Build an ISO 42001 AI management system your customers and auditors can check
An implementation-grade kit for risk, compliance, product and technology leads in organisations that use AI and build some of it, who must put AI under a real management system and take it through certification.
- A 23-sheet AIMS Master Workbook: 36-practice maturity self-assessment, an AI system register that raises STOP flags, AI risk register, impact assessments, a 38-control Statement of Applicability, evidence register, internal audit, CAPA and a dashboard with traffic lights
- A business case calculator in low, likely and high cases, and a crosswalk of 25 instruments across the EU AI Act, NIST AI RMF, ISO/IEC 27001 and six markets
- Five fillable forms including an AI system impact assessment, policy and procedure starters with a release gate, leadership memos, 32 messages and 29 AI prompts with human-review rules
- A 45-minute team briefing, a 14-question LMS-ready knowledge check, a 36-week calendar and a task board
The ISO 42001 AI Management System Starter · Bodhih Pro Kits · 319 by Bodhih Training, trainers to 2,000+ companies since 2008.
How do you implement ISO 42001?
Score where you stand, register every AI system and your role in each, agree a business case and scope, assess AI risk and impact with fixed criteria, write a Statement of Applicability for the 38 Annex A controls, audit and review, then book an accredited certification body. Bodhih Training's ISO 42001 AI Management System Starter gives you every file.
Want the full free guide first? Read How to Implement ISO 42001: A Step-by-Step AIMS Guide.
You already feel the problem. Here is what it is costing you.
An ethics statement is not a system
Most organisations have principles on a web page and nobody who owns them. Auditors and customers test owners, decisions and records.
Nobody knows how much AI you run
Bought tools add AI features with every update. Without a register, you cannot assess risk, impact or suppliers, and you cannot answer a tender question.
Risk and impact get blurred
A risk register asks what could go wrong for you. An impact assessment asks what the system could do to people. Templates that merge them miss the second question.
The certificate gets oversold
Teams tell customers ISO/IEC 42001 means AI Act compliance. It does not, and the claim can do more harm than having no certificate.
Picture the next few weeks with the kit open beside you.
Imagine the Monday eleven days before your Stage 1 audit. You open the AIMS Master Workbook and the Dashboard shows, in numbers and colours, where you stand: maturity up from below 0.5 to 2.5, every AI system on the register, no unresolved STOP flags, no risks rated High after treatment and a dated plan for every gap.
As you send the auditor your scope, roles, register, risk and impact assessments, Statement of Applicability, internal audit reports and management review minutes, you notice something: every claim points to evidence you can open in seconds, and two features you chose not to ship are recorded with reasons.
When the auditor asks a product manager which AI tools he may paste customer emails into, he knows, and he knows why, because of the 45-minute briefing. When a hospital group sends its AI questionnaire, you answer it from the same records in a day.
Open the Start-here map tonight and give it one hour. Whether you begin with the AI system register or the self-assessment, you will know your gaps, your first decision and the file to open next.
23 files that do the work for you
The e-book shows you how. The tools make it happen. Here is exactly what you download.
The ISO 42001 AI Management System Starter (e-book, PDF)
The guide: methods, worked examples, scripts and exercises
Start here: the AIMS implementation map
The whole job on one page, your first hour, your first week, the 30-60-90-day plan and the route to certification, with the file to open at each step.
AIMS Master Workbook
23-sheet workbook: settings, 36-practice maturity self-assessment, gap-to-action plan, context, AI system register with STOP flags, AI risk register, treatment plan, impact assessments, 38-control SoA, objectives, metrics, evidence register, AI suppliers, AI incidents and concerns, internal audit, findings and CAPA, decision log, roadmap, RACI, a dashboard with six charts and traffic lights, What changed log and glossary.
AIMS Business Case Calculator
Cost of doing it vs cost of doing nothing over a three-year cycle: assumptions (all your estimates), internal time, costs, AI loss scenarios, three-case comparison and a summary with traffic lights and three charts.
