Phase 7: AI Governance, Compliance & Risk · 50 min · ISO/IEC 42001 · Python

ISO/IEC 42001 & SOC 2 for AI

NIST AI RMF tells you what to do. ISO 42001 and SOC 2 are what an auditor checks that you actually did it.

Hiring signal: AI Governance & Compliance Engineer and AI Security Architect roles are the ones asked to prep a company for its first SOC 2 report or ISO 42001 certification. Being able to point at the same implemented control as evidence for two different frameworks — instead of building parallel compliance programs — is the difference between a one-quarter audit prep and a permanent compliance headcount.

What you will learn

Explain what ISO/IEC 42001 certifies (an AI management system) and how it differs from NIST AI RMF and the EU AI Act
Adapt existing SOC 2 Common Criteria controls (access, change management, monitoring, vendor risk) with AI-specific evidence
Build an explicit control-mapping cross-reference between an org's implemented controls and two certifiable standards
Identify dual-purpose controls that satisfy multiple frameworks and prioritize closing single-framework gaps

The Problem

A prospective enterprise customer's security team sends over a vendor questionnaire before they'll sign: "Are you ISO 42001 certified? Can you provide your latest SOC 2 report covering your AI features?" Sales forwards it to engineering with a deadline. Nobody on the team has been through a certification audit before, and the instinct is to treat this as a brand-new project — write new policies, build new controls, hire a consultant, start from zero.

That instinct is usually wrong, and it's expensive when it's wrong. Most engineering orgs of any size already have SOC 2 Type II — auditors have already reviewed access controls, change management, and monitoring for the core product. The AI features didn't appear in a vacuum outside that program; they're new attack surface and new risk inside an org that already knows how to run a compliance program. The actual work is extending existing muscle to cover AI-specific evidence, and layering in the parts that are genuinely new — like proving an AI management system exists at all.

That's what ISO/IEC 42001 and SOC 2 are, functionally: certifiable proof, issued by an independent third party, that the governance NIST AI RMF describes and the risk classification the EU AI Act requires are actually implemented and operating. They're the audit layer sitting on top of the policy layer.

ISO/IEC 42001: Certifying the Management System, Not the Model

ISO/IEC 42001 (published in December 2023) is the first international standard for an AI management system (AIMS) — modeled on the same family of ISO management-system standards as ISO 27001 (information security) and ISO 9001 (quality). If your org has been through an ISO 27001 audit before, the shape will look familiar: clauses 4 through 10 cover context of the organization, leadership, planning, support, operation, performance evaluation, and continual improvement, plus an Annex A of AI-specific controls an org selects from and justifies via a Statement of Applicability.

The critical thing to internalize: certification applies to the organization's management system, not to any individual model. An accredited certification body audits whether the org has documented policies, assigned roles, a risk assessment process, and evidence that the process actually runs — not whether a specific model is bias-free or safe in every context. A company can hold a valid ISO 42001 certificate while one of its models has an active fairness bug, because certification means "we have a functioning system for identifying and addressing exactly that kind of problem," not "every problem has already been eliminated."

The Annex A control areas that matter most to an engineering org:

Control area	What it requires
AI Policy & Governance	Leadership-approved policy defining risk tolerance, roles, acceptable use
AI System Impact Assessment	A completed assessment of affected stakeholders and potential harms before deployment
Data Management for AI	Training/RAG data classified, quality-checked, provenance-tracked
AI System Lifecycle Controls	Change management across design, development, deployment, monitoring, retirement
Third-Party & Customer Relationships	Vendor and third-party AI component risk assessed before use
Use and Monitoring of AI Systems	Deployed systems monitored, issues fed back into the management system
Resourcing and Competence	Defined competence requirements and training for AI-risk personnel
Transparency to Interested Parties	Capabilities and limitations communicated to users, auditors, and other stakeholders

Certification itself follows the standard ISO pattern: a Stage 1 audit (documentation review — does the management system exist on paper), a Stage 2 audit (does it actually operate — interviews, evidence sampling), then a certificate valid for three years with annual surveillance audits.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers How This Differs From NIST AI RMF and the EU AI Act, Adapting SOC 2 Controls for AI, Where the Gaps Actually Show Up, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.