Build an AI management system your team can operate and explain. We support you from the initial assessment through AIMS documentation, implementation guidance, internal audit and certification preparation, with clear responsibilities at every stage.
Start with a Readiness Assessment from $5,000 per engagement to understand your AI inventory, governance gaps and priorities. Choose the Full Readiness Program for all assessment deliverables plus AIMS documentation, implementation guidance, internal audit and certification preparation.
Free 30-minute consultation. No obligation. A 16–24-week readiness program that gives your team a clear route from assessment to certification preparation.
01
Every ISO 42001 engagement is led by Temi, with 20+ years of security, audit and governance experience and more than 100 assessments across industries. Temi’s consulting experience includes Amazon, Walgreens and Humana.
CISA · CISM · CRISC · CDPSE · PCI-QSA Connect on LinkedIn →
LinkedIn recommendations
Temi is an incredibly thorough GRC professional with an impressive command of PCI requirements. During our time working together, I was consistently impressed by her ability to navigate complex audit workflows and provide clear, actionable insights. She is a dedicated expert who brings high standards of professionalism to every project.
I’ve had the privilege of working alongside Temi, and I can confidently say she is one of the most reliable and technically proficient GRC and IT Security professionals I have partnered with. Her expertise spans SOX compliance, IT risk management, security controls, and governance frameworks, and she consistently brings clarity, structure, and rigor to every engagement.
Temi has a rare ability to translate complex regulatory requirements into practical, actionable controls that strengthen organizational resilience. Her attention to detail, strong analytical mindset, and commitment to high-quality execution make her an invaluable asset to any team. Beyond her technical strengths, she is collaborative, solutions-oriented, and trusted by stakeholders across the business.
Temi is GRC professional who has exhibited top level IT security risk and audit competence by leading high visibility, high impact projects building frameworks and implementation of systems that have improved the safety and reliability of business operations in global organizations. I have interacted with Temi on tangential projects and I can attest to her professionalism, commitment and leadership.
I had the privilege of being mentored by Temi during my transition from a general tech role into the security field, and I can confidently say her guidance made a significant difference in my journey.
Temi has a rare ability to support and uplift others in whatever capacity she can. She helped me not only understand complex security concepts and frameworks, but also gain practical, real-world exposure to the role. She taught me how to think like a security professional - from communicating security concepts to cross-functional teams with varying levels of understanding, to reviewing and analyzing security documentation for accuracy and completeness.
What stood out most was her genuine investment in my growth. Whether it was recommending resources, connecting me with a trainer to deepen my knowledge, reviewing my learning path, or sharing valuable industry insights, she was always generous with her time and expertise.
If you’re looking for a mentor or security leader who truly empowers others, I highly recommend Temi. I’m incredibly grateful for her support and the lasting impact she has had on my career.
Recommendations as published on LinkedIn, shown with the recommender's name and headline at the time of writing.
02
A buyer asking about responsible AI needs answers your sales, product and risk teams can support. Start with the request driving the work and the evidence needed to answer it.
Procurement wants to know your certification status and the plan ahead. We help you establish your current position, document the work needed and set out the next steps. Your team can explain completed milestones, current priorities and the route toward certification.
Your existing information security controls provide a useful foundation. AI use also raises questions about intended purpose, effects on people, data suitability and oversight of changing systems. We identify the additional governance work and connect it to the records your team already maintains.
Engineering, product, privacy and legal may each own part of an AI decision. We bring those responsibilities into a clear review process so the right people can approve a new use or material change. The assessment identifies who needs to decide, what evidence they need and when another review is appropriate.
03
ISO/IEC 42001:2023 is an international standard for an artificial intelligence management system, or AIMS. It applies to organizations that develop, provide or use AI. An AIMS brings responsibilities, risk decisions and operating processes into a management system that can be reviewed and improved over time.
ISO 42001 certification is a voluntary assessment by an independent certification body. We prepare your management system and team for that assessment through the Full Readiness program.
Readiness gives you a documented view of your current position, the work ahead and the evidence your team can use in customer and certification discussions.