AI Framework Crosswalk and Official Sources
Jurisdiction crosswalk for the EU, Denmark, the US, Canada, the UK, Australia and New Zealand (25 instruments), a 13-row framework map (ISO/IEC 42001, EU AI Act, NIST AI RMF, ISO/IEC 27001, Australia's six practices) and an official sources register with quarterly check dates.
AIMS Scope, Context and Roles Worksheet
Four pages to agree context, interested parties, your role for each AI system, scope boundaries and interfaces with top management (clauses 4.1 to 4.4).
AI Risk Assessment Workshop Form
Run a 90-minute AI risk workshop for one system or team: criteria reminder, risk-source prompts, scoring table, treatment choices and owner sign-off.
AI System Impact Assessment
Five pages to assess how one AI system could affect individuals, groups and society: system profile, affected people, harms and benefits, severity and scale, mitigations, decision and review (clause 6.1.4, Annex A.5).
AI Supplier and Model Due Diligence
Assess an AI supplier or model provider in proportion to the risk: triage, 20 plain-English questions, assurance check, AI contract terms and decision (Annex A.10).
AIMS Internal Audit Checklist and Corrective Action
Plan an internal audit, work through 36 evidence questions across clauses 4 to 10 and sampled Annex A controls, grade findings and record corrective action and effectiveness.
AI Policy and Procedure Starters
A one-page AI policy, 8 topic policy starters, 8 procedure starters, a release gate record and a policy register, in plain English with placeholders.
Leadership Sign-Off and Management Review Pack
Four one-page decision memos (programme sign-off, residual risk above appetite, SoA approval, stopping an AI system) and a management review agenda and minutes template.
Email and Message Library
32 ready-to-edit emails, chat messages, disclosure texts and tender answers for leadership, staff, system owners, AI suppliers, customers and auditors.
Worked example pack: Nordlys Health, Copenhagen
The kit's main files completed for one fictional 260-person health-tech company: self-assessment, business case, scope and roles, AI system register, impact assessments, risk extract, SoA summary, objectives, audit findings, management review and an illustrative Stage 1 and Stage 2.
AI Prompt Pack for AIMS Work
29 tool-agnostic prompts grouped by step of the job, each with what to paste in and what to check, plus six human-review rules.
Team Briefing Session Plan and Answer Key
A 45-minute all-staff AI briefing: timed plan, opening script, four scenario cards, a printable answer key for the 14-question knowledge check and an attendance record.
Numbers that matter: AIMS KPI card
Fourteen AIMS numbers with plain-words definitions, the formula, where each lives in the workbook and what to do if it moves.
Correct at November 2026: AI standards and laws
The dated sheet: the ISO/IEC 42001 family, accreditation, the amended EU AI Act timetable and the harmonised standard, Denmark, and positions in the US, Canada, the UK, Australia and New Zealand, each with its source.
Annex A at a glance: 38 AI controls
All 38 Annex A control themes in our own paraphrase, grouped in nine areas, plus one line on each of Annexes B, C and D.
Audit-ready decision card
If-then rules for AI decisions and audit moments, the seven-check release gate, how to choose an accredited certification body and ten mistakes to avoid.
36-week roadmap calendar
52 calendar entries: task starts, milestone checks, monthly metrics reviews and quarterly source checks, starting Monday 11 January 2027 (move them to your own start date).
AIMS task board import (CSV)
26 roadmap tasks with phase, owner, start and due dates, ready to import into Trello, Asana, Planner, Jira or Notion.
Knowledge check (14 questions, LMS-ready)
Scenario-based multiple-choice questions on everyday AI judgement, with explanations. Imports into Bodhih LMS or any LMS that accepts question, options A to D, correct and explanation columns.
Chapter by chapter
Each chapter opens with a real situation, gives you a method and ends with something to do today, using the tools in your kit.
