The standard requires an impact assessment and a risk assessment for each AI system, and lifecycle controls that treat the risks found. It does not say how. AIQURIS does exactly this, deployment by deployment: the risks that matter, the Annex A controls that treat them, every exclusion justified, and the evidence your auditor will check.
Policy, roles, accountability, a template Statement of Applicability. Consultants, templates and platforms all cover this. It gets you through the document review, not through the audit of your AI.
Each AI system needs an impact and a risk assessment. Done generically, they say nothing about the system. Done by experts, they take months per system.
Annex A says to have lifecycle controls in place. What that means for a candidate screening AI assistant, compared with a coding AI assistant, nobody tells you. The controls also cut across data, model, people and processes, and must keep up when the system changes. So organisations implement everything, or too little.
The audit stands or falls on the assessments and controls. That is where AIQURIS works.
Define the scope, AI policy, roles and accountability.
You, or your adviserImpact and risk assessment per deployment, at the depth its risk calls for. Annex A controls derived, every exclusion justified.
AIQURISYour teams put the controls in place. AIQURIS specifies each one and tracks its status and evidence.
AIQURIS specifies, you implementYour management system checks itself, as the standard requires.
YouStage 1 and stage 2 audits by an accredited certification body.
Certification bodyOthers give you the framework. AIQURIS fills it with your AI.
"Have appropriate lifecycle controls in place." This is what that means for one AI system.
One of many chains a single assessment produces.
We were involved in developing ISO/IEC 42001, and we built AIQURIS for the part the standard leaves open: assessing each AI system and specifying the controls it needs.
AIQURIS started within the global AI quality practice of TÜV SÜD, one of the world's largest testing, inspection and certification companies. Seven years of methodology development and decades of certification and safety-critical expertise stand behind every assessment. We know what an auditor looks for.
Today AIQURIS is independent and not a certification body, so we can prepare you without a conflict of interest. Certification bodies are not allowed to advise you; we are.
Meet the team and their standards work →Leadership, internal audit and management review stay with you or your adviser.
Describe one AI deployment. See who could be affected, how badly, and how deep the assessment needs to go next. No sales call needed.
Bring your intended certification scope and the AI systems in it. In one call we scope the deployment assessments, the Annex A decisions and the evidence your audit will need.