04
A customer asks which AI systems your governance program covers. A useful answer connects the product to the model behind it, the information it can access and the people who approved its use. We help you make those connections across systems your team builds and AI features supplied by other providers.
We work with the people responsible for the agreed AI portfolio to connect each AI use to its business purpose, dependencies and operating responsibilities. We include relevant agents, third-party models and AI-enabled features within that boundary, recording what is known and the supplier information still to obtain. The resulting inventory gives procurement, engineering and risk teams a shared starting point for the assessment.
| Record | Why it matters |
|---|---|
| Purpose and use | Identify the intended use, deployment context and decisions influenced by the output. |
| Responsibility and approval | Name the people responsible for the business use and technical operation and the person responsible for approving use. |
| Models and suppliers | Record provider, model, API, retrieval and tooling dependencies relevant to the scoped system. |
| Data and affected people | Identify data categories, permitted-use questions and people or groups who may be affected. |
| Autonomy and review | Document what the system can do and who can intervene, challenge or stop its use. |
| Change triggers | Identify model, data, supplier or use changes that call for another review. |
The inventory also supports change management. A different model, expanded data access or a new automated action can prompt the person responsible for that AI system to revisit an earlier decision. We identify these review triggers and track supplier-information requests so the register remains useful as your portfolio develops.
05
When a buyer or auditor asks how AI governance works, your team needs to connect the policy to a real decision. For a feature that accesses customer records, that means identifying the person responsible for the feature, the access approval and the supporting evidence. When a supplier changes the underlying model, it means showing how that change was reviewed. We organize the assessment around those practical questions so your team can explain the controls in operation.
We assess the management-system requirements and the controls relevant to your risks, looking for the connection between a stated rule, the person responsible for the control and evidence of operation. In the Full Readiness Program, we use the findings to develop the scoped AIMS documentation and guide implementation. The review covers the following questions; unresolved decisions and missing evidence become tracked actions.
| Area | Evidence and decisions reviewed |
|---|---|
| Leadership and scope | AI policy, objectives, accountable roles, organizational boundaries and leadership decisions. |
| Risk and impact | Assessment methods, affected groups, risk decisions, treatment actions and reassessment triggers. |
| Data and lifecycle | Data suitability records, evaluation evidence, release approvals, change records and retirement responsibilities. |
| Human oversight | Review procedures, intervention authority, user information and escalation arrangements. |
| Supplier relationships | Due diligence, responsibility boundaries, relevant supplier evidence and material-change notifications. |
| Performance and improvement | Monitoring inputs, incident and complaint records, management review and corrective actions. |
Clear accountability helps a release decision reach the right person. We review roles, objectives and escalation routes, together with evidence that the people assigned to those roles understand their responsibilities. Management receives a clear view of the decisions it needs to assign or approve.
A well-supported AI decision considers both the business purpose and the people it affects. We help the people responsible for AI decisions document the purpose, affected people or groups, relevant risks and impacts, and the basis for accepting or treating them. Changes in use or new evidence provide clear triggers to revisit the decision.
Your team needs a clear view of the information a system uses and the provider responsibilities behind it. We review records supporting data suitability, permitted use and supplier responsibilities, and identify the information the people responsible for data and supplier reviews should request or refer for specialist review.
As the system changes, its approvals and evidence need to stay current. We review how design, release, monitoring, model and supplier updates, and retirement are governed. The people responsible for AI changes can show who reviewed each material change and how resulting actions were handled.
Effective human oversight gives people a clear role and a practical way to act. We review the documented responsibilities, user information and intervention or escalation routes relevant to the use. We help the people responsible for human oversight establish the arrangements and retain evidence of how they operate.
Complaints, incidents, review findings and overdue actions need to reach someone who can make a decision. We review how those inputs are tracked, how management sees the significant issues and how corrective actions are followed through. That gives the AIMS a way to improve as the portfolio changes.
Your governance team needs to understand what the AI system can do in its operating environment. An assistant that retrieves restricted documents or takes actions through connected tools needs clear access decisions and approval routes. We help the people responsible for AI access and approvals connect those permissions to the evidence supporting them: what the system can access, which actions require approval and who reviews the result.
