Five practical strategies for a small team — focused scope, existing processes, clear responsibilities, and evidence that the system works
ISO 42001 for small organizations starts with a practical question: “Could a company our size actually get certified?” Yes. ISO/IEC 42001 applies to organizations of any size, including those that use AI rather than develop it. A 40-person company does not need to copy a large enterprise’s governance structure. It does need a management system that meets the requirements and works in practice.
The distinction matters: scale the implementation, not the conformity requirements. These five strategies explain how to make preparation manageable without leaving gaps in the AI management system, or AIMS.
Why smaller organizations are looking at this now
A customer’s request for evidence of responsible AI use can turn governance into an immediate business issue. Start with what your customers and contracts actually require: certification, evidence of effective governance, or both. Certification is most useful when it supports a defined business need rather than an assumption that every competitor already has it.
Regulation is another consideration. Under the EU AI Act, obligations depend on matters such as the organization’s role, the AI system’s use and risk classification, territorial scope, and applicable dates. An AIMS can help organize responsibilities, controls, and evidence, but ISO/IEC 42001 certification does not automatically establish legal compliance or replace a required regulatory conformity assessment. Our comparison of ISO 42001, the EU AI Act, and NIST AI RMF explains their different purposes.
The real constraints — and why they are not blockers
Small teams may have limited time, several responsibilities assigned to one person, and little experience with management systems. Those constraints call for deliberate choices: reuse processes, combine records where practical, and reserve time for operating the controls. A smaller organization is not necessarily a lower-risk one; the intended use of its AI systems still matters.
Strategy 1 — Define a focused, defensible scope
Certification need not cover every activity in the organization. The AIMS can focus on activities associated with a particular service, business unit, or AI system. The object of certification is the management system within that scope, not the AI product itself.
For a company operating a customer-support chatbot, an illustrative scope could be “the AI management system supporting the operation of the customer-support chatbot service.” The boundary must still account for the relevant people, processes, data, and supplier interfaces supporting that service.
Clause 4.3 requires the scope to be documented and determined with regard to organizational context and relevant interested-party requirements. Recording the reasoning is a practical way to show how those considerations informed the boundary. A staged expansion plan is useful when expansion is intended; it is not a separate certification requirement.
Choose a scope that serves a genuine business need and can be governed effectively. Do not exclude significant dependencies merely to simplify the audit. A focused scope can make implementation more manageable, but it does not automatically reduce the required document categories or guarantee fewer audit days.
Strategy 2 — Reuse the management system you already have
Existing ISO/IEC 27001 or ISO 9001 processes can provide a useful starting point. Review document control, competence management, internal audit, corrective action, and management review against the AIMS requirements, then extend them where needed. An existing certification is neither a prerequisite nor proof that the reused processes already meet ISO/IEC 42001.
The AI-specific work still needs attention: policy and objectives, risk and impact assessment, and appropriate controls for data, the AI life cycle, human oversight, responsible use, stakeholder information, and third-party relationships. Our guide to extending an ISO 27001 ISMS distinguishes what can be reused, adapted, or added.
For a small team, the practical gain is avoiding duplicate administration. One controlled register can link risks, treatment actions, owners, and evidence; a combined management review can address more than one management system, provided each system’s required inputs and outputs are covered.
Strategy 3 — Start from your actual AI role
When your organization uses external model APIs, SaaS AI features, or cloud AI services, start with the responsibilities attached to that use. Do not copy a model developer’s risk assessment. Equally, using an external model does not remove responsibility for the system you integrate, deploy, or operate.
Four useful starting practices are:
- Identify the services and their uses: record the business purpose, owner, data involved, and affected users.
- Set usage boundaries: define approved uses, prohibited inputs, and conditions for consequential decisions.
- Apply risk-based oversight: establish appropriate output checks, human review, escalation, and monitoring rather than assuming every output needs the same review.
- Manage supplier dependencies: assess available assurance and contractual terms, provider changes, incident arrangements, and limitations that require additional safeguards.
These practices are a starting point, not the complete AIMS. Integrating or modifying an AI service can also involve design, testing, and change responsibilities. Our ISO/IEC 5338 life cycle overview helps identify the activities involved. Control applicability should follow the organization’s actual responsibilities and risk treatment decisions, not a blanket “we only use AI” exemption.
Strategy 4 — Assign roles part-time, but assign them properly
ISO/IEC 42001 requires relevant responsibilities and authorities to be assigned and communicated; it does not prescribe a full-time “AI officer” job title. A small organization might appoint an AIMS coordinator alongside an existing role, name AI system owners, and arrange competent internal audit coverage. The titles are examples, not required positions.
The coordinator can organize assessments and report progress, while top management retains its leadership responsibilities. Each role needs sufficient authority, competence, and time. Experience auditing ISO 27001 is useful, but the auditor also needs competence relevant to the AIMS and its AI activities; a particular personal certification is not itself an ISO/IEC 42001 requirement.
