AI compliance
AI compliance across ISO 42001, the EU AI Act and NIST AI RMF
Regulations and standards for AI are arriving faster than most teams can track them. Certifyi brings ISO 42001, the EU AI Act and the NIST AI RMF into the same workspace as your existing compliance programme.
AI compliance is compliance
AI compliance is not a separate programme. The controls you need for ISO 42001 overlap with ISO 27001. The data protection requirements of the EU AI Act overlap with GDPR. The risk management practices in the NIST AI RMF overlap with NIST CSF. Certifyi maps them all on one control set.
AI compliance in Certifyi
Every AI framework in the catalogue maps to the same control set as your existing frameworks. Add ISO 42001 and the controls you already have for ISO 27001 carry across.
- ISO 42001
- The AI management system standard. Map your AIMS controls to Annex A and B, with evidence and ownership on each control.
- EU AI Act
- Track the requirements by risk category: unacceptable, high, limited and minimal. Record conformity assessments for high-risk systems.
- NIST AI RMF
- Organise your AI governance into the four functions: Map, Measure, Manage and Govern. Each function maps to controls.
- AI system register
- Catalogue every AI system with purpose, data sources, model type, deployment status and risk tier.
- AI agent assessments
- Assess AI agents against security, reliability and governance criteria before deployment.
- Cross-framework mapping
- AI controls map to ISO 42001, the EU AI Act and the NIST AI RMF at the same time. No duplicate work.
ISO 42001
ISO 42001: the AI management system standard
ISO 42001 is the first international standard for AI management systems. It follows the same structure as ISO 27001 (clauses 4–10 with Annex A controls), which means if you already run an ISMS, the approach is familiar.
Certifyi maps ISO 42001 controls beside your ISO 27001 controls. Where they overlap — risk management, documentation, internal audit — the mapping is shared.
- Annex A controls mapped alongside ISO 27001 Annex A
- Annex B: AI-specific implementation guidance
- Statement of Applicability for the AIMS
- Evidence on each control, with version history
- Auditor portal access scoped to the ISO 42001 engagement
EU AI Act
EU AI Act: risk-based requirements
The EU AI Act classifies AI systems into four risk categories. High-risk systems must meet requirements for data governance, transparency, human oversight, accuracy and cybersecurity. Certifyi tracks each requirement as a control.
- Risk categorisation: unacceptable, high, limited, minimal
- High-risk requirements tracked as controls
- Conformity assessment tracking
- Technical documentation requirements
- Transparency obligations for limited-risk systems
One programme
AI compliance inside your existing programme
AI compliance does not need a separate tool. In Certifyi, the controls for ISO 42001 sit beside the controls for ISO 27001, SOC 2 and HIPAA. The evidence is shared. The risk register is shared. The auditor portal is shared.
- Compliance software: the full workspace for every framework.
- AI risk management: register, classify and govern AI systems.
- GRC platform: governance, risk and compliance together.
- Risk management: AI risks in the same register as your other risks.
Questions
AI compliance, answered
Do we need ISO 42001 if we already have ISO 27001?
ISO 27001 covers information security. ISO 42001 covers the responsible development and use of AI. They share the same management-system structure and many controls overlap, but ISO 42001 adds AI-specific requirements: an AI system inventory, impact assessments for individuals and groups, and controls for data quality, bias and transparency. If you build or deploy AI, you need both.
What is an AI management system?
An AI management system (AIMS) is the set of policies, processes, roles and controls an organisation uses to govern its AI activities. ISO 42001 defines what an AIMS must contain: leadership commitment, risk assessment, objectives, operational controls (Annex A), performance evaluation and continual improvement. It follows the same Plan-Do-Check-Act cycle as ISO 27001 and ISO 9001.
How does the EU AI Act affect organisations outside Europe?
The EU AI Act applies to any organisation that places an AI system on the EU market or whose AI system's output is used in the EU, regardless of where the organisation is based. If your AI product serves EU customers, you are in scope. The penalty for non-compliance is up to 35 million euros or 7 per cent of global annual turnover.
Can we manage AI compliance in the same platform as SOC 2 and ISO 27001?
Yes. A GRC platform with cross-framework mapping lets you link a single control to ISO 42001, the EU AI Act and your existing frameworks. Controls that already satisfy ISO 27001 requirements carry over. You build out only the AI-specific controls that are new.
Get ahead of AI regulation with Certifyi
Book a demo and we will walk through ISO 42001, the EU AI Act and your AI system register.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them