We connect available specialist findings to the system version, operating environment, risk owner and corrective action. Your team can see which findings support the current configuration, which actions need attention and what evidence will support the next review.
We provide implementation guidance and coordinate evidence priorities with the people responsible for the controls and technical specialists. Connecting specialist findings to those responsibilities gives management a clearer basis for deciding what needs attention before the next review.
06
If your team already maintains an ISO 27001 program, a second set of assigned responsibilities, policies and review meetings can make AI governance harder to operate. The practical question is which existing records can support both programs and which AI-specific decisions still need attention.
We review the relevant management-system structure, responsibilities and evidence before developing new documentation. Where an existing process genuinely covers the requirement, we connect the AIMS to it. Where it does not, we identify the additional analysis, approvals or records needed. For example, a supplier review may already address information security while still needing evidence about the intended AI use and the information your team relies on from the provider.
| Existing foundation | AI governance work to connect |
|---|---|
| Policy and leadership reviews | AI policy, objectives, risk acceptance and oversight responsibilities. |
| Asset and supplier records | AI system inventory, model dependencies and relevant supplier responsibilities. |
| Security risk management | AI risk and impact assessment with criteria appropriate to the use and affected people. |
| Change and incident processes | AI release decisions, material changes, monitoring inputs and escalation. |
| Audit and management review | AIMS scope, performance evidence, findings and corrective actions. |
We connect useful information security evidence to the AI-specific decisions your team needs to make about impacts, appropriate use and oversight. The people responsible for both programs can see which records serve both programs and where additional evidence is needed.
07
The starting point is the decision driving the work: a customer questionnaire, procurement deadline, internal approval or plan to seek certification. We connect that request to the AI systems in use and the governance work required. Portfolio complexity, the significance of each use and supplier relationships help us shape the right program.
We shape the program around your portfolio and the decisions your team needs to make. The situations below show how the work supports different buyers and operating teams.
An enterprise prospect asks how you approve AI-enabled features, protect customer information and control changes made by model suppliers. Your sales team needs answers that product and engineering can substantiate. We connect the agreed features to the people responsible for them, dependencies and evidence so your response describes the program you actually operate and the work still underway.
A model used in a financial workflow or health-related product brings business, privacy, legal and domain expertise into the decision. We help organize that review, document the purpose and supporting evidence, and identify the specialist input the decision-makers need. Your team gains a clear record of the decisions, responsibilities and next actions.
When AI influences candidate screening, ranking or another people-related decision, buyers may ask how the system is overseen and how an affected person can raise a concern. We help the people responsible for the AI use document the use, the people affected, the review responsibilities and the evidence supporting the chosen safeguards. Where further legal or specialist evaluation is needed, the roadmap makes that dependency explicit.
Your security team already runs audits and management reviews, but product teams now need a consistent way to bring AI decisions into that structure. We identify reusable records, add the AI-specific assessment work and clarify responsibilities across product, engineering, security, privacy and legal. The aim is a program your existing teams can operate with clear ownership.
08
Two proposals can both promise ISO 42001 readiness while assigning very different work to your team. One may end with findings; another may include documentation and implementation guidance but leave audit preparation unclear. A low starting price is difficult to evaluate until you know what evidence, support and handoff it covers.
A documentation-only proposal may be appropriate when your team already has the capacity to implement, gather evidence and arrange its own audit. If you need support across those stages, compare it with a full-readiness program that carries findings into documentation, implementation guidance and audit preparation. Also compare whether existing records will be integrated, who will own the system after handoff, whether regulatory mapping is actually included and when the final fee will be confirmed. Those differences help you identify the support and expertise your program needs.