- Format
- PDF e-book + XLSX + fillable PDF + DOCX + printable PDF + ICS + CSV
- Files
- 23 files plus a one-click ZIP
- E-book
- 69 pages
- Works with
- Excel, Google Sheets, Apple Numbers, LibreOffice, Word, Google Docs, Acrobat Reader, Google Calendar, Outlook, Apple Calendar, Trello, Asana, Planner, Jira, Notion and any LMS that imports CSV
- Best for
- Organisations of about 20 to 1,000 people that use AI and build lower-risk AI features, implementing ISO/IEC 42001 for the first time
- Standards
- ISO/IEC 42001:2023. Not affiliated with or endorsed by ISO or IEC
The Standard in Plain Words, and Where You Stand
Clauses 4 to 10, the four annexes and the 38 Annex A controls in plain words, and how to score 36 practices from 0 to 4 to find your gaps.
Decide, Scope and Sign Off
An honest three-case business case, why certification is not legal compliance, context and interested parties, a scope a customer would recognise and the AI policy.
The AI System Register and Your Role in Each System
Find every AI system you build, buy or use, record your role and intended use, screen each one and let STOP flags force a decision.
AI Risk Assessment That Holds Up
Criteria first, then risk sources, specific events and evidence, scored the same way every time, with an owner accepting every residual risk.
AI System Impact Assessment
Assess what each system could do to individuals, groups and society, including people who never chose it, and let the result change the decision.
Risk Treatment and the Statement of Applicability
Modify, retain, avoid or share; a dated treatment plan; all 38 Annex A controls with true reasons; and honest exclusions for organisations that only use AI.
Life Cycle, Data and Third Parties
A seven-check release gate, model cards, logs, data provenance, monitoring, AI supplier and customer terms, and a protected route for concerns.
People, Objectives and Checking It Works
Competence and AI literacy, objectives and metrics with decisions, the dashboard, internal audit, management review, and where AI helps and people decide.
Certification, the Crosswalk and Keeping It Current
Choosing an accredited certification body, Stage 1 and Stage 2, the three-year cycle and one AIMS mapped to the EU AI Act, NIST AI RMF and five other markets.
Not just reading. Tools you will actually open again.
Start here
- 00-Start-Here-ISO-42001-AIMS-Map.pdf: the job in ten steps with the file for each, your first hour, your first week, the 30-60-90-day plan to certification and a 'Brand it in five minutes' box
Workbooks
- AIMS-Master-Workbook.xlsx: 23 sheets: Settings, a 36-practice maturity self-assessment, gap-to-action plan, context, an AI system register with STOP flags, AI risk register, treatment plan, impact assessments, a 38-control Statement of Applicability, objectives, metrics, evidence register, AI suppliers, AI incidents and concerns, internal audit programme, findings and CAPA, decision log, 36-week roadmap, RACI, a dashboard with six charts and traffic lights, a What changed log and a UK/US glossary
- AIMS-Business-Case-Calculator.xlsx: cost of doing it vs cost of doing nothing over three years in low, likely and high cases, with every assumption labelled your estimate
- AI-Framework-Crosswalk-and-Official-Sources.xlsx: 25 laws, standards and guidance documents across the EU, Denmark, the US, Canada, the UK, Australia and New Zealand, a 13-row framework map and a sources register with quarterly check dates
Fillable forms
- AIMS-Scope-Context-and-Roles-Worksheet.pdf (4 pages)
- AI-Risk-Assessment-Workshop-Form.pdf (4 pages)
- AI-System-Impact-Assessment.pdf (5 pages)
- AI-Supplier-and-Model-Due-Diligence.pdf (4 pages)
- AIMS-Internal-Audit-Checklist-and-Corrective-Action.pdf (4 pages, 36 evidence questions)
Word templates
- AI-Policy-and-Procedure-Starters.docx: a one-page AI policy, 8 topic policy starters, 8 procedure starters, a release gate record and a policy register
- Leadership-Sign-Off-and-Management-Review-Pack.docx: four decision memos (including stopping an AI system) and a management review agenda and minutes
- Email-and-Message-Library.docx: 32 emails, chat messages, AI disclosure texts and tender answers
- Worked-Example-Pack-Nordlys-Health.docx: the main files completed for one fictional 260-person health-tech company
- AI-Prompt-Pack-for-AIMS-Work.docx: 29 prompts with what to paste in, what to check and six human-review rules
- Team-Briefing-Session-Plan-and-Answer-Key.docx: a 45-minute all-staff AI briefing with script, scenario cards and the answer key
Cheat sheets
- Numbers-That-Matter-AIMS-KPI-Card.pdf: 14 numbers with formulas and what to do when they move
- Correct-at-November-2026-AI-Standards-and-Laws.pdf: the dated sheet of standards, accreditation, the amended EU AI Act timetable and positions in six other markets, each with its source
- Annex-A-at-a-Glance-38-AI-Controls.pdf: all 38 control themes in our own paraphrase
- Audit-Ready-Decision-Card.pdf: if-then rules, the seven-check release gate, choosing a certification body and ten mistakes
Calendar, task board and LMS
- AIMS-36-Week-Roadmap-Calendar.ics: 52 calendar entries
- AIMS-Task-Board-Import.csv: 26 tasks for Trello, Asana, Planner, Jira or Notion
- Knowledge-Check-14-Questions-LMS.csv: 14 scenario questions with explanations, ready for Bodhih LMS or any LMS
E-book
- The ISO 42001 AI Management System Starter e-book: 9 chapters, 23 figures and a running worked example
When you have worked through it, you will be able to…
Every outcome is practised with a worked example and a tool, not just described.
- Score your AIMS maturity from 0 to 4 across 36 practices and turn every gap into a dated action
- Register every AI system you build, buy or use, with your role and intended use
- Build a three-case business case leadership can sign, without overselling certification
- Run AI risk workshops with criteria that give repeatable results
- Assess impacts on individuals, groups and society and let them change decisions
- Produce a true Statement of Applicability for all 38 Annex A controls
- Put every AI change through a release gate and every AI supplier through proportionate checks
- Run internal audits, management review and corrective action, and prepare your team for Stage 1 and Stage 2
Know your starting point. Prove your progress.
People who measure before and after improve faster and can show it. AssessAll, our sister assessment platform, has AI-graded assessments that pair with this kit. Take one now, work through the kit, then re-take it.
Signing It Off: AI Governance Judgment
Take the assessment →AssessAll assessmentData Governance & Data Quality Stewardship Judgment
Take the assessment →AssessAll assessmentDecision-Making Under Uncertainty
Take the assessment →JobularyTurn what you learn into a measured development plan (Jobulary)
Make it a growth plan →A taste of Chapter 2
Ingrid's three-year cost of doing it came to €342,400, of which €179,500 fell in year 1. Internal time was €207,700 of the total; the cash cost was €134,700, kept down because document control, internal audit and supplier reviews already ran inside the ISMS. Her likely-case expected loss without an AIMS was €25,300 a year, from four scenarios led by a chat assistant giving harmful health information and patient data exposed through an AI supplier. The net over three years was a loss of €8,920 in the low case, a gain of €179,360 in the likely case and €660,080 in the high case. In the likely case, each euro spent returned about 1.52 in benefit. Ingrid showed all three. Marta's comment was the most useful thing said in the meeting: "The low case is roughly break-even. I can defend that. I can't defend losing the hospital groups." Amara signed memo 1 from the Leadership Sign-Off and Management Review Pack that afternoon.
