ISO 42001 Implementation Roadmap: 32-Week Guide

The foundation determines everything that follows. Don't shortcut this phase.

Week 1-2: Project Initiation

• Secure executive sponsorship and budget commitment
• Appoint project manager and core team
• Define scope (which AI systems, which business units)
• Identify certification body (consider Gulf-based auditors)

Week 3-4: Gap Analysis

• Assess current state against ISO 42001 requirements
• Use our ISO 42001 readiness assessment for structured evaluation
• Document existing controls and processes
• Identify high-priority gaps

Deliverable: Gap analysis report with prioritized remediation roadmap

You can't govern what you don't know exists.

Week 5-6: AI System Discovery

• Catalog all AI systems (including shadow AI)
• Document purpose, data inputs, outputs, users
• Classify systems by risk level
• Map data flows and third-party dependencies

Week 7-8: Impact Assessment

• Conduct AI impact assessments per Clause 8
• Identify potential harms and affected parties
• Assess bias, fairness, and explainability risks
• Document mitigation strategies

Deliverable: AI system register, impact assessment reports

Documentation is the backbone of certification. Plan for iteration.

Week 9-10: Core Policies

• AI Policy (Clause 5.2)
• Risk management policy
• Roles and responsibilities matrix

Week 11-12: Procedures

• AI system lifecycle procedures
• Impact assessment methodology
• Incident response procedures
• Third-party management procedures

Week 13-14: Supporting Documents

• AI system documentation templates
• Training materials
• Communication templates
• Audit checklists

Week 15-16: Review and Approval

• Management review of documentation
• Legal and compliance review
• Version control establishment
• Document distribution

Deliverable: Complete AIMS documentation set

Policies mean nothing without execution.

Week 17-18: System Implementation

• Deploy document management system
• Configure monitoring tools
• Establish metrics collection
• Implement technical controls

Week 19-20: Training Rollout

• Executive awareness sessions
• AI governance committee training
• Technical team training
• General staff awareness

Week 21-22: Control Implementation

• Implement Annex A controls systematically
• Focus on high-risk areas first
• Document implementation evidence
• Address identified gaps

Week 23-24: Operational Testing

• Test procedures in production
• Verify control effectiveