ISO/IEC 42001 readiness for an AI management system
Paul Okhrem's ISO 42001 consulting for enterprise teams starts at USD 80,000 for an 80-hour engagement. He helps define the management-system scope, name owners, assess gaps and organize the work. Paul does not issue certificates. Certification is a separate decision by an independent certification body. The consulting scope does not guarantee that result.
Price: USD 1,000 per hour, 80-hour minimum, USD 80,000 floor. Delivered personally by Paul Okhrem. Reply within two business days. Read the published terms.
What ISO/IEC 42001 covers
ISO/IEC 42001:2023 sets requirements for an AI management system. They cover how to set it up, run it and keep improving it. The standard concerns how an organization manages AI. It does not mean every model or output is safe.
Use the licensed standard for its full requirements. This guide gives an original structure for readiness work. It does not reproduce the standard or replace an auditor's interpretation.
What a readiness review should produce
| Work area | Practical output | Evidence to review |
|---|---|---|
| Scope and context | Boundaries, interested parties and covered AI activities | Scope statement and system inventory |
| Leadership | Accountable roles, policy and decision rights | Approvals, responsibilities and management decisions |
| Planning | Risk, impact and objective-setting processes | Assessments, treatment decisions and measurable objectives |
| Support | Resources, competence and controlled documentation | Training, communications and document records |
| Operation | Working lifecycle and supplier processes | Review gates, tests, procurement and change evidence |
| Performance review | Monitoring, internal audit and management review | Findings, decisions and follow-up |
| Improvement | Corrective action and a repeatable review cycle | Root-cause work, closed actions and effectiveness checks |
Map each gap to the applicable clause or control in the licensed standard. Do not mark an item complete merely because a document exists.
When readiness support is useful
Readiness support fits leaders who need a clear scope, owners and evidence of how their AI processes work.
- Customers ask how the business governs AI and want evidence.
- Several teams use AI, but no one owns the full management process.
- Policies exist, but there is little proof that teams use them.
- The business needs a defined certification scope and a plan it can carry out.
- Leaders want to connect security, privacy and quality processes with AI work.
This work does not fit a request for a badge without working processes. It does not certify a single AI-generated answer. For a basic use policy, start with the free AI policy template. Add a governance framework that fits the scope and risk.
A practical path from gap review to audit preparation
- Confirm scope. Agree which entities, systems and activities are included.
- Review existing evidence. Reuse working security, privacy, vendor and quality processes where they fit.
- Rank the gaps. Name an owner, due date and evidence needed for sign-off.
- Run the processes. Collect records from real decisions and reviews.
- Run internal assurance. Arrange an internal audit with appropriate independence, and a management review.
- Prepare for external assessment. Close known gaps and agree the certification body's process separately.
Paul can coordinate the readiness work and executive decisions. The client remains responsible for its management system. Use safeguards so independent assurance does not become a consultant marking their own work.
Need a decision, not a report? Send a private brief. Paul replies within two business days.
Send a private briefReadiness evidence register
Download the free readiness register. Record the relevant standard reference, owner, evidence, gap and due date. The reference field is left blank on purpose. The correct mapping depends on your scope and licensed standard.
Use the AI risk method to organize system risks. Use the EU AI Act checklist for separate legal questions.
ISO 42001 does not replace EU AI Act duties. For classification and evidence, see EU AI Act consulting.
Scope, fees and certification boundaries
Paul Okhrem's consulting is USD 1,000 per hour with an 80-hour minimum, a USD 80,000 engagement floor. The written scope sets the outputs, required evidence and who owns each task. Certification-body fees, legal advice and delivery-team costs are separate unless expressly included.
Timing depends on scope, how the system works today and what evidence is still needed. This page does not promise certification in a fixed number of weeks. See pricing and engagement terms and AI governance consulting.
Questions about ISO/IEC 42001 readiness
Does Paul Okhrem certify an organization to ISO/IEC 42001?
No. Paul supports readiness and oversees the work within the agreed scope. An independent certification body handles the separate assessment and certification decision.
Does ISO/IEC 42001 certification prove every AI output is correct?
No. The standard addresses an AI management system. It does not guarantee every model, output or use case is safe or correct.
What does ISO 42001 readiness consulting cost?
Paul Okhrem's consulting costs USD 1,000 per hour with an 80-hour minimum and USD 80,000 floor. The written scope sets the readiness work, evidence and responsibilities. Certification-body fees, legal advice and delivery-team costs are separate unless included. Certification remains an independent decision and is not guaranteed by the consulting engagement.
Does ISO readiness replace EU AI Act compliance work?
No. Management-system requirements and legal obligations are different. Identify the applicable legal duties separately with qualified advisers.
Change log
- : Reviewed copy, source boundaries and supporting resources.
- : Reviewed service scope, source evidence, links and buyer answers for the October release.
Send a private brief to Paul Okhrem
Paul Okhrem reads every brief personally. Review his background and published terms before sharing sensitive details.