The honest comparison
| Free templates and typical advice | This kit | |
|---|---|---|
| Where you start | A list of documents to write | A scored 36-practice self-assessment and an AI system register that turn gaps into a dated plan |
| Your AI systems | Not covered, or one row per product | A register with role, intended use, screens, linked risks, impact assessment status and STOP flags by formula |
| Impact on people | Merged into the risk register | A separate impact assessment form and sheet covering individuals, groups and society, with decisions |
| Statement of Applicability | 38 rows marked implemented | 38 paraphrased controls with reasons, status, owner, evidence and linked risks, plus a check column |
| Laws and frameworks | A claim that certification means AI Act compliance | A crosswalk to the amended EU AI Act, NIST AI RMF, ISO/IEC 27001 and six markets, with honest limits and dated sources |
| Compared with a consultant or software | A consultant brings experience and capacity; governance software brings automation and integrations, both at a recurring cost | You own the method and every file, can run it yourself, and can still hand it to a consultant or load it into software later |
Made for you if…
- Heads of risk, compliance and governance asked to deliver ISO/IEC 42001 certification
- Product, data and engineering leads who build AI features into a product
- Organisations that already hold ISO/IEC 27001 and want an integrated AI management system
- Operations leads in firms that use many bought AI tools and need to show customers they are under control
- Consultants and internal auditors who want a structured, editable toolkit for client work (consultant licence)
- Teams in the US, Canada, the UK, the EU, Australia and New Zealand facing AI governance questions in procurement
Probably not for you if…
- Anyone looking for the text of the standard: buy ISO/IEC 42001 from ISO or your national standards body
- Providers of high-risk AI systems under EU law or developers of general-purpose AI models: you need specialist legal and regulatory support
- Anyone wanting legal advice or a statement that they comply with the EU AI Act or any other law
- Organisations that want an audit or a certificate from us: we train and equip, we do not certify
Built by trainers, tested in real rooms.
Bodhih Training has designed and delivered corporate programmes since 2008. Bodhih Pro Kits package what works in those workshops into a guide plus the exact tools we use, so you can apply it the same day without a facilitator in the room.
From here to using it in three steps
- STEP 1
Tap Get the kit
Name, email and country. UPI, card or netbanking in India; international cards everywhere else. No account to create.
- STEP 2
Download instantly
Your download page opens at once, with every file and a one-click ZIP. A permanent link lands in your inbox too.
- STEP 3
Open the first tool
Start with the quick-start chapter, then the main spreadsheet or planner. Most buyers use something from the kit the same day.
Your AI, under a system you can show
Open the Start-here map and give it one hour. Whether you start with the AI system register tonight or the business case at your next leadership meeting, you will know your gaps and your next step.
Personal licence for the buyer's own use, including use within your own organisation with your team, system owners and risk owners. Please don't share or resell the files. Team, company, multi-site and consultant licences: solutions@bodhih.com.
What buyers say
No ratings yet. Only people who have bought this kit can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
The Bodhih family, when you are ready for more
AssessAll
250+ AI-graded assessments to measure skills and earn verified credentials.
Jobulary
Individual development plans that start from evidence and stay yours.
Bodhih Training
Run this topic as a live workshop for your team, in person or online.
Pewple
Book a vetted coach for career, leadership or communication. Pay per session.
Bodhih.org pathways
Certification pathways in Applied AI, Workplace English and management.
The ISO 42001 AI Management System Starter: FAQs
Read the free guideAlready bought? Resend my linkWhat exactly is in the kit?
An e-book of 9 chapters and 22 working files: three workbooks (including a 23-sheet AIMS Master Workbook with an AI system register and a 38-control Statement of Applicability), five fillable forms, six Word templates, four cheat sheets, a start-here map, a 36-week calendar, a task board and an LMS-ready knowledge check. Every file follows one worked example so you can see what complete looks like.
Do I need to buy the ISO/IEC 42001 standard as well?
Yes. ISO/IEC 42001:2023 is copyrighted, and you should buy it from ISO or your national standards body (the European edition, EN ISO/IEC 42001:2026, is sold by European national bodies). The kit paraphrases the clauses and the 38 Annex A controls in its own words. It is not affiliated with or endorsed by ISO or IEC.
Does ISO 42001 certification mean we comply with the EU AI Act?
