Your developers use AI to write code. Your support team uses it to answer tickets. Your sales team uses it to draft proposals. In most IT companies, AI arrived quietly, without a policy, a register or a named owner.
That works until a client asks a simple question: how do you govern the AI you use on our project? ISO 42001 (formally ISO/IEC 42001) gives IT and software companies a clear, auditable answer. This guide explains what the standard requires, what responsible AI looks like in practice, and how to govern your AI in a managed, repeatable form.
The problem: shadow AI is outpacing AI governance
IT teams use AI more than any other sector, and mostly without approval. This unapproved use is known as shadow AI. A September 2026 TrustedTech survey of 2,001 UK and US employees found that 73% of IT and telecoms workers use unapproved AI tools, even though 84% understand the security and privacy risks. 57% said their company has no clear guidance on AI use (IT Brief).
For a software or IT services company, unmanaged AI creates four concrete risks:
- Client data exposure. Source code, credentials or customer records pasted into public AI tools leave your control and can become a data breach.
- Unreviewed AI-generated code. AI-written code that skips application security testing, licence checks or code review ships into client products.
- No audit trail. When something goes wrong, you cannot show which AI was used, by whom, or with what checks.
- Unanswered client questions. Security questionnaires and RFPs increasingly ask how you govern AI. “We trust our team” is not an answer.
Banning AI does not solve this. The same survey found 48% of IT and telecoms workers would keep using AI tools even if their employer banned them. The fix is governance, not prohibition.
What is ISO 42001?
ISO/IEC 42001 is the world’s first international standard for an AI management system (AIMS). Published in December 2023, it sets out how an organization establishes, runs and continually improves the way it governs AI (ISO). In simple terms, ISO 42001 does for AI what ISO 27001 does for information security.
Four things IT leaders should know:
- It covers building and using AI. It applies to companies that develop AI products and to companies that use AI tools in their daily work.
- It is certifiable. An accredited certification body audits your AI management system and issues a certificate your clients can verify.
- It fits what you already run. It shares the management system structure of ISO 27001: context, leadership, planning, support, operation, evaluation and improvement. An ISO 27001 company can extend its existing system instead of starting over. It also works alongside the voluntary NIST AI Risk Management Framework.
- It is risk-based, not a checklist. Annex A offers 38 controls across 9 objectives, from AI policy and impact assessment to data quality, the AI lifecycle and third-party AI. You apply the controls your risks call for and justify each choice in a Statement of Applicability.
Responsible AI use in practice
Responsible AI is not a slogan. It is a set of habits your team can prove to a client or an auditor. ISO 42001 turns each of these principles into a documented, checkable control.
| Principle | What it looks like in an IT company |
|---|---|
| Accountability | Every AI tool and AI feature has a named owner who answers for it. |
| Transparency | Clients know where AI is used on their project, and end users know when they are dealing with AI. |
| Data protection | Client code, credentials and personal data never enter AI tools that are not approved for them. |
| Human oversight | A qualified person reviews AI output before it reaches production or a client. |
| Fairness | AI features that affect people, such as CV screening or credit scoring, are tested for bias before launch. |
| Reliability | AI systems are tested before release, monitored in operation and have a rollback plan. |
Responsible use does not slow teams down. It gives them clear rules, so they can use AI openly and confidently instead of in secret.
How to govern your AI in managed form
Managed form means AI governance runs as a system, not a one-time policy document. It has owners, routines and records, and it repeats. ISO 42001 builds this on the Plan-Do-Check-Act cycle used across ISO management systems.
A managed AI governance system works in seven steps:
- Discover. Build an inventory of every AI tool, model, API and AI feature in use, including the ones teams adopted on their own. You cannot govern what you cannot see.
- Set policy and ownership. Approve an AI use policy, define which tools are allowed for which data, and assign an owner to each AI system.
- Assess risk and impact. For each AI system, assess what could go wrong for your company, your clients and the people affected, using the same discipline as ISO 31000 risk management.