Our Full Readiness offer carries the work through assessment, AIMS documentation, implementation guidance, internal audit and certification preparation. The questions below help you compare the support you will receive and how responsibilities will be assigned.
| Buying question | What to establish with us |
|---|---|
| Which systems will you review? | Named systems, entities, dependencies and review depth in the written scope. |
| Will you use our existing records? | Relevant evidence to reuse and the AI-specific gaps requiring additional work. |
| Will you implement or test changes? | Agreed delivery responsibilities and any separately arranged technical work. |
| Who conducts the internal audit? | A competent, objective reviewer and safeguards against reviewing their own work. |
| What happens after the report? | A handoff to the people responsible for the next steps, 30 days of follow-up access and separately agreed ongoing support. |
| What is the final commercial commitment? | Deliverables, assumptions, fees, payment terms and third-party costs confirmed before work begins. |
| Will you integrate our existing program? | Which ISO 27001 records can support the AIMS, what AI-specific work remains and who owns each shared process. |
| How will you handle regulatory questions? | Which legal mapping is expressly in scope, which facts need counsel and how management-system work is kept distinct from legal conclusions. |
| What evidence supports your assessment? | The operating records and relevant specialist findings reviewed, their limitations and unresolved dependencies. |
09
A report is only useful if someone can use it to make the next decision. Leadership needs to see which issues require resources, product owners need to know what changes to address, and the people answering customer questions need an accurate account of progress.
We organize the engagement materials around those needs. The Readiness Assessment gives you the inventory, findings, roadmap and management readout described below. The Full Readiness Program includes all of those deliverables and carries the findings forward into AIMS documentation, implementation guidance, internal audit and certification preparation.
A register of the reviewed systems, their purposes, responsible people, suppliers and relevant data context, with a clear assessment boundary. Your team can use it to explain what the program covers and identify when a new use or dependency needs review. Supplier-information requests and ownership decisions are tracked for follow-through.
A documented view of your current management system, the evidence reviewed and the work needed to prepare for assessment. The people responsible for the work can see which documents, operating records and decisions require attention and how each finding connects to the next step.
A sequenced view of recommended actions, the people proposed to carry them out, dependencies and the evidence needed to close gaps. This lets you discuss implementation priorities with the people who will do the work and see where a supplier response, specialist review or management decision is holding progress.
A management discussion of significant risks, unresolved decisions and resource needs. Leadership can see what has been completed, what remains open and which responsibilities need to be assigned before the program moves forward.
The Full Readiness Program adds scoped AIMS policies, accountability records, risk and impact assessment documentation, control records and review processes. We guide implementation, help establish control ownership and organize evidence and remediation priorities. If you do not have an internal team, we provide hands-on governance support and coordinate the technical expertise needed to put the program into practice.
The Full Readiness Program includes internal audit and certification preparation to bring those materials together for review. We work with your external assessor, coordinate evidence, help with assessor questions and evidence requests, and participate in assessment discussions to support you through the certification process.
10
Your 16–24-week Full Readiness program takes you from the initial assessment through documentation, implementation guidance, internal audit and certification preparation. The phases below give your team a clear sequence of activities, decisions and evidence to prepare.
We establish milestones with the people responsible for the readiness work so they can see what happens next, which records to prepare and where decisions are needed. We guide implementation and coordinate the evidence your team will use in the certification assessment.
We begin with the customer requirement or internal decision driving the engagement. With the people responsible for your AI systems, we establish which systems, entities and dependencies are in scope, what the systems are intended to do and which records already exist. Stakeholder interviews and evidence review identify gaps against the relevant requirements.
This phase produces the working inventory, assessment findings and priorities for the full program. We identify ownership decisions, supplier-information requests and legal questions early so each can be assigned and addressed as the program progresses.
We develop the scoped policies, responsibilities, risk and impact assessment records, control documentation and review processes. The people responsible for the AI systems and business decisions contribute the operational detail and make the decisions that belong to the business. Suitable ISO 27001 records are reused to support the relevant requirements.
The work explains how reviews are initiated, who approves the outcome and what evidence must be retained. That gives the team a documented basis for handling the agreed AI uses and for recognizing when a change needs another decision.
We work with your team to guide implementation, establish control ownership and organize evidence. If you don’t have an internal team, we provide hands-on governance support and coordinate the technical expertise needed to move your readiness program forward.
As implementation progresses, we track actions and decisions with the people responsible for them. We coordinate specialist-input needs and review the operating records, helping management see progress and prepare for the next stage.
We coordinate the included internal audit, support management review and track corrective actions. We work with your external assessor, coordinate evidence, help with assessor questions and evidence requests, and participate in assessment discussions to support you through the certification process.
The handoff brings together the scope, key records, audit findings and open actions so your team can explain its position. The people responsible for the next steps leave with a clear view of the evidence prepared and the actions still needing attention.
You have 30 days of follow-up access for questions about the agreed deliverables and recommended next steps. This gives the people responsible for the program a route to clarify the handoff while they continue operating the program.
A certification assessment asks your team to explain how the management system works. We help the people responsible for the controls connect their records to the decisions, reviews and corrective actions behind them, so they can prepare for that conversation.
11
We coordinate the internal audit included in the Full Readiness Program so the findings give management a clear basis for action. We help organize the evidence, address findings and prepare the people responsible for the controls for discussions with your external assessor.
For certification preparation, we organize the scoped inventory, assessment records, control decisions, audit results and open-action log. Each key record needs a named person who can explain how it is used. This helps your team prepare for questions about operation as well as documentation.
We help you prepare for the certification-body discussion with a clear scope, organized evidence and questions about recognition, availability and the assessment process.
A buyer may ask about ISO 42001 and the EU AI Act in the same conversation. Your AIMS provides organized records of systems, responsibilities and decisions that can support regulatory preparation. Your roles, uses and markets guide the legal analysis needed alongside that management-system work.
We use the inventory to identify the facts needed for that analysis and connect relevant duties to activities, evidence and the people responsible for carrying them out. Counsel can resolve interpretation questions while your team develops the governance records needed to support its response.
12
Choose the Readiness Assessment to establish your current position and priorities, or the Full Readiness Program to carry that work through documentation, implementation guidance, internal audit and certification preparation. All amounts are in USD.
We confirm the final scope and fee in writing before work begins. More complex portfolios and multi-entity requirements receive a scoped quotation.
| Readiness Assessment | Most Popular Full Readiness Program |
|---|---|
| From $5,000 per engagement | From $15,000 per engagement |
| • Agreed AI inventory and scope • Readiness findings • Prioritized roadmap • Management readout • Findings and recommendations for the documentation needed • Prioritized actions and recommended responsibilities • Readiness findings to inform your next steps |
Everything in the Readiness Assessment, plus: • Scoped AIMS policies, processes and supporting records • Implementation guidance • Hands-on governance support • Coordination of technical expertise • Included internal audit • Certification preparation • External-assessor collaboration, including support with assessor questions and evidence requests. |
| Assessment and roadmap Understand your current position and plan the work ahead 4–6 weeks for the Readiness Assessment 30 days of follow-up access Complex scopes quoted after scoping |
Build on the assessment and prepare for certification 16–24 weeks to readiness for the agreed scope 30 days of follow-up access Complex scopes quoted after scoping |
In the Full Readiness Program, we provide implementation guidance, hands-on governance support and coordination of technical expertise. Technical changes and control operation are assigned to designated implementers and people responsible for controls. Planning accounts for portfolio complexity, evidence access and implementation capacity. Certification-body fees, legal advice, specialist AI testing and model evaluation are separate unless expressly included. We work with your external assessor, coordinate evidence, help with assessor questions and evidence requests, and participate in assessment discussions to support you through the certification process.
13
Your AI portfolio keeps evolving after readiness. New supplier features, model versions and users create opportunities to update the inventory and revisit the relevant assessments. Clear ownership helps the program keep pace with those changes and gives buyers and auditors a current view of your governance.
We help the people responsible for the program establish a useful handoff: a review calendar, a way to capture new uses and supplier changes, and a route for incidents, complaints and actions to reach the right decision-maker. Management can use those records to review progress and priorities.
The included 30 days of follow-up access let your team ask questions about the agreed deliverables. If you need continuing governance leadership, our Virtual CISO service is a starting point for discussing ownership, review cadence and future surveillance preparation. We can discuss how continuing support would fit the people and processes you already have.
ISO 42001 Readiness Questions
15
An artificial intelligence management system is the set of responsibilities, policies, processes and records your organization uses to govern AI. ISO/IEC 42001 provides requirements for that management system. For your team, the practical questions are who can approve an AI use, how risks and impacts are assessed, and what happens when the system or its use changes.
Readiness helps your team put that approach into practice and organize the evidence for independent assessment.
A customer evaluating your AI-enabled product may ask for a certificate, a readiness roadmap or evidence of governance. Internal leadership may also need a consistent approval process before expanding AI use. We start with the exact requirement: the scope the requester cares about, the evidence they expect and any deadline. We help your team prepare the response that matches that request.
16
An ISO 27001 program can provide useful management-system processes and security evidence. We review what can support the AIMS, including responsibilities, document control, reviews and corrective actions, before creating parallel records. The amount of reuse depends on your scope and how the existing processes operate.
We add the AI-specific decisions around intended use, impacts, data considerations and human oversight, connecting them to the existing program and the people responsible for it.
17
The Readiness Assessment starts at $5,000 per engagement and includes the agreed AI inventory and scope, readiness findings, a prioritized roadmap and management readout. The Full Readiness Program includes every assessment deliverable plus AIMS documentation, implementation guidance, internal audit and certification preparation. See the pricing table for both offers. Both include 30 days of follow-up access after delivery.
18
The Full Readiness program takes 16–24 weeks. We move from assessing your current position to preparing the documentation, operating evidence, internal audit and certification handoff. Your team has a clear sequence of milestones to work toward and explain to stakeholders.
19
An independent certification body assesses your management system and decides whether to issue a certificate. We prepare your team through the Full Readiness Program, including an objective internal audit and certification preparation. The body sets its own assessment schedule.
20
The AIMS organizes governance records that support EU AI Act preparation. Your applicable legal duties and conformity requirements are assessed separately, based on your role, system, use and jurisdiction.
We help your team explain the management-system work and regulatory preparation clearly, connecting each to its relevant records, responsibilities and next steps.
21
AI security testing and model validation are specialist services. We use available findings to help the people responsible for AI governance make governance decisions and track the response. The pricing section explains how specialist work is handled.
We connect each finding to the system configuration, the person responsible for the response and the evidence supporting closure. That gives your team an actionable record for implementation and review.
22
We review the systems and dependencies identified with the people responsible for your AI systems, including the supplier features your team uses. We check inventory completeness and record the additional provider information needed to support the assessment.
A new feature, changed model or expanded use may require another scope decision. Keeping those changes visible is part of making the inventory useful after the initial review.
23
A main contact responsible for the engagement, access to relevant records and participation from people who understand the systems. Product, engineering, security, privacy, legal and procurement may need to contribute, depending on the uses in scope.
Your business decision-makers provide direction and approvals. We help establish control ownership, guide the work and coordinate evidence priorities so each contributor understands their role and the next milestone. If you do not have an internal team, we provide hands-on governance support and coordinate the technical expertise needed.
24
After the Readiness Assessment, you have a documented view of your AI inventory, governance gaps and priorities for deciding what to do next. The Full Readiness Program includes those deliverables and carries the work through AIMS documentation, implementation guidance, internal audit and certification preparation. If you do not have an internal team, we provide hands-on governance support and coordinate the technical expertise needed.
After delivery, you have 30 days of follow-up access for questions about the agreed deliverables. If you need continuing governance leadership or help preparing for future reviews, discuss the Virtual CISO route with us.
25
Tell the buyer what you can evidence: the agreed scope, completed milestones, open actions and next planned review. We help you establish that documented position through the readiness work, so the answer can be checked against the records your team maintains.
We help you describe readiness milestones and certification status clearly, giving the buyer a supportable account of progress and the next planned review.
26
If an AI questionnaire is waiting on your desk, start with the actual request. Bring it to the conversation with your system list, any existing ISO 27001 materials and the date the buyer has given you. We will discuss what is in scope, what evidence already exists and which responsibilities need to be assigned.
Bring the information you already have. We will identify what else is needed to shape a practical readiness plan. The next step is a free 30-minute consultation, with no obligation.
Get Your ISO 42001 Readiness Roadmap →Free 30-minute consultation. No obligation. Speak to Temi Directly About Your ISO42001 Readiness →