No. A certificate shows an accredited body found your AI management system conforms to the standard for the scope on the certificate. It does not prove compliance with any law. For providers of high-risk systems, the EU route to a presumption of conformity is the harmonised standard EN 18286 cited in October 2026. An AIMS does give you the register, records and decisions that make legal duties easier to show; the EU AI Act Deployer Compliance Kit covers the law itself.
Can I implement ISO 42001 without a consultant?
Many small and mid-size organisations can, especially with a capable lead, leadership support and an existing management system such as ISO/IEC 27001 to build on. The kit gives you the method, the templates and a worked example. Some teams still buy a short independent gap review or a contract internal auditor, and the business case calculator lets you price that option.
How long does ISO 42001 certification take?
It depends on your starting point, scope, number of AI systems and resources. The kit's sample plan runs 36 weeks from kick-off to the Stage 2 audit for a 260-person company that already held ISO/IEC 27001. Score the self-assessment and build the register first: your gaps tell you more about your timeline than any rule of thumb.
How much does ISO 42001 certification cost?
Costs include internal time, the standard, training, evaluation tooling and testing, any outside help and the certification audits, which certification bodies quote from your scope, headcount, sites and AI systems. The calculator builds your own three-year figure; in the sample, internal time was the biggest line and shared ISMS processes kept the cash cost down.
We only use AI tools and build nothing. Is ISO 42001 for us?
It can be. The standard applies to organisations that provide or use AI. If you build nothing, some development and data controls may not apply, and you record that in the Statement of Applicability with a true reason; the kit's second case study shows exactly this. Many such organisations align first and certify later.
Is ISO 42001 required by law in the UK, US, Canada, Australia or New Zealand?
No. Certification is voluntary everywhere at November 2026. Customers increasingly ask for it in procurement, and some laws refer to risk management or impact assessment duties that an AIMS helps you meet. The crosswalk workbook maps where an AIMS helps; whether a law applies to you is a question for your adviser.
Can I use this with my team?
Yes, within your own organisation under the personal licence: share the workbooks, forms and briefing with your team, system owners and risk owners. Company-wide, multi-site and consultant licences are available from solutions@bodhih.com.
Does it work in my country?
The method is international because the standard is. The crosswalk covers the EU (with Denmark as an example member state), the US, Canada, the UK, Australia and New Zealand with official links, and the dated sheet holds country specifics correct at November 2026. Laws need local checking with your adviser.
How can I measure my team's AI governance judgement?
Score the 36 practices in the Self-assessment sheet first. To check people as well as processes, AssessAll offers the Signing It Off: AI Governance Judgment, the Data Governance & Data Quality Stewardship Judgment and the Decision-Making Under Uncertainty assessments at assessall.com.
How do I turn this into a development plan for myself?
Leading an AI management system is a strong career skill. Pick two competences from the competence profiles you write in chapter 8 and turn them into a measured individual development plan with Jobulary's guide at jobulary.com.
How much does The ISO 42001 AI Management System Starter cost?
₹1,999 including 18% GST for buyers in India, or $49 for buyers outside India. One-time payment, no subscription, with an automatic invoice.
How do I get the files after paying?
Instantly. Your download page opens the moment payment succeeds, and a permanent download link is emailed to you. Download each file separately or everything in one ZIP.
What software do I need?
Any of the usual tools: Excel or Google Sheets for spreadsheets, Word or Google Docs for templates, Adobe Acrobat Reader, Preview, Xodo or GoodNotes for the fillable PDFs, and Google, Outlook or Apple Calendar for the calendar plan.
Can I get a refund?
Because it is a digital download, kits are not refundable once downloaded. We always refund a duplicate charge or a failed delivery, and if a file is corrupted and we cannot fix it within 3 working days. Full terms: bodhih.org/refunds.
Can my company buy this for a team?
Yes. Team and company licences, and workshops on this topic run by Bodhih Training, are available. Write to solutions@bodhih.com or call +91 99000 11601.
