ISO 42001 certification in the UK: what it covers and what it doesn’t
Prepare your AI management evidence.
ISO/IEC 42001 certifies how an organisation manages AI: policy, roles, risk and operating evidence. It does not settle a system’s EU AI Act duties. Tenhaw is not certified; ISO/IEC 42001 is under assessment. This is not legal advice.
30 minutes with James · how this would work in your organisation
The basis for this approach
This is our function-level delivery approach, not a clause-by-clause certification mapping. ISO/IEC 42001 is under assessment at Tenhaw. Certification and independent auditing belong to appropriately qualified bodies. This is delivery guidance, not legal advice. Your legal owner determines the duties and classification for each system.
The demand signal
Tenhaw’s published industrial and energy guidance describes ISO/IEC 42001 and the NIST AI RMF as ways to keep a defensible record of AI risk management. Its security page states the firm’s actual assurance status.
Bring the reason this is on your agenda to a 30-minute call with James, and we can explore what it would take in your organisation.
Book a 30-minute callWhy it stalls
2 failure modes we keep meeting
The register separates from the running system
A policy and an inventory only help when they describe the system people actually use. Keep owners, evaluation records and changes connected to delivery.
A certificate is treated as a per-system legal answer
The management-system disciplines overlap with the evidence a system may need, but they do not replace the legal owner’s assessment of that system’s obligations. This is delivery guidance, not legal advice. Your legal owner determines the duties and classification for each system.
If one of these sounds familiar, bring it to a 30-minute call with James and we can explore a way past it.
Book a 30-minute callHow we approach it
3 moves, in order
- 01
Start with the evidence you need to operate
Build an AI inventory, record decision ownership and keep evaluation results with the runs that produced them. Use review gates and change history as normal delivery records.
- 02
Distinguish frameworks from legal duties
ISO/IEC 42001 describes an AI management system. NIST organises risk work through govern, map, measure and manage. The EU AI Act raises separate questions for the particular system and organisation. This is delivery guidance, not legal advice. Your legal owner determines the duties and classification for each system.
- 03
Check the supplier’s actual status
Tenhaw is not certified to ISO/IEC 42001; it is under assessment. Cyber Essentials Plus certification is in progress, and ISO 27001 has a gap assessment complete with certification targeted for 2027. Read the current security statement when procuring.
Your legal owner determines the duties and classification for each system.
Prefer to talk it through? Ask us on a discovery call →
Sources
Every source below was opened and read before it was attached. Where nothing survived that check, the claim on this page was softened rather than given a plausible-looking link.
Tenhaw, industrial and energy assurance frameworksTenhaw, AI governance and regulatory evidenceTenhaw, security and assuranceISO/IEC 42001 is under assessment; Tenhaw is not certified.NIST AI Risk Management FrameworkEuropean Commission, AI Act framework and application timelinePrimary overview checked 5 November 2026, with a link to the final AI Omnibus text and current high-risk dates.ISO, ISO/IEC 42001 AI management systemsThe closest guides to this one
Nearest first, then the rest. Each one carries the same label: written from delivery, or the method we would bring. All 34 are on the hub.
What should an AI governance framework include?
Keep the AI inventory, accountable decisions and evidence connected.
Our approachNIST AI RMF vs ISO 42001
Compare NIST’s voluntary AI risk framework with ISO/IEC 42001’s certifiable management system and the delivery evidence both help organise.
Our approachDoes the EU AI Act apply to UK companies?
Check your systems, role and EU exposure.
Our approachHow do we verify an AI agent beyond a vendor demo?
Give your release decision evidence the business can inspect.
Our approachAgent identity and access
Give each workflow the authority it needs, with a way to take it away.
DeliveredWhat does an AI-native software delivery lifecycle look like?
Connect requirements, AI engineering and human release decisions.
Or bring the problem to a call instead of reading three more of these.
Book a 30-minute callWork out the next step for your team.
A 30-minute call with James Rooney to discuss your workflow, people and budget. Leave with a rough scope and a useful next step.
90-day outcome programme · £120k or £180k fixed · 90 days · excluding VAT
No time that suits? Email hello@tenhaw.com. Calendar not loading? Open it on cal.com.
Describe the work
Describe the work in a paragraph. James replies with a rough scope and budget range within two working days.
Questions this guide answers
What does ISO 42001 require?
At function level it is an AI management system: policy, roles, risk assessment, controls and evidence that those controls operate. Keep those records connected to the systems and decisions they describe. This guide is not a clause-by-clause certification checklist.
Does ISO 42001 cover the EU AI Act?
No. A management-system certificate does not discharge per-system legal obligations. The disciplines overlap, but your legal owner must determine the classification and duties for each system. This is not legal advice.
Is it mandatory in the UK?
ISO/IEC 42001 is a certifiable standard, not law. Procurement requirements and the duties on a specific system need separate checks with the relevant owners. This is not legal advice.
How does it relate to ISO 27001?
Treat AI-management and information-security assurance as distinct questions in procurement. Tenhaw publishes its status for each separately: ISO/IEC 42001 is under assessment; ISO 27001 has a gap assessment complete and certification targeted for 2027.
How does it compare with the NIST AI RMF?
NIST’s framework is voluntary and organised around govern, map, measure and manage, with a generative AI profile alongside it. ISO/IEC 42001 is a certifiable management system for AI. Neither is law; both need records grounded in the running work.
Is Tenhaw certified?
No. The published security wording is “ISO/IEC 42001 (AI management systems), under assessment, and increasingly the one clients ask for”. Nothing in that status is a certification claim.
What evidence should we build first?
Start with a proportionate inventory, named owners, evaluation records, approval records and change history. Produce them while designing and building the workflow so that the record describes how it actually runs.