ISO 42001 for service companies

A service company sells work, and a growing share of that work passes through AI tools: drafted letters, contract summaries, CV ranking, translated texts, answers from a support chatbot. Clients have noticed. The supplier questionnaire that used to cover data protection and information security now has a block of questions on AI use.

Tenders follow the same pattern. The purchasing department wants to know who is responsible for AI use at your firm, whether client data is entered into external models and how errors are caught before a deliverable leaves the house. Answering this in free text, tender after tender, costs time and convinces few readers.

A certificate to ISO 42001 replaces those paragraphs with one document. The reader scans the QR code on the PDF and lands on the verification page. If you work as a subcontractor for a bank, an insurer or a large corporate, their supplier review reaches you sooner or later.

• ISO standards for small and medium businesses

The standard applies to organisations that develop, provide or use AI systems. Most service companies are users, a few are also providers. These are the places where the risks sit.

Document drafting

A fiduciary firm or law practice uses a language model for letters and summaries. The risks are confidential client data in an external tool and wrong content that nobody checked.

Candidate screening

A staffing agency ranks CVs with a matching tool. A biased ranking affects real applicants, so the people affected need to be assessed, not only the business risk.

Customer support

A service desk classifies tickets or runs a chatbot. A wrong answer is given in your company's name and can reach a client's customer.

Content and marketing

An agency generates copy and images for clients. Unchecked claims and unclear rights to the output are the points a client will ask about.

Analysis and planning

A consultancy uses AI for market analysis, or a cleaning and facility provider for rostering. Decisions rest on output that nobody has validated.

Meeting notes and transcription

Recordings of client meetings go to a transcription service. Where the audio is stored and who can read it must be known before the first call.

The standard follows the same structure as ISO 9001 or ISO 27001, with context, leadership, planning, support, operation, performance evaluation and improvement. If you already run one management system, the layout is familiar. The content is specific to AI.

None of the steps needs a project team. A firm of 10 to 50 people can work through them in a few focused sessions.

1. 01

   Decide your role per system

   A law practice that uses a drafting assistant is a user. A software-minded consultancy that offers clients an automated document classifier is also a provider. Write the role next to each system.

2. 02

   Write a short AI policy

   State which tools are approved, which data must never be entered, who approves a new tool and who answers questions. The managing partner signs it.

3. 03

   Keep an AI register

   One table with tool, purpose, data used, owner and risk rating. The register is also the first thing a client auditor will ask to see.

4. 04

   Assess the people affected

   For each system that touches applicants, employees or clients' customers, record who is affected, what could go wrong and what stops it.

5. 05

   Go through the Annex A controls

   Mark each control as applicable or not and give a reason. This becomes your Statement of Applicability.

6. 06

   Put review into the workflow

   A second person reads AI-drafted client documents before sending. Tool vendors are checked once a year. Incidents go into a log with the action taken.

You start with the online self-assessment: 40 yes/no questions on ISO 42001. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Among the other 27 you need at least 18 yes answers. The assessment is free and needs no registration.

Once you have passed and paid, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education, and SICE reviews every assessment before issue. There is no on-site audit. Each certificate carries a number and a QR code, and anyone can check it on the public verification page.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Swiss and Liechtenstein customers pay 8.1% VAT, which is included in these prices. No account is needed to buy.

• Start the free self-assessment
• ISO 42001 standard page
• Pricing

Attach the PDF to the tender appendix and quote the certificate number in the supplier questionnaire. The reviewer can verify it without contacting you. Add the number to the AI section of your offer template so it does not get forgotten.

Some tenders spell out the form of certification they expect. Read that wording before you apply. If a client insists on the classic route with an on-site audit by a certification body, the guide below compares the routes.

• Compare the certification routes
• Certification without an on-site audit