← Back to Insights ISO 42001

ISO/IEC 42001 Explained: The New AI Management Standard, and Who Needs It First

Q: What's the difference between the AI Governance Audit and Internal Auditor Training?

The Audit is an independent review conducted by Dr. Seify — a findings report on where your AI governance currently stands. Internal Auditor Training teaches your own staff to run that kind of review themselves, so it becomes a repeatable internal capability rather than something you commission each time.

Q: Is this the same service VisionXY7 offers?

Related, not identical. Dr. Seify offers this personally, one-to-one with your organisation, drawing on his ISO/IEC 27001 Lead Auditor credential. VisionXY7, the company he founded, offers a comparable Enterprise AI Governance programme and a lighter-scope SME entry point for organisations that want a company-delivered engagement instead.

Dr. Mahdi Seify, PhD, MBA, Engr.·6 September 2026·4 min read

ISO/IEC 42001 is the first international standard built specifically for managing AI systems — not information security in general, not IT governance broadly, but the particular risks that come from deploying AI: opaque decisions, data that drifts, and systems that behave differently in production than they did in testing. If you're asking whether your business needs to care about it yet, the honest answer depends on how much an AI decision of yours could affect someone else if it went wrong.

What the standard actually asks for

Stripped of the certification-body language, ISO/IEC 42001 asks four things: document what your AI systems do and who's accountable for them, maintain a risk register that names specific use cases and their risk level, define where a human has to check or override the system before a decision takes effect, and run internal audits that verify all of this is actually happening, not just written down somewhere. It's the same discipline I already apply under ISO/IEC 27001 as a Lead Auditor — extended to the AI-specific risks the older standard was never written for.

Who needs to act on this first

Not everyone needs to act at the same speed. Organisations using AI in ways that materially affect people — healthcare decisions, financial assessments, hiring, anything with real consequences if it's wrong — need this now, because the regulatory and reputational exposure is already live, whether or not a formal audit has happened yet. Businesses using AI for lower-stakes internal efficiency (drafting, scheduling, summarising) have more runway, but "more runway" isn't "none" — the standard is moving from novel to expected faster than most people preparing budgets right now assume.

Two ways I work with this, and a third for teams who want to own it

As an ISO/IEC 27001 Lead Auditor and Lead Implementer, I offer both sides of this for AI governance specifically: an independent AI Governance Audit that tells you where the gaps are without a sales pitch attached to the findings, or hands-on AI Governance Implementation where I build the AI Management System — policies, risk register, controls — alongside your team.

For organisations that want to build this capability internally rather than commission an external review every time, I now also offer Internal AI Auditor Training — a structured programme that trains your own staff to run ISO/IEC 42001 internal audits between external reviews, built as an extension of my existing Company Training Day: from £1,250/day online, £1,600/day in person for a single-day foundation session, or £2,200 online / £2,800 in person for the fuller two-day programme that goes deeper into audit methodology and evidence-gathering.

Why train your own auditors rather than always bringing someone in

An external audit is a snapshot — accurate on the day, but the gap between reviews is where drift actually happens. A team that can run its own internal audits catches problems between the formal external checks, the same reason ISO/IEC 27001 has always required internal audits as part of the standard, not as an optional extra. This isn't a replacement for an independent audit; it's what happens in the months between them.

Frequently Asked

On ISO/IEC 42001 and internal auditor training

Do I need ISO/IEC 42001 certification to use AI responsibly?

No — certification is a formal, third-party process. Most of what actually reduces risk (documented policies, a risk register, defined human oversight) can and should be in place well before anyone pursues formal certification. Certification is the proof; the governance work is what it's proving.

What's the difference between the AI Governance Audit and Internal Auditor Training?

The Audit is an independent review I conduct — a findings report on where your AI governance currently stands. Internal Auditor Training teaches your own staff to run that kind of review themselves, so it becomes a repeatable internal capability rather than something you commission each time.

How much does the AI Governance Audit cost?

There's no flat advertised rate — scope varies too much by how many AI systems are in use and which regulation applies, so it's quoted individually on a free discovery call. Internal Auditor Training, by contrast, is priced from £1,250/day, since it follows the same structure as my existing Company Training Day format.

Is this the same service VisionXY7 offers?

Related, not identical. I offer this personally, one-to-one with your organisation, drawing on my ISO/IEC 27001 Lead Auditor credential. VisionXY7, the company I founded, offers a comparable Enterprise AI Governance programme and a lighter-scope SME entry point for organisations that want a company-delivered engagement instead.

Ready to Build This Capability?

Book a governance consultation.

Whether you need an independent audit, hands-on implementation, or want your own team trained to run this internally, a short conversation will tell you which one actually fits your situation.

Book a Discovery Call

Backed by 25+ years of business leadership — PhD (AI-Driven Business Analytics) · MBA · ISO/IEC 27001 Lead Auditor.