Keep a register of your AI systems and the decisions made about them

Start with a list of the AI systems you run

ISO 42001 expects you to define which AI systems are in scope. The EU AI Act requires providers of most high-risk systems to register them in an EU database. Both assume you already know what you run. Most organisations do not: product teams ship models, staff sign up for AI tools, and suppliers add AI features to software you already pay for.

The register in Certifyi records each AI system, what it is for, who owns it and which EU AI Act risk class it falls into.

• One record per system. Its purpose, its owner and its risk class under the EU AI Act.
• Classify by use. A system used for two purposes can carry a different risk for each. Record the class for the use you are assessing.
• Next to your ISMS. The register lives in the same workspace as your controls, risks and policies.

Assess the risks AI adds

AI brings risks that an information security risk assessment rarely covers: unfair outcomes for some groups of people, confident wrong answers, personal data leaking through prompts, and models that behave differently after an update. ISO 42001 gives you a management system to handle them. The EU AI Act sets duties according to the risk class.

In Certifyi you classify the system, run an AI impact assessment on it and record the AI risks you find in the same risk register as the rest of your programme.

• AI impact assessments. A structured assessment for each system in the register.
• One risk register. AI risks sit beside your other risks, each with a likelihood, impact, treatment and owner.
• A person decides. Where Certifyi’s AI drafts an answer or a mapping, it stays a proposal until a person accepts it.
• Activity log. Who approved what, and when, written to a tamper-evident log.

Follows the structure of ISO/IEC 42001

ISO/IEC 42001 is the international standard for AI management systems. It uses the same high-level structure as ISO 27001, so an organisation certified to ISO 27001 can extend its existing management system to cover AI instead of building a second one.

In Certifyi, the AI system register and AI risk assessment support Clause 6 (planning), and the activity log supports Clause 9 (performance evaluation). Shared controls can be mapped to both ISO 27001 and ISO 42001 and documented once.

Clause 4: Context

The scope of your AI management system, the interested parties and the AI systems in scope.

Clause 5: Leadership

AI policy, roles and responsibilities, with someone accountable for each AI system.

Clause 6: Planning

AI risk assessment, AI system impact assessment, risk treatment and objectives.

Clause 7: Support

Competence, awareness and communication for the people doing AI governance work.

Clause 8: Operation

Day-to-day control of AI systems through their life, including impact assessments and changes.

Clause 9: Evaluation

Monitoring, measurement, internal audit and management review.

Clause 10: Improvement

Corrective action and continual improvement.

Plan for the EU AI Act by risk class

The EU AI Act sorts AI systems into four risk classes and sets duties for each. High-risk systems need a conformity assessment, a risk management system, human oversight, logging and technical documentation. That is well beyond what most organisations hold today.

Certifyi records the risk class on each system, so you can plan the duties for that class and keep the evidence in the same workspace.