Internal audit must be objective and impartial. Avoid assigning people to audit their own work. Cross-functional review or an independent, competent external party can help a small team achieve this; the organization’s certification body should not be used to perform its internal audit.
Strategy 5 — Sequence it in three phases
The following is an illustrative six-month preparation sequence, not a minimum duration, a general benchmark, or a promise of certification within six months. Adapt it to the scope, starting maturity, available time, and evidence needed. Discuss scope and scheduling with a suitable certification body early rather than waiting until preparation is complete.
Phase 1 (months 1–2) — establish the foundations. Confirm the scope, relevant requirements, AI inventory, roles, policy, and objectives. Establish assessment criteria and begin AI risk and system impact assessments, planning coverage across the defined scope. Our AI risk assessment methodology provides a practical sequence; the ISO/IEC 23894 overview explains supporting risk guidance, and the ISO/IEC 42005 overview explains impact assessment guidance.
Phase 2 (months 2–4) — implement and operate. Complete the planned assessments, implement risk treatment, and document the Statement of Applicability, including necessary controls and reasons for inclusion or exclusion of Annex A controls. Establish the required documents and records, address competence needs, and ensure relevant people understand their responsibilities. Operate the controls and retain evidence rather than treating this phase as document production alone.
Phase 3 (months 4–6) — evaluate readiness. Conduct the internal audit, address identified nonconformities, review corrective-action effectiveness, and hold management review. The internal audit checklist supports this stage. Confirm readiness for the agreed certification process, including Stage 1 and Stage 2; allow separately for scheduling, findings, certification review, and the certification decision.
The ISO/IEC 42006 overview explains requirements directed at certification bodies, not additional qualifications every small organization must obtain. The full implementation sequence is covered in our seven-step governance roadmap. The supporting standards linked here help with implementation; ISO/IEC 42001 does not make their separate adoption or certification universal prerequisites.
Four mistakes smaller organizations make
- Using an enterprise template unchanged. Adapt documents to actual responsibilities and decisions. Combining records can be sensible; leaving out required content is not.
- Planning only for document completion. Reserve time to operate controls, evaluate results, and correct weaknesses. Set the audit date around readiness and certification-body availability, not an assumed minimum preparation period.
- Running it without leadership. Clause 5.1 requires top-management commitment. Approval at the end cannot replace decisions about objectives, resources, accountability, and improvement throughout implementation.
- Treating the certificate as the finish line. Continue monitoring, reassessment, internal audit, management review, and improvement after certification. The system must remain useful when AI services, suppliers, or business needs change.
ISO 42001 for small organizations: preparation checklist
This is a preparation aid, not a substitute for reviewing all applicable requirements.
- ☐ AIMS scope documented, with relevant context, requirements, and dependencies considered
- ☐ AI systems, purposes, organizational roles, and suppliers identified
- ☐ Existing processes reviewed for reuse and remaining gaps identified
- ☐ Responsibilities, authorities, competence needs, and resources established
- ☐ AI policy established by top management and communicated appropriately
- ☐ AI objectives and plans for achieving them established
- ☐ AI risk assessment and treatment documented across the defined scope
- ☐ AI system impact assessments completed in accordance with the established process
- ☐ Statement of Applicability completed and necessary controls implemented
- ☐ Responsible use, oversight, and supplier arrangements implemented as applicable
- ☐ Required documents, competence evidence, and operating records available
- ☐ Performance monitored and results evaluated
- ☐ Competent, objective internal audit completed and corrective actions evaluated
- ☐ Management review completed, with decisions and follow-up recorded
- ☐ Certification scope, readiness, and Stage 1/Stage 2 arrangements confirmed with the certification body
The bottom line
A small organization can build an effective AIMS without copying a large enterprise’s structure. Focus the scope, reuse suitable processes, govern the AI activities you actually perform, assign responsibilities with sufficient time and authority, and build evidence through operation.
The goal is proportionate implementation, not reduced requirements. Certification can then provide independent assurance about the management system within its defined scope, rather than become a substitute for managing AI responsibly.
Wondering where to begin? Our free AI governance readiness assessment has 13 questions and takes about 5 minutes. It provides an indicative snapshot based on your answers, not a certification or formal conformity determination.
Reference basis: ISO/IEC 42001:2023 and the European Commission’s AI Act overview. The role examples, combined-record suggestions, and six-month sequence are practical implementation suggestions, not additional requirements of the standard.
Related
🧭 The full sequence: building an AI governance framework — a seven-step roadmap to ISO 42001.
🔧 Already hold ISO 27001? Extending an ISO 27001 ISMS to ISO/IEC 42001, control by control.
📄 Documents and records: the ISO 42001 documentation guide.
🗺 Supporting standards: explore our SC 42 AI Standards Map for related guidance on governance, risk, impact assessment, and the AI life cycle.