Compliance tools · AI, digital commerce and consumer protection

Toolkit for ISO 42001

ISO/IEC 42001:2023 · European Union and United Kingdom · Voluntary standard

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Toolkit for ISO 42001 documentation cited clause by clause. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Toolkit for ISO 42001 is ISO/IEC 42001:2023, a voluntary standard in the European Union and United Kingdom. AI management system standard. Strong evidence of AI Act readiness. The toolkit runs alongside your own licensed copy of the ISO standard.

The free assessment screens for Toolkit for ISO 42001 when a business develops, supplies or uses AI systems.

This is a voluntary standard rather than binding law. Businesses adopt it because customers, insurers or public buyers ask for it.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Toolkit for ISO 42001: what is in place, what is missing, and what to do about each gap.
• Documentation with clause citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the standard requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Toolkit for ISO 42001 applies to your business, free →

Does Toolkit for ISO 42001 apply to my business?

ISO/IEC 42001:2023 applies to you if your organisation develops, provides, or uses AI systems and wishes to demonstrate responsible AI management. The standard is sector-agnostic, so private companies, public bodies, and not-for-profit entities may all seek conformity or certification.

Who does ISO 42001 apply to?

It applies to any organisation that develops, provides, or uses AI systems and wishes to demonstrate responsible AI management. It is applicable to all sizes and types of organisations across all sectors, including commercial, governmental, and non-profit entities that have a role in the AI supply chain or deploy AI-enabled products and services.

Does Toolkit for ISO 42001 apply to a small business?

No size threshold applies. The standard is explicitly scalable to small and medium-sized organisations, and Annex guidance acknowledges proportionate adoption, with certification able to serve as a market-access credential or supply-chain assurance signal for SMEs acting as AI vendors, integrators, or deployers.

When does ISO 42001 apply from, and what are the deadlines?

ISO/IEC 42001:2023 was published on 18 December 2023 and imposes no statutory reporting deadlines. Certification runs on a two-stage audit, surveillance audits at approximately 12-month and 24-month intervals, and a full recertification audit every three years, with internal audits at planned intervals under Clause 9.2.

What does ISO 42001 require me to do?

You must establish, operate, maintain, and improve an AI management system meeting Clauses 4 to 10, consider every Annex A control during risk treatment, and document inclusion or exclusion in a Statement of Applicability under Clause 6.1.4. Top management must set an AI policy under Clause 5.2 and assign AIMS roles under Clause 5.3.

What records or documents does ISO 42001 require me to keep or produce?

You must keep documented information under Clause 7 and a Statement of Applicability recording your decision on every Annex A control under Clause 6.1.4. You must also produce AI risk assessment records under Clause 8.2, AI impact assessments under Clause 8.4, internal audit results under Clause 9.2, and management review records under Clause 9.3.

What happens if I do not comply with ISO 42001?

ISO is not a regulator and imposes no fines. A minor nonconformity requires corrective action, typically within 90 days, while a major nonconformity may stop the certificate being issued or continued until resolved, typically within six months, and unresolved major nonconformities or a missed surveillance audit can lead to suspension and then withdrawal.

Does Toolkit for ISO 42001 apply to a UK business selling into the EU?

The standard is international with no geographic restriction, so a UK business selling into the EU can seek certification. The IAF Multilateral Recognition Arrangement provides mutual recognition of certifications issued by accredited bodies in signatory countries, so organisations do not need separate certifications for different markets.

Does Toolkit for ISO 42001 apply to an EU business selling into the UK?

The standard is international with no geographic restriction, so an EU business selling into the UK can seek certification. In the United Kingdom it is published through BSI, and a certificate issued by a UKAS-accredited body is recognised by accreditation bodies in all other IAF MLA signatory countries.

How do I start complying with ISO 42001?

The first practical step is to define the context of the organisation under Clause 4, which opens the Plan phase of the Plan-Do-Check-Act cycle. From there you establish leadership under Clause 5 and planning including AI risk assessment and treatment under Clause 6.

Which ComplianceSME account includes the Toolkit for ISO 42001 toolkit?

The Toolkit for ISO 42001 agent toolkit is included from the Medium level.

Related in AI, digital commerce and consumer protection: EU AI Act · Digital Services Act · Digital Markets Act · Product Liability Directive