Governance Operating Model & AIMS
Implementing an AI management system aligned with ISO/IEC 42001
From a governance concept to a workable operating model: together we translate requirements into clear roles, decision paths, processes, controls and evidence, aligned with ISO/IEC 42001 and existing management systems.
When is this the right engagement?
Moving from assessment to implementation
A gap assessment or an initial policy exists, but responsibilities, processes and controls still need to be built and embedded in the organisation.
Inconsistent governance
AI use cases are assessed locally, approvals are inconsistent and evidence is distributed across several functions.
Integration rather than parallel structures
AI governance needs to connect with data protection, information security, risk management, procurement, compliance and existing management systems.
Management oversight and audit preparation
Decisions, controls and their effectiveness need to be documented in a traceable way and regularly reviewed by management.
What we build
Scope and governance architecture
Define the AI management system scope, central principles and interfaces with existing management and control systems.
Roles and governance bodies
Clarify responsibilities, decision rights, escalation paths and practical collaboration between business, IT and control functions.
AI lifecycle and controls
Establish processes and checkpoints from an initial idea through assessment, development or procurement and approval to operation, monitoring, change and retirement.
Documentation and evidence
Create a manageable set of policies, process descriptions, decision templates, control evidence and management reporting.
Capabilities and adoption
Enable the relevant roles and integrate governance into existing working practices and decision routines.
What you receive
A documented AI governance operating model with defined roles, governance bodies, processes, controls and interfaces.
An AIMS architecture aligned with ISO/IEC 42001 and tailored to the organisation and its actual risk context.
Practical templates for assessment, approval, monitoring, escalation and management review.
A prioritised implementation roadmap with owners, milestones and criteria for reviewing effectiveness.
Approach
1. Target state and scope: agree the ambition, boundaries, interfaces and key governance decisions.
2. Design: develop the operating model, roles, processes, controls and required documentation together.
3. Implementation: pilot the model on concrete use cases, adapt existing practices and introduce the agreed governance components.
4. Adoption and review: enable the roles involved, establish management review and assess practical effectiveness.
Engagement scope
Typically four to nine months. Scope depends on organisational size, the existing governance landscape and the required level of implementation.
Implementation is carried out with the responsible functions. Specialist matters are coordinated with internal or external experts in law, data protection, information security and audit as needed.
Governance becomes effective in operation
The objective is a workable system for decisions, controls and continuous improvement. Engagements are available from 2 November 2026.