AI Governance and ISO/IEC 42001

Over the past several months, working with organisations at different stages of AI adoption, I've been looking closely at AI governance, and specifically at what ISO/IEC 42001 means in practice for leadership teams under real pressure to move fast.

Most companies are under pressure to “implement AI”. The focus is often on productivity, automation and keeping pace with competitors.

But adoption is already happening, sometimes without anyone formally deciding that it should.

AI governance isn’t just an issue for software engineering teams.

Consider:

• Which business systems have introduced AI features through routine upgrades?

• Are employees connecting AI assistants to email, messaging or collaboration platforms?

• Is confidential, customer or commercially sensitive information being entered into public AI tools?

• Are development teams using AI-generated code without appropriate review or security testing?

• Can the organisation explain which AI systems it uses, what data they access and who is accountable for their outputs?

Without suitable governance, organisations risk exposing intellectual property, personal data, security information and customer data. They may also make decisions based on inaccurate, biased or poorly understood outputs.

A practical starting point is not necessarily certification. It is gaining visibility and establishing proportionate control.

Based on this, I believe there are ten areas every organisation should address — not as a compliance exercise, but as a foundation for using AI with confidence:

1. Create an inventory of AI systems, including AI embedded within existing software and cloud services.

2. Define approved tools, permitted uses and prohibited data.

3. Assign clear ownership and accountability for every significant AI use case.

4. Assess risk and impact, including security, privacy, legal, ethical and operational concerns.

5. Maintain meaningful human oversight, particularly where AI influences important decisions.

6. Review suppliers, models, integrations and data flows, not just the application’s headline functionality.

7. Test, monitor and record how AI systems perform throughout their lifecycle.

8. Train employees to recognise AI risks, verify outputs and report incidents.

9. Integrate AI governance with existing security, privacy, supplier-management and software-development processes.

10. Review controls regularly as systems, models, regulations and business uses evolve.

The objective is not to slow AI adoption, it is to ensure that enthusiasm does not outpace the organisation's ability to understand, manage and stand behind what it deploys.

The first question for many leadership teams may therefore be:

“Do we actually know where AI is already being used across our organisation?”