What to outsource for ISO 42001 and what to keep in-house

If a customer or contract requires ISO/IEC 42001, keep leadership, accountability, the AI policy, and the AI risk and impact decisions inside your organization. An implementation partner can prepare systems, documentation and evidence, and can help you build the controls. Only an independent certification body issues a certificate, because ISO does not certify organizations itself. Any proposal that promises a certificate from the consultant, or puts the policy and risk acceptance decisions in the consultant's hands, should be treated as a warning sign.

The exact split depends on the scope of your AI management system, the number of AI systems and suppliers in that scope, and how much of the work already exists. A company with one customer-facing model and a few well-documented vendors will hand off very different work than a company running many internally built systems. Start by listing the decisions that the statement of applicability under clause 6.1.3 requires you to justify, including the inclusion or exclusion of each Annex A control. That justification is a management judgment and should be signed off by your own people, even when a partner drafts it.

Supplier work needs its own allocation. Control A.10.2 asks you to ensure that responsibilities across the AI system life cycle are allocated between your organization, partners, suppliers, customers and other third parties, and A.10.3 asks for a process that checks whether what you obtain from suppliers aligns with your approach to responsible AI. Ask a partner to map these responsibilities into written contracts and supplier review steps, but confirm internally who approves each supplier and who monitors them after signature. Ask the partner to state in writing which evidence it will produce and which items remain your team's to collect.

Which ISO 42001 decisions must stay with your leadership

ISO/IEC 42001 treats adopting an AI management system as a strategic decision, integrated with existing management structures. The decisions below cannot be handed to a consultant, a supplier or a certification body, and each one becomes an audit question that someone in your organization must answer.

Approving the AI policy

Clause 5.2 requires an AI policy that top management approves and communicates. A consultant can draft the text, but the policy states what your leadership commits to on responsible AI development and use. Check that the policy names the accountable executive, the scope of AI systems it covers, and the commitments your teams will be measured against. Reference control A.2.2 then requires the policy to be aligned with other organizational policies, so review it against your existing security and risk policies before approval.

Demonstrating top management commitment

Clause 5.1 expects top management to show leadership and commitment to the AI management system through visible action, not paperwork. Assessors look for evidence that executives set AI objectives, provide resources, and direct the system's continual improvement. Ask your leadership team to name the specific meetings, budget decisions and escalations where they reviewed AI governance. A partner can prepare these records, but the attendance and decisions must be genuinely theirs.

Owning the statement of applicability

Clause 6.1.3 requires a statement of applicability that lists the Annex A controls you need and justifies including or excluding each one. Organizations are not required to implement every control, so the choices reflect your AI risks and context. Your leadership must approve these justifications, because an exclusion that cannot be defended is a finding. Ask your partner to draft the justifications, then verify each one against your actual AI systems and suppliers.

Accepting AI risks and impacts

The impact assessment and risk treatment outputs are only useful if someone with authority accepts the residual risk. Decide who signs off on each high-impact AI system, what level of residual impact is tolerable, and when a system must be paused or redesigned. An implementation partner can run the assessments and document the findings, but a consultant cannot accept risk on your behalf. Record each acceptance with a name, date and the reasoning behind it.

Approving supplier and life cycle allocation

Control A.10.2 asks the organization to allocate AI life cycle responsibilities between itself, its partners, suppliers, customers and other third parties. Deciding who owns data quality, model monitoring, incident communication and decommissioning is a business decision that shapes contracts and accountability. Your leadership should approve the allocation and the contract terms that reflect it. Outside help can map responsibilities, but the commercial and legal accountability remains yours.

Conducting final management review

Clause 9.3 requires top management to review the AI management system at planned intervals and decide on improvements. This review is the point where leadership confirms the system still fits the business, and it is one of the first things an assessor checks. Schedule the review as a standing agenda item, record the decisions and actions, and track them to closure. A partner can prepare the review pack, but the conclusions and resulting changes must come from your leadership team.

Who does what across your team, a partner and the certification body

Your organization owns the AI management system and every decision it records. ISO/IEC 42001 expects top management to make adopting the system a strategic decision and to integrate it with existing processes and management structures. Accountability for the AI policy, objectives, risk acceptance, the statement of applicability and the management review cannot be handed to a partner or a vendor, because those are the points an assessor will ask a named person to defend.

Leadership and policy: Top management approves the AI policy, sets objectives and chairs the management review, as clause 5.2 and the leadership clauses require.
Scope and applicability: Your team decides which Annex A controls apply, and the justification for each inclusion or exclusion in the statement of applicability under clause 6.1.3.
Risk and impact decisions: Owners accept AI risks and sign off impact assessments for the systems they run.
Operations and evidence: Your staff run the controls day to day, such as logging, human oversight and change approval, and keep the records.
Internal audit: Your own people, or an internal auditor who is not responsible for the work being audited, perform the internal audit.