- Apply controls. Put the right controls in place: an approved tool list, data handling rules, human review of AI-generated code and checks on third-party AI suppliers.
- Train people. Make sure developers, support and sales staff know the rules and the reasons behind them.
- Monitor and audit. Log AI incidents, review performance, run internal audits and hold management reviews.
- Improve. Feed what you learn back into policy and controls. Then the cycle repeats.
The difference between a policy and a managed system is evidence. A managed system produces records: an AI register, risk assessments, approvals, logs and audit reports. That evidence is exactly what clients and certification auditors ask to see.
Why ISO 42001 matters for IT and software companies
For IT companies, AI governance is fast becoming a condition of doing business, not an optional extra.
- It earns client trust. Enterprise clients now ask vendors how they control AI. A certified AI management system answers with evidence, not promises.
- It prepares you for the EU AI Act. The Act reaches companies outside the EU whose AI systems or outputs are used in the EU. Bans on prohibited AI practices and AI literacy duties have applied since February 2025, and transparency rules since August 2026. After the EU’s Digital Omnibus, obligations for high-risk AI systems listed in Annex III apply from 2 December 2027 (European Commission). That is preparation time, not a pause, and ISO 42001 builds much of the groundwork.
- It matches regional direction. Pakistan’s National AI Policy 2025, approved by the federal cabinet in July 2025, prioritizes data security and ethics and calls for alignment with international AI regulations (Profit). In Saudi Arabia, the Saudi Data and Artificial Intelligence Authority (SDAIA) oversees both data and AI. For IT exporters serving clients in the US, UK, EU and the Gulf, an international standard is the common language.
- It builds on ISO 27001. Companies that already hold ISO 27001 can extend their existing management system instead of running two separate programs.
- It sets you apart in bids. A verifiable certificate separates you from vendors who can only say they use AI responsibly.
How Catalyic Security helps you get ISO 42001 ready
Catalyic Security already delivers governance, risk and compliance services for standards such as ISO 27001, ISO 31000 and ISO 22301. We bring the same approach to AI, helping IT and software companies govern their AI in managed form, from the first assessment to certification and beyond.
- Gap assessment. We measure your current AI use and controls against ISO 42001 and show you exactly what is missing.
- AI inventory and risk assessment. We map every AI tool and system in use and assess its risks and impacts.
- Policies and controls. We design an AI policy, an approved tool list and controls that fit how your teams actually work.
- Training. We help developers, support and sales teams use AI responsibly and understand why the rules exist. Security leads can build deeper skills through our training and certification programs.
- Certification readiness. We run internal audits and prepare you for the audit by an accredited certification body.
- Managed governance. After certification, we keep your AI management system running with regular reviews, monitoring and continual improvement, as part of ongoing support such as our virtual CISO service.
Start governing your AI today
AI is already part of how your company builds and delivers. The real question is whether you can prove it is under control. ISO 42001 gives you the framework. Catalyic Security gives you the managed path to get there.
Book an ISO 42001 readiness assessment with Catalyic Security and find out where your AI governance stands today.
FAQs
Is ISO 42001 mandatory?
No. ISO 42001 is a voluntary international standard. Companies certify because clients, partners or regulators expect proof that their AI is governed.
Does ISO 42001 apply if we only use AI tools and do not build them?
Yes. ISO 42001 applies to any organization that develops, provides or uses AI-based products or services, including companies that only use third-party AI tools.
Do we need ISO 27001 before ISO 42001?
No. They are separate standards. Because they share the same structure, an ISO 27001 certified company can extend its existing management system and move faster.
Does ISO 42001 certification mean EU AI Act compliance?
Not automatically. The EU AI Act is law with its own requirements. ISO 42001 gives you the management system, records and controls that make meeting those requirements far easier.
How many controls does ISO 42001 have?
Annex A lists 38 controls across 9 objectives. You apply the ones your AI risks call for and document the reasoning in a Statement of Applicability.