01
AI risk assessment
Identify and treat the risks an AI system creates for your organisation.
ISO/IEC 42001:2023
Govern the AI you build and buy, in the same place as the rest of your compliance.
ISO 42001 is the first management system standard for AI. CyberPlug maps it next to ISO 27001, so your AI risk and your security risk share one set of owners and evidence.
- Standard
- ISO/IEC 42001:2023
- Type
- AI management system
What it is
What ISO 42001 asks of you
ISO 42001 is an international standard for running an AI management system. It asks an organisation that develops, provides or uses AI to set policy, assess AI risk and impact, and manage AI systems across their life cycle.
Like ISO 27001, it is audited by an accredited certification body, and it follows the same management-system structure, so the two fit together.
Who needs it
- Organisations that build AI products.
- Regulated institutions that use AI in credit, fraud, customer service or compliance decisions.
What it covers
Three areas at the centre of the standard
02
AI impact assessment
Assess the effect of an AI system on the people it touches.
03
AI system life cycle
Govern a system from design and data through deployment and retirement.
The problem
AI risk that nobody has written down
- Teams adopt AI tools before anyone records what data they see or who is accountable.
- AI risk lives in a slide deck separate from the security risk register.
- Nobody can show a regulator how an AI decision was reviewed by a person.
How CyberPlug helps
AI governance beside your security governance
- 01
AI risk in the same register
Log AI risks next to your security risks, with likelihood, impact, an owner and mitigation tasks followed to closure.
- 02
Controls mapped once
ISO 42001 requirements link to the controls you already run for ISO 27001, such as access control, supplier management and incident handling.
- 03
Policies drafted and approved
Draft an AI policy from a framework-tailored template or upload your own. A person approves it and every version is recorded.
- 04
A person approves everything
At CyberPlug, AI drafts and flags and a named person approves, and customer evidence is never used to train public models.
- 05
Readiness you can see
A live readiness score shows which controls still lack evidence and who owns each one. Your auditor gets read-only access.
Path to ready
From AI inventory to certification audit
- 1
List every AI system you build or use
Record its owner and the data it sees.
- 2
Assess AI risk and impact
Score each system and record how people are affected.
- 3
Put your security foundations in place
Do it under ISO 27001, which ISO 42001 builds on.
- 4
Run and evidence the controls
Connect your systems and upload what has no API.
- 5
Sit the certification audit
An accredited certification body audits you. CyberPlug prepares the evidence and does not issue the certificate.
CyberPlug covers steps 1 to 4 inside the platform. Your certification body runs step 5.
One control, many frameworks
AI governance builds on information security
Access control, supplier management and incident handling serve both standards, so ISO 27001 evidence is a head start.
FAQ
Questions we hear most
Does CyberPlug certify us?
No. An accredited certification body issues ISO 42001 certificates. CyberPlug prepares your controls and evidence so that audit goes faster.
Do I need ISO 42001 if I use AI tools but do not build AI?
The standard covers organisations that use AI too. Whether to certify depends on your customers and regulators.
Does it replace ISO 27001?
No. ISO 42001 builds on information security, and the two share a management-system structure. CyberPlug maps them to one set of controls.