Before you engage anyone, confirm which of these roles already have named owners and which are still open.

How to allocate AI life cycle responsibilities with suppliers

Control A.10.2 asks your organization to make sure responsibilities across the AI system life cycle are allocated between you, your partners, suppliers, customers and other third parties. In practice, this means writing down who owns each stage for each AI system you build, buy, host or deploy: data sourcing, model selection, testing, deployment, monitoring, incident handling and retirement. Start with a single responsibility matrix per system, and have the business owner, the engineering lead and procurement sign off on it. Where a vendor's documentation says it handles something (for example, model updates or abuse monitoring), record that claim and confirm it in the contract rather than assuming it. The allocation must be written down, not implied by a vendor's product page.

Control A.10.3 asks for a process that checks whether the services, products and materials you obtain from suppliers align with your approach to responsible development and use of AI. This is where procurement and your AI policy meet. Intake questions should cover data origin, training and evaluation practices, security testing, incident notification and how the supplier handles changes to the model. The NIST AI RMF to ISO/IEC 42001 crosswalk, contributed by Microsoft and posted by the NIST AI Resource Center with NIST stating that posting is not an endorsement, maps AI RMF GOVERN 6.1 (third-party AI risk policies, including intellectual property), GOVERN 6.2 (contingency plans for failures in high-risk third-party systems) and MANAGE 3.1 to B.10.2. Use it as a starting point to check your own mapping, and confirm the mapping against the current standard text.

Cloud and AI vendor certificates, such as Microsoft's ISO/IEC 42001 coverage for its AI systems and AWS's certification of its AI management process within a stated scope, support your assessment but do not replace it. Microsoft states that customers remain responsible for engaging an assessor to evaluate their own controls and implementation, and AWS states that customers are not automatically certified by association, although a provider's certification may make your own work easier. Ask each supplier for the exact scope of its certificate, the date of the audit report, and which of your systems fall inside that scope. Your own assessment then covers your configuration, data, use cases and the controls the vendor leaves to you, and the result belongs in your statement of applicability.

Assessor work your certified provider will not do for you

A certification body issues the certificate, but it cannot run the management system for you. The cards below cover the work that must come from your own people, and the independence rules that keep the people who prepared your system apart from the people who assess it.

Internal audit under clause 9

Clause 9 requires you to audit your AI management system at planned intervals and report the results to management. The auditor cannot perform this for you and then certify the same work. Assign internal auditors who did not build the controls they test, and keep a written plan, findings and corrective actions. Ask your implementation partner to show you a sample audit file so your team can repeat the process without outside help.

Management review under clause 9

Top management must review the AI management system at planned intervals, covering open risks, audit results, objectives, and changes in AI use. Minutes, decisions and owners for each action are the evidence an assessor will sample. A partner can draft the agenda and the reporting pack, but the meeting, the decisions and the signature belong to your leadership team.

Impact assessments under A.5

The A.5 controls require you to assess the impacts of each AI system on individuals, groups and society, and to document the results. These judgments depend on your products, users and affected parties, so they must be made and owned inside your organization. An outside partner can supply a method and templates, but the risk acceptance decisions must stay with named accountable staff.

Evidence kept current for surveillance

Surveillance audits sample evidence from the period since the last visit, so records must be produced continuously rather than assembled before an audit. Model changes, data sources, supplier reviews and incident logs all need dated entries. Confirm with your certification body how it samples records and how far back it will look, and assign an internal owner for each evidence stream.

Independence from the certification body

The body that certifies you must be independent of anyone who performed your internal audit. European Accreditation FAQ 49.4 explains this rule for ISO/IEC 27006-1 clause 5.2.2, the closest analogue to ISO 42001 certification. ISO/IEC 42006:2025 adds requirements for bodies certifying AI management systems. Ask any certification body whether it will also consult for you, and keep preparation and assessment with separate firms.

Where outside help fits in the ISO 42001 project

The sequence below runs from the scoping decision through the certification body's two audits, showing for each phase what gets produced and who owns it. Outside help supports the organization's own work, and only the certification body issues the certificate.

