Artificial Intelligence Management System (AIMS)
ISO 42001 Consulting Services

Phase I - Scope and Context

• Understanding the client’s business and their relation with AI (developer, user or both)
• Define Organizational AI Boundaries: Coral will assist in identifying AI systems, use cases, and business areas covered under ISO 42001, considering internal and external stakeholders.
• Understand regulatory and ethical Landscape: Our team will analyze applicable laws, industry standards, and ethical considerations to align AI governance with compliance requirements.

Phase II – AI inventory, Impact Assessment, and Gap Analysis

• AI System inventory: A structured record of all AI systems developed, used, or integrated within the organization to ensure visibility, governance, and oversight of AI activities.
• AI Impact assessment: Coral will analyse each AI use case, and determine its impact on the individual, group or society.
• Evaluate the current AI governance framework: Our team will assess existing AI policies, risks, and controls against ISO 42001 requirements to identify gaps.
• AI risk assessment: Coral will analyze AI system risks related to bias, transparency, accountability, privacy, and security to prioritize corrective actions.

Phase III – AIMS Design

• This phase represents the design stage of the AI Management System (AIMS). Based on the organization’s context, defined scope, role in the AI ecosystem, and the AI solutions it develops or uses, the applicable objectives and controls are determined.
• This assessment is performed both at the organizational level and at the level of each AI solution, since every AI use case carries different risks and considerations.
• For example, using ChatGPT as a productivity tool requires a different set of controls compared to building a chatbot using the ChatGPT API, where additional controls related to system design, monitoring, and user transparency may apply.
• This step forms the core design phase of the AIMS, where governance requirements are translated into controls tailored to each AI use case.

Phase IV – Policy, Procedures, and Practice Definition

• Coral will develop AI governance policies: Our ISO 42001 experts will establish policies covering responsible AI use, ethical considerations, risk management, and compliance alignment.
• Define Operational Procedures: Our team will create guidelines for AI model lifecycle management, human oversight, bias mitigation, and stakeholder engagement.

Phase V – Implementation and Monitoring

• Deploy AI risk controls and accountability measures: Coral ISO 42001 specialists will assist in implementing technical and organisational changes, such as fairness checks, explainability tools, and human-in-the-loop mechanisms.
• Establish Continuous AI System Monitoring: Our responsible AI experts will implement real-time monitoring and periodic assessments to detect unintended AI behaviour, bias drift, or performance deviations.

Phase VI - Measurement, Internal Audit and Management Review

• Our team will assist in establishing measurable indicators of AI fairness, accuracy, reliability, and compliance to track the effectiveness of AI systems.
• An independent ISO 42001 auditor will conduct internal audits to assess the effectiveness of AI governance, adherence to policies, and risk mitigation strategies.
• Finally, Coral will facilitate a management review that shows the degree of compliance achieved, a key step before approaching the external audits.

Summary: At this stage, the organisation has successfully implemented the baseline requirements for achieving ISO 42001 certification.

Phase VII - External Audit Support

• Certification bodies conduct audits in two phases: phase I and phase II. Phase I is a documentation audit, where they will verify the completeness of the documentation in line with the organisational context and applicable requirements. In phase II, they will verify the effectiveness of the implemented controls.
• Facilitate engagement with external auditors: Coral will support client representatives in engaging with external auditors by providing transparency into AI governance practices to ensure successful ISO 42001 certification.
• Upon successful completion of the audit, the auditors will issue an ISO 42001 certificate valid for three years.