A staff member pastes customer information into a public chatbot. A recruitment tool filters out an applicant without anyone being able to explain why. A marketing team publishes AI-written claims that have not been checked. These are not distant enterprise problems. They are everyday decisions that show why companies ask how ISO 42001 applies to companies using AI tools.

ISO 42001 is the international standard for an Artificial Intelligence Management System, or AIMS. It gives organisations a practical framework for governing AI properly: setting responsibilities, understanding risks, checking outcomes and improving controls over time. For UK SMEs, it is not about turning every employee into a data scientist. It is about using AI in a controlled, accountable way that customers, staff and regulators can trust.

How ISO 42001 Applies to Companies Using AI Tools

ISO 42001 can apply whether your business builds AI products, embeds AI into software, or simply uses third-party tools such as generative chatbots, transcription platforms, HR screening systems, customer-service assistants and analytics packages. The depth of your system should reflect the scale, purpose and risk of your AI use.

That distinction matters. A small design agency using an AI assistant to produce first drafts does not need the same level of technical assessment as a software firm deploying an AI model that influences lending, medical decisions or recruitment. But both businesses need clear rules around data, human oversight, accuracy and accountability.

The standard asks a simple commercial question: can you demonstrate that your organisation understands how AI is being used and has proportionate controls in place? If a client, tender assessor or insurer asks who approved an AI tool, what data it receives, or how its output is checked, you should have a reliable answer rather than a collection of informal habits.

It covers AI use, not just AI development

Many firms assume ISO 42001 is only relevant if they create algorithms. In reality, a company can be an AI user and still carry meaningful responsibility. If your team enters personal, confidential or commercially sensitive information into a tool, you need to know where that data goes, what the supplier does with it and whether the tool is suitable for the task.

Likewise, if employees rely on AI-generated answers to advise customers, write policies, make personnel decisions or assess compliance, the business remains accountable for the result. The fact that a tool produced the output does not remove the need for professional judgement.

ISO 42001 helps turn these concerns into a managed process. It does not ban useful tools. It helps you decide where they are appropriate, where human approval is required and where their use should be restricted.

What an AI management system looks like in practice

An AIMS should fit the way your business works. For an SME, this is usually a focused set of policies, registers, assessments and review activities rather than a large corporate manual.

Start by defining the scope. You might cover all AI tools used across the business, or begin with a higher-risk area such as customer data, HR, finance or software delivery. A sensible scope is clear about which teams, processes, systems and locations it includes.

You then need an AI inventory. This is a current record of the tools in use, their intended purpose, the supplier, the types of data involved, the person responsible and the level of risk. It often reveals more than expected. Staff may be using browser-based tools under individual accounts that were never assessed or approved.

For each significant use case, carry out an impact and risk assessment. Consider not only cyber security and data protection, but also inaccurate outputs, bias, lack of explainability, intellectual property concerns, unsafe advice and damage to customers or your reputation. The aim is not to eliminate every risk. It is to identify the realistic ones and choose controls that make sense.

For example, an AI tool used to summarise internal meeting notes may require restricted data inputs and a quick human check. An AI system that ranks job applicants needs much closer scrutiny, defined approval authority, testing for unfair outcomes and a clear route for people to challenge a decision.

The controls SMEs usually need

The right controls depend on your risk assessment, but most companies using AI tools will need a combination of documented rules and day-to-day checks. These may include an acceptable-use policy, approved-tool process, data-handling guidance, human-review requirements, staff training, supplier assessments and an incident process for when something goes wrong.

Staff awareness is particularly valuable. Employees should know not to enter confidential client information into unapproved tools, treat generated content as factual without checking it, or use AI to make sensitive decisions without authorised oversight. A short, clear policy that teams understand is more effective than a lengthy document left unread.

ISO 42001 also expects senior management involvement. This does not mean directors need to approve every prompt. It means leadership sets the policy, assigns ownership, provides resources and reviews whether the system is working. Someone must be accountable for keeping the AI register current, responding to concerns and making sure controls are followed.

Supplier checks are central when you use third-party AI

Most SMEs will not train their own models. They will rely on external providers, which makes supplier management a major part of ISO 42001 implementation.

Before approving a tool, assess what it does with your information, whether it uses inputs to train its models, where data is processed, what security measures are available and how the supplier handles incidents. You should also consider service availability, contractual terms, intellectual property ownership and how easily the business could stop using the tool if needed.

A supplier’s popularity is not evidence that it is appropriate for every business use. Free consumer versions and paid business versions can have very different privacy, administration and retention settings. Your assessment should reflect the version your staff will actually use.

Keep records of the decision and review it when the supplier changes its terms, features or model. AI services develop quickly, so a one-off check at procurement stage is rarely enough.

ISO 42001 and other ISO standards

For many businesses, ISO 42001 will sit alongside existing management systems rather than operate alone. If you already work to ISO 9001, the ideas of documented processes, responsibilities, internal audits, corrective action and management review will be familiar. ISO 27001 provides a useful foundation where AI use involves confidential information, access controls and supplier security.

An integrated approach reduces duplication. The same document-control process can govern AI policies; the same internal audit programme can test AI controls; and the same management review can consider quality, information security and AI performance together. The key is to add AI-specific risks and objectives rather than copy another standard without adapting it.

This can be especially useful when a customer asks for evidence of responsible AI alongside quality or information-security assurances. Certification will not make an unsuitable AI use case safe, but it gives your organisation a credible structure for evaluating and managing it.

A practical route to ISO 42001 certification

The fastest route is usually to begin with a gap assessment against your current AI use. Identify the tools in play, decide your scope, assess the most material risks and set practical controls. From there, create the core AIMS documents, train relevant staff, gather evidence that the controls operate and carry out an internal review before certification assessment.

Do not over-engineer the system. An organisation with five employees and three approved tools needs a proportionate management system, not an enterprise governance department. Equally, avoid a paper-only exercise. Auditors will expect to see that your policies influence real decisions, including tool approval, staff behaviour, incident handling and management oversight.

A digital-first implementation can keep the workload manageable. ISO-Cert Online supports SMEs with customised templates, consultancy guidance and a central portal to organise documents, actions and progress without unnecessary site visits or disruption.

When ISO 42001 is worth prioritising

Certification is most compelling where AI affects customers, personal data, regulated activity, hiring, financial decisions or core service delivery. It can also strengthen tender responses where buyers want assurance that suppliers are adopting AI responsibly.

For lower-risk internal use, the business case may be more about getting ahead of unmanaged adoption. A clear AI management system lets you gain productivity benefits while protecting customer trust and avoiding avoidable mistakes. As AI becomes embedded in ordinary software, knowing what your organisation permits, monitors and reviews will become a practical business advantage.

Start with the AI tools your people are already using this week. A clear inventory, sensible approval rules and visible human accountability will give you a stronger foundation than waiting for every technology question to be answered.

Ready to get started?

Contact us today on +44 (0)333 014 7720 or email info@isocertonline.net for a free consultation. You can also get a quote online in minutes.

Don’t let cost hold you back from achieving ISO certification. With ISO-Cert Online, management systems certification is affordable for every business.