Decide scope and assign internal ownership
Top management decides whether to adopt an AI management system and defines which AI systems, products, teams and suppliers fall inside it. The organization owns this decision and names an accountable executive and an internal programme lead before any partner is engaged. ISO/IEC 42001 treats adoption as a strategic decision and expects the AI management system to fit into existing management structures, so the scope statement should reference those structures. A partner can draft the scope options, but the output is an approved scope document signed off by the organization. The step is done when leadership has approved the scope and the named owners have accepted their roles.
Run the gap analysis against clauses 4 to 10
The organization or a partner compares current practice with the requirements in clauses 4 to 10 and with the Annex A controls. The partner typically drafts the gap list, but the organization validates each finding against how AI work is actually done in its teams. The output is a gap register that records each gap, its owner and the internal decision on how to close it. Gap analysis is advisory and does not produce a conformity finding. The step is done when the register is accepted by the programme lead and the executive owner.
Write the statement of applicability
The organization lists the Annex A controls it considers necessary and records a justification for including or excluding each one, as clause 6.1.3 requires. The organization owns every inclusion and exclusion decision, including the justification for any control it omits. A partner can help structure the document, but it should not be presented as the organization's own position unless leadership has reviewed and adopted it. The output is an approved statement of applicability that matches the scope and the gap register. The step is done when the document is version-controlled and signed off by the accountable executive.
Implement controls and produce evidence
Control owners in the organization implement the selected controls, such as the AI policy, impact assessments, life cycle records, data records and supplier allocation of responsibilities under A.10.2. Partners may configure tooling, prepare templates and build evidence collection, but control operation stays with the organization. Supplier processes under A.10.3 and life cycle responsibilities need written agreements with AI vendors. The output is a set of operating records for each control, with dates, owners and reviewers. The step is done when a sample of each control can be traced from the statement of applicability to a record that someone other than the author has reviewed.
Complete internal audit and management review
The organization runs its own internal audit of the AI management system and holds a management review that considers audit results, objectives, incidents and changes. The internal auditor must be independent of the people who prepared the controls, and a partner that helped build the system should not be the only reviewer. The output is an internal audit report, documented corrective actions and minutes of the management review. The step is done when the corrective actions are tracked to closure and leadership has recorded its decisions. Keeping this work in-house is what allows the certification body to test the organization's own oversight.
Check impartiality before the preliminary audit
Before engaging a certification body for a preliminary or stage 1 review, the organization checks whether the body or its auditors have also advised on the system. European Accreditation FAQ 48.11 and FAQ 49.2 explain how preliminary audits and related impartiality risks are handled, and FAQ 49.2 describes measures to manage those risks. The organization should ask the body in writing how it manages conflicts of interest and who will not be allowed to act on both sides. The output is a documented impartiality check and a written conflict statement from the body. The step is done when the organization has filed both and has confirmed that the consultant and the auditor are separate.
Pass the certification body's stage 1 and stage 2 audits
The independent certification body reviews the documented system at stage 1, then tests implementation and effectiveness at stage 2. The organization answers auditor questions, provides access to records and staff, and owns any nonconformities and corrective actions. A partner may attend as a preparer but should not answer for the organization or speak as its assessor. Only the certification body can issue a certificate, and ISO does not certify organizations. The output is the certification body's audit report and, if the findings allow, a certification decision. The step is done when the body issues its decision in writing and the organization records the certificate's scope.

In-house, partner-supported or fully outsourced: which fits

This table compares three ways to deliver an ISO 42001 programme, showing when each fits, where accountability is at risk, and what to settle in writing before work starts. Read each column as a model, not a promise: no delivery model guarantees certification, because the independent certification body decides that.

