Skip to content
NZSNextZen SecuritySecure AI engineering

Service

AI Governance and ISO/IEC 42001 Readiness

Make AI use accountable across the tools you build, buy and discover in use. Establish an AI inventory, review governance against ISO/IEC 42001 and NIST AI RMF, and set the evidence you require from every supplier running AI on your data.

Who it is for

Organisations deploying or buying AI whose customers or regulators now ask how it is governed.

When clients call

  • A customer questionnaire asking about AI governance
  • Teams using AI tools without approval
  • A supplier adding AI features to a product you already run
  • A procurement or board request for documented AI risk controls

Scope

  • AI system inventory, including shadow, supplier and embedded AI
  • Clauses and Annex A controls of ISO/IEC 42001:2023
  • NIST AI RMF function mapping
  • Supplier AI claims, data handling and contractual evidence requirements
  • Regional AI obligations

Method and standards

  • ISO/IEC 42001:2023
  • NIST AI RMF 1.0
  • ISO/IEC 27001:2022 supplier relationships

Deliverables

  • AI system and supplier register
  • Gap register
  • AI policy set
  • Remediation plan

Engagement arrangements

Dates, responsibilities and any ongoing review cadence are agreed in the written scope. Retesting is included where stated in that scope.

What happens after the scoping call

Written scope and fixed-fee proposal within one business day of your scoping call. The scope names the standards applied, the deliverables, the dates and the people doing the work.

Questions

Does ISO/IEC 42001 certification establish legal compliance?+

No. ISO/IEC 42001 is an AI management system standard. Applicable obligations in the United States are assessed separately for the systems in scope.

Does this cover the AI our suppliers run on our data?+

Yes. Supplier and embedded AI is a named workstream: vendor claims are checked against documentation and contracts, and the evidence you require at renewal is defined for each supplier.

How is the fee set?+

The written proposal defines the fixed fee, responsibilities and deliverables. Any change to scope is agreed in writing before additional work begins. Ongoing advisory includes an agreed review cadence and availability.

How is our evidence handled?+

Evidence is held under NDA, encrypted at rest and in transit, restricted to the named engagement team and destroyed on the schedule stated in the scope. It is never used to train any model.

Tell us what changed.

Thirty minutes, no obligation. Written scope and fixed-fee proposal within one business day of your scoping call.

Book a Strategic AI Readiness Assessment