Management system
Clauses 4 to 10
Context, leadership, planning, support, operation, evaluation and improvement, with an AI system impact assessment added to planning.
AI suppliers, managed inside your ISO 42001 system
ISO/IEC 42001 is the international standard for an AI management system, published in December 2023 and certified by an independent body. It covers how you govern the AI you build or use, including what you need from the suppliers behind it.
Much of the AI a business relies on comes from suppliers. Montro keeps those AI services in one register with your other suppliers, raises changes such as AI switched on inside a tool you approved, and records what your team decided.
Framework
How the standard is laid out
ISO 42001 uses the same clause structure as ISO 27001, so the two can run as one management system. What differs is the AI-specific content.
Controls
Annex A: 38 controls in nine areas
From AI policy and data to impact assessment, the AI lifecycle and use. Annex B explains how to apply each one.
Third parties
Suppliers and customers
Annex A.10 covers sharing responsibilities across the AI value chain, and making sure what suppliers provide fits your approach to responsible AI.
How Montro helps
AI suppliers in the same register as the rest
Montro keeps the AI services you use beside your other suppliers, so your A.10 supplier controls draw on the same entries as your ISO 27001 and EU AI Act records.
Responsibilities written down
For each AI service, your team records what the supplier is responsible for and what stays with you, as control A.10.2 asks.
AI switched on, raised for review
When a tool you approved adds an AI feature, it comes back to its owner with the supplier’s notice as the source, so the impact assessment can be revisited.
AI services no longer in use
When an AI service stops being used, Montro raises it for re-tiering, with the decisions behind it kept for your next review.
What you get
What the management system can draw on
Records your AI team would otherwise rebuild before every review.
Impact
Impact assessments tied to the tool
Each AI system’s impact assessment sits with its entry, so a change to the tool points straight to the assessment it may affect.
Use
Intended use, on record
What each AI system is approved for is recorded, so use beyond that purpose is easier to spot and decide on.
Overlap
One entry, two standards
Because ISO 42001 and ISO 27001 share a structure, one supplier entry can carry evidence for both without doing the work twice.
Findings
How much AI now comes from suppliers
In regulated sectors, a growing share of the AI that matters most is bought in, and firms lean on what suppliers tell them about it.
53%
of high-materiality AI systems are supplied by third parties
Up from 35% two years earlier.
81%
rely on vendor assurance and contracts to understand those systems
Only 24% report deep knowledge of third-party AI, against 77% for systems built in-house.
68%
keep a central inventory of their AI systems
Rising to 92% when partial or in-progress inventories are included.
Questions
Questions about ISO 42001, and how Montro keeps the AI suppliers behind it.
It’s voluntary either way, but yes, it can. The standard applies to organisations that develop, provide or use AI, and for a business that only uses AI tools, the supplier controls in A.10 matter most.
No. The two overlap, especially on risk and impact assessment, but certification doesn’t by itself show you meet the Act. Your role under the Act and each system’s risk level still decide what you owe.
Yes. Both share the same clause structure, so many organisations run one management system and add the AI-specific controls on top.
What the system is for, what data it uses, how new features and changes are announced, and how responsibilities are split. Keep the answers with the supplier’s entry, so they’re there when the tool changes.
An accredited certification body. A companion standard, ISO/IEC 42006, sets requirements for the bodies that audit and certify AI management systems.
Keep reading
The AI rules and standards around ISO 42001
AI suppliers usually fall under more than one framework. These pages cover the closest.
EU AI Act
The law that decides your duties for each AI system, by your role and the system’s risk.
Read more
GDPR & RoPA
AI services that use personal data also need a place in your record of processing.
Read moreISO 27001
The security standard ISO 42001 is built to sit beside, with the same clause structure.
Read moreThird-party records are becoming decision logs. The firms that get this right will be the ones that can show who decided, on what evidence, and when.
- Pen-test summary on request
- Frankfurt hosting
- Sample register
- Expert Series guests
- Cyber Ireland member
See it on your own suppliers
A read-only connection, about an hour to set up, and a named person who can say yes to a decision.
Priced to scope — never per seat, never per supplier. Upgrade only when the evidence earns it.