Model	When it fits	Accountability risk	Settle in writing before work starts
Fully in-house	Your team already runs an ISO management system, has staff who understand AI systems and data, and can give AI governance enough time from named owners.	Gaps often come from unclear ownership of impact assessments, supplier obligations and evidence collection, which can slip when the same people run product delivery.	Named owners for each Annex A area, the internal audit schedule, and who signs the statement of applicability under clause 6.1.3.
Partner-supported	Your staff own the AI policy, risk decisions and sign-offs, but need help preparing systems, gap analysis, documentation and evidence in your own environment.	Staff may assume the partner's work equals the organization's control. The organization still owns every decision, and the partner cannot accept risk on its behalf.	Which deliverables the partner prepares, which decisions remain with named staff, how evidence is handed over, and who reviews it internally.
Outsourced delivery with heavy partner involvement	Your team lacks capacity or experience, and a partner runs most of the implementation work across systems, documentation and internal audit preparation.	Leadership accountability, the AI policy, risk acceptance and supplier decisions cannot be outsourced. Heavy reliance can leave staff unable to explain or maintain the system later.	Written split of responsibilities, staff time commitments, knowledge transfer milestones, and what the partner will not do, such as acting as internal auditor or issuing certificates.
Certification body role (any model)	Always required. The independent certification body conducts the audit and decides certification, under accreditation where available.	A partner who also performs your internal audit may create an impartiality conflict that a certification body must assess. Confirm independence early.	Confirm with the certification body which preparation activities it accepts from consultants, and that the same person does not perform both internal audit and implementation.
Supplier and AI vendor inputs (any model)	Used when AI vendors or cloud providers supply part of your AI system life cycle or evidence.	Under A.10.2, responsibilities must be allocated across partners and suppliers. Vendor certificates do not transfer automatically to your organization.	Which life cycle responsibilities each supplier holds, what evidence they provide, and how you verify it against your own controls.
Internal audit and management review	Needed in every model because clause 9 expects the organization to check its own system.	If the implementation partner also audits the system, the internal audit loses independence and may not be accepted as evidence.	Who performs internal audits, their independence from implementation work, and who receives and acts on the findings in management review.
Ongoing operation after the project	Applies to every model, since the AI management system must be maintained and continually improved after initial work ends.	Once a partner leaves, the organization must still operate controls, update impact assessments and respond to changes in AI systems.	Whether the partner provides ongoing support under a separate agreement, what it covers, and which internal roles take over maintenance.

What blurs the split and delays certification

Most delays in ISO 42001 work come from a small set of boundary mistakes: decisions that drift to the wrong party, supplier duties nobody allocated, and certificates or auditors that were never independent. Each card names one failure, why it matters for the split, and the check that prevents it.

Partner writes the AI policy

When an implementation partner drafts the AI policy and nobody on the leadership team reviews it, the policy describes what the consultant expects rather than what the organization will do. Clause 5.2 expects top management to establish the policy, and the statement of applicability under A.2.2 must trace back to it. Check that a named executive has read, edited and approved the policy, and that the approval is minuted. Illustrative example: a policy that promises human review of every high-impact decision, when no team has been assigned to perform that review.

Risk acceptance by an outside party

Risk acceptance decisions, including which residual AI risks the organization will carry and which impacts it will accept, belong to the accountable manager. A partner can model options, score risks and recommend treatments, but a partner that signs off acceptance has taken a management decision it cannot be held to. Record each acceptance with a named owner, the date, the reasoning and the review trigger. Confirm that the owner can explain the decision to an assessor without the partner in the room.

Unallocated life cycle duties

Under A.10.2, responsibilities across the AI life cycle must be allocated between the organization, its partners, suppliers, customers and other third parties. When a model provider updates weights, retrains or changes its logging, and the contract says nothing about who tests, documents and reports the change, gaps appear at the boundary. Map each life cycle stage to an owner in a responsibility matrix, and write those allocations into supplier and customer contracts before go-live.

Relying on a vendor certificate

A supplier's ISO/IEC 42001 certificate covers the supplier's own management system within its stated scope. Microsoft states that customers remain responsible for having an assessor evaluate their own controls, processes and implementation, and AWS states that customers are not certified by association. Treat the vendor certificate as one input to the statement of applicability, then test the organization's own use, configuration, data handling and human oversight against the controls it claims.

Certifier that also built the system

A certification body that performed the gap analysis, wrote the controls or configured the AI system cannot give an impartial opinion on it. European Accreditation's FAQ 49.4 explains that the certification body must be independent of whoever performs the client's internal audit under the related ISO/IEC 27006-1 rules, with no two-year mitigation period. Ask each bidder to confirm in writing which implementation, consulting and internal audit work it has performed for you, and keep implementation and certification with separate firms.

Preliminary audit used as a dress rehearsal

When the certification body also runs a preliminary audit or repeated stage 1 review, the same firm may suggest fixes that become its own implementation advice, which blurs impartiality. European Accreditation guidance describes measures to manage these impartiality risks during preliminary audits. Ask the certification body how it separates readiness advice from certification decisions, and whether any preliminary findings will be written up in a form the assessor can rely on at stage 1 and stage 2.

Questions buyers ask before hiring outside help for ISO 42001

Can we do ISO 42001 ourselves without a consultant?

Yes, in principle. ISO/IEC 42001 is a management system standard, and the organization owns its AI policy, risk and impact assessments, controls and evidence. Nothing in the standard requires an outside firm. The practical question is whether your team has the time, the AI and security knowledge, and the internal audit and management review capacity to run the system continuously. Before deciding, read the clauses 4 to 10 requirements and the Annex A controls against your current AI use, and confirm with the certification body you plan to use what evidence it will sample. A partner is most useful when your team lacks a gap analysis baseline or needs to build evidence quickly.

