Governance that takes AI from pilot to results
Most companies investing in AI have yet to see a return. About 6% turn AI into returns above those of their competitors, while three in four use AI in several areas without earning better returns than those competitors. An AI management system gives every system an owner, a purpose, an assessed risk and a value metric.
Source: BCG, How AI Leaders Create Competitive Advantage, 2026
- An inventory of all AI in use, including suppliers' AI
- Risk and impact assessed before each new use
- Readiness for the ISO/IEC 42001 certification audit
ISO/IEC 42001
The five pillars of an AI management system
Based on ISO/IEC 42001, which has 38 AI-specific controls.
-
Context and leadership
The organization's role in each system, the scope of the management system and an AI policy approved by top management.
-
Risks and impacts
Common criteria to assess and treat risks, impact assessments on people and society, and the Statement of Applicability for the controls.
-
Life cycle and data
Requirements for every stage, from specification to monitoring in production, with data quality and provenance.
-
Third parties and transparency
Responsibilities shared with suppliers and customers, information for users and incident communication.
-
Performance and improvement
Objectives with metrics, internal audit, management review and corrective action in a continuous cycle.
Engagement options
Each option includes the previous one. The organization starts with the assessment and decides on the next step with the results in hand.
- Starting point
AI maturity assessment
What AI the organization uses, with what risk, what value and what governance maturity, across nine dimensions mapped to the standard.
- Included: AI system inventory
- Included: Maturity profile and regulatory exposure
- Not included: Remediation plan
- Not included: Management system implementation
- Assessment and plan
Remediation plan
A gap analysis against ISO/IEC 42001, clause by clause and control by control, with the scope, the governance model and a prioritized roadmap.
- Included: Inventory and maturity profile
- Included: Gap analysis and roadmap
- Not included: Management system implementation
- From assessment to certification
AIMS implementation
The full management system, running through one cycle of internal audit and management review, up to the certification pre-audit.
- Included: Assessment and remediation plan
- Included: Policy, processes and controls in place
- Included: Preparation for the certification audit
The method
Five phases that follow the cycle of management system standards. Each phase ends with a deliverable approved by top management.
-
01
Assess
Discovery of the AI in use, interviews, regulatory screening of each use case and an evidence-based maturity score.
-
02
Plan
Gap analysis, scope, an AI committee, approval levels by risk class, roadmap and business case.
-
03
Implement
Policy, risk and impact processes, a use-case intake workflow, life-cycle requirements, supplier clauses and team training.
-
04
Operate and measure
Monitoring of systems in production, internal audit, management review and corrective action.
-
05
Certify and improve
Pre-audit, support during the certification body's audits and continual improvement after certification.
What you receive
Documents and processes that stay with the organization and support the certification audit.
-
01
AI system inventory
One record per system, with its purpose, owner, data, affected people and risk class.
-
02
AI policy
Approved by top management and aligned with security, privacy and quality policies.
-
03
Use-case intake workflow
An intake form, a risk questionnaire and approval levels, with a fast track for low-risk cases.
-
04
AI risk register
Acceptance criteria, assessed risks and a treatment plan with owners.
-
05
Impact assessment
The effect of each relevant system on individuals, groups and society, assessed before use.
-
06
Statement of Applicability
The controls that apply, with the reason for each inclusion and exclusion.
-
07
Objectives and metrics
Measurable targets for systems and for governance, with the dashboard that tracks them.
-
08
AI literacy program
Role-based training, from developers to end users, with recorded evidence.
-
09
Internal audit and management review
The first full cycle, which the certification body requires before the audit.
Why now
AI adoption is growing faster than governance
AI enters companies mostly through purchased software, governance committees exist but few work well, and the European Union's high-risk rules now have a start date.
- of Brazilian companies that used AI in 2025 bought off-the-shelf tools
- 80%
- Source: Cetic.br, TIC Empresas 2025
- of organizations consider their AI governance committee mature, while 75% have one
- 12%
- Source: Cisco, 2026 Data Privacy Benchmark Study
- of global annual turnover is the EU AI Act's maximum fine
- 7%
- Source: Regulation (EU) 2024/1689, Art. 99
What regulation requires and how the management system responds
The requirement
With an AIMS
-
01The requirement: EU AI Act: high-risk obligations apply from December 2, 2027, and reach companies outside the European Union whose systems are used there.
With an AIMS: Each system gets a risk class in the inventory, and the management system produces the evidence for risk management, data, technical documentation, logs and human oversight.
-
02The requirement: Brazil's AI bill (PL 2338/2023): passed by the Senate in December 2024 and under review in the Chamber of Deputies, with risk-based classification of systems.
With an AIMS: The assessment records each system's preliminary class, and the risk process adapts once the law is passed.
-
03The requirement: LGPD, Brazil's data protection law: individuals can request a review of decisions based solely on automated processing of their data.
With an AIMS: The management system's impact assessment and data controls integrate with the data protection impact assessment and ISO/IEC 27701.
-
04The requirement: Federal government: Ordinance SGD/MGI No. 5,921/2026 requires rules on AI use in IT contracts or in the agency's AI governance policy.
With an AIMS: The management system's AI policy and supplier clauses cover both routes.
-
05The requirement: Customers, investors and parent companies ask for evidence of AI governance when they buy.
With an AIMS: ISO/IEC 42001 certification, issued by an accredited body, gives customers and auditors independent, verifiable evidence.
Frequently asked questions
Answers to common questions about AI governance and ISO/IEC 42001.
What is an AI Management System (AIMS)?
It is the set of policies, roles, processes and controls an organization uses to direct, assess and improve its use of AI. ISO/IEC 42001 specifies the requirements for this system and is the first certifiable AI management standard. It follows the structure of ISO/IEC 27001 and ISO 9001, which makes it easier to integrate with the management systems the organization already has.
Does ISO/IEC 42001 certification guarantee compliance with the EU AI Act?
The standard does not give a presumption of conformity with the AI Act. The regulation's first harmonised standard is EN 18286:2026, on the quality management system required of high-risk AI providers. An AIMS produces much of the evidence the AI Act asks for, such as risk management, technical documentation, logs and human oversight, and the conclusion on legal compliance requires legal analysis.
My organization only uses AI from suppliers. Does it need an AIMS?
The standard applies to organizations that develop, provide or use AI, and the organization's role determines which controls apply. According to Cetic.br, 80% of Brazilian companies that used AI in 2025 bought off-the-shelf tools, and much of the risk lies in that use. It includes data sent to third parties, decisions supported by models the organization does not control, and AI features switched on in software it already licenses. The Annex A third-party controls address this.
Does Takter certify the organization?
Certification is issued by an accredited certification body, and whoever implements the system cannot certify it. Takter prepares the organization, runs the pre-audit and supports it during the certification audits.
How long does it take?
It depends on the scope and on how many AI systems it covers. The assessment defines the recommended scope and the timeline for the following phases. Before the certification audit, the system must have completed at least one cycle of internal audit and management review.
Does the service cover public sector organizations?
Yes. For agencies in SISP, the Brazilian federal government's IT resources system, Ordinance SGD/MGI No. 5,921/2026 requires rules on AI use in IT infrastructure operation contracts or in an AI governance policy. An AIMS gives that policy roles, risk criteria and supplier clauses that follow an international standard.
How does an AIMS relate to ISO/IEC 27001 and the LGPD?
ISO/IEC 42001 uses the same structure as ISO/IEC 27001, and the standard's Annex D recommends integrating them. AI security controls build on the information security management system, and privacy controls on ISO/IEC 27701 and the LGPD program. An organization that already holds ISO/IEC 27001 reuses the internal audit and management review it already runs.
