WhatsApp and Telegram +44 7563 115980
[email protected]
ISO/IEC 42001, the EU AI Act, SOC 2, ISO/IEC 27001 and the buyer security reviews that decide enterprise deals, for firms that build, buy or sell AI.
Firms that build, buy or sell AI now answer to two audiences: the regulator, through the EU AI Act and sector rules, and the enterprise buyer, through certification and security review.
| Deliverable | What it contains | Who relies on it |
|---|---|---|
| AI inventory and risk register | Every AI system the firm develops, buys or embeds, with risk classification and owner | Board, buyers, auditors |
| Readiness assessment | Gaps against ISO/IEC 42001, the EU AI Act and buyer requirements, prioritised | Board, compliance |
| AI management system | Scope, risk methodology, statement of applicability, controls and evidence | Certification body |
| Internal audit report | Findings, severity, owners and closure evidence | Board, certification body |
| EU AI Act scoping memo | Systems in scope, risk category, obligations and documentation by system | Board, legal |
We advise on ISO/IEC 42001, the EU AI Act, SOC 2 and ISO/IEC 27001, and on the client and buyer reviews that decide enterprise deals.
We run the programme with your compliance function, or as the outsourced senior function. We have advised regulated businesses on authorisation, compliance and regulator engagement since 2013, and senior specialists lead each engagement from first assessment through certification and ongoing assurance.
AI systems, policies and evidence assessed against the standard being measured, with the gaps and what certification or client review will require.
A full register of the AI the firm develops, buys or embeds, each system classified by risk with an accountable owner.
The AI management system designed and set up: scope, risk methodology, statement of applicability, controls and supporting evidence.
The annual internal audit ISO/IEC 42001 and ISO/IEC 27001 require, carried out independently and reported to management or the board.
Evidence and staff prepared for the Stage 1 and Stage 2 audits, attended through to certification.
The systems in scope identified, classified by risk category, and the obligations and documentation each attracts mapped.
CAIQ, SIG, due diligence and bespoke AI questionnaires answered from approved evidence, with reusable answers for later reviews.
Governance, risk assessment, human oversight, data governance, third-party AI and incident handling policies prepared and reviewed.
Evidence kept current between audits: control re-testing, evidence refresh, regulatory change monitoring and questionnaire responses.
| Deliverable | What it contains | Who relies on it |
|---|---|---|
| Questionnaire answer library | Approved answers and evidence for CAIQ, SIG, due diligence and AI questionnaires | Sales, buyers |
As amended by the Digital Omnibus on AI, approved by the Council of the EU on 29 June 2026.
The Act reaches firms outside the EU that place AI systems on the EU market or whose AI output is used in the EU. ISO/IEC 42001 certification runs on its own cycle: a Stage 1 and Stage 2 audit by an accredited certification body, annual surveillance audits and recertification every three years, with an internal audit each year. Our guides on ISO/IEC 42001 certification and AI governance for financial services cover each step.
Yes, where a firm places an AI system on the EU market, puts it into service in the EU, or uses AI whose output is used in the EU. UK and US firms selling to EU customers are in scope for those systems.
From 2 December 2027 for the high-risk systems listed in Annex III, which include credit scoring and life and health insurance pricing, and from 2 August 2028 for high-risk AI built into regulated products, following the Digital Omnibus on AI.
Certification is issued by an accredited certification body. We prepare the AI management system and the evidence, prepare staff for the Stage 1 and Stage 2 audits and attend them through to certification.
ISO/IEC 42001 and ISO/IEC 27001 both require an internal audit each year, which the certification body cannot perform. We carry it out with a team independent of any implementation work and report to management or the board.
They share a management system structure. A firm certified to ISO/IEC 27001 or reporting under SOC 2 reuses its governance, risk and evidence processes, and adds the AI-specific controls, impact assessments and lifecycle requirements.
Yes. We answer CAIQ, SIG, due diligence and bespoke AI questionnaires from approved evidence, and build a library of reusable answers that shortens every later review.