Which parts of ISO 42001 can a consultant not do for us?

A consultant cannot take ownership of the AI management system or make the decisions it documents. The organization must set the AI policy under clause 5.2, assign accountable roles, decide the statement of applicability under clause 6.1.3, accept residual AI risk, and run management review. Life cycle responsibilities with suppliers must be allocated by you under A.10.2. Only an independent certification body can issue a certificate, and it cannot be the firm that built your system. Consultants can prepare evidence and train staff, but they should not sign or attest to your controls.

What drives the cost of outside help and what should the quote include?

Cost depends on how much of the system is new, how many AI systems and suppliers are in scope, and how much work your staff can absorb. Quotes usually split into one-time work (gap analysis, policy and control design, impact assessments, evidence set-up, internal audit support) and recurring work (surveillance support, updates, review). The certification body's fees are a separate line paid to that body, not to the consultant. Ask any provider for a written scope listing the AI systems covered, the Annex A controls addressed, deliverables, who performs each task, what the client must supply, and what is excluded. DeployOpen does not publish a price list; a quote follows from the written scope. No figures are given here.

How much time does our organization need to commit?

The time commitment depends on your starting point, the number of AI systems in scope and how many internal people must review and approve work. Your leadership must commit to the policy and management review. Process owners must document how AI systems are built, used and monitored, and your engineers must supply technical records and logs. Ask a provider to name the internal roles and approximate hours it expects from each, and to state which tasks depend on your responses. No duration is given here, so treat any timeline as unverified until it is tied to a written scope and a named certification body schedule.

Can the firm helping us prepare also be our certification body?

No. The organization preparing your system and the body that certifies it must be independent of each other. ISO does not certify organizations; external certification bodies do, and ISO/IEC 42006:2025 sets additional requirements for bodies certifying AI management systems on top of ISO/IEC 17021-1. Independence rules also reach the people. European Accreditation's guidance on the related ISO/IEC 27006-1 explains that a certification body must be independent of whoever performed the client's internal audit, including freelance auditors. Ask any certification body to confirm in writing how it handles conflicts of interest before you share evidence with a partner.

Do vendor certificates from AI providers cover our own AI use?

Only partly. Microsoft says customers that need ISO/IEC 42001 certification for implementations of Microsoft AI systems can use its certification in their compliance assessment, but they remain responsible for engaging an assessor to evaluate their own controls, processes and implementation. AWS states that customers are not automatically certified by association, though AWS's certification within its specified scope may make a customer's own certification easier. Vendor certificates cover the vendor's scope, not your policies, impact assessments, roles or the AI systems you build. Review each vendor's scope statement and map its coverage against your own statement of applicability.

Which life cycle and supplier duties should we allocate in contracts?

Under A.10.2, you must allocate responsibilities across the AI system life cycle between your organization, partners, suppliers, customers and other third parties. Under A.10.3, you must have a process ensuring that services, products or materials from suppliers align with your approach to responsible development and use. In practice, a contract or responsibility matrix should state who handles data provenance, model documentation, incident communication, change notices and contingency for supplier failures. A consultant can draft the matrix, but the allocation must be agreed with each supplier and approved by you.

How DeployOpen scopes and prepares ISO 42001 evidence

DeployOpen plans, implements and documents self-hosted open-source platforms and prepares systems and evidence for an ISO/IEC 42001 assessment, inside your own cloud accounts, data centers or air-gapped networks. The work runs under a fixed scope agreed in writing before any work starts, so the deliverables, the systems covered and the timelines are known to both sides before the first change is made. Where the scope touches your AI policy, your Annex A control selections in the statement of applicability, or your impact assessment conclusions, those decisions remain yours. DeployOpen can build the records, configure the tooling and assemble the evidence that supports them, but it does not decide them.

DeployOpen does not issue audit reports, attestations or certificates. Only an independent certification body can certify your AI management system, and only the auditor it assigns can test your controls. Before you commit, ask any implementation partner, including DeployOpen, to state in its written scope which items it prepares and which items belong to your team or your certification body. Confirm with the certification body whether it has any preliminary audit or readiness review in its process, and whether the partner's role creates any independence question under its own rules. Keep the partner's staff separate from the people who will later conduct your internal audit.

Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work is complete. A retainer suits the periods when your AI systems, suppliers or platforms change and the evidence needs to be kept current for the next surveillance or recertification review. It does not change who owns the controls, and it does not guarantee any assessment outcome. Ask for the retainer terms in writing, including what is covered, how changes to scope are handled and who signs off on the evidence before it goes to an assessor.

What to outsource for ISO 42001 and what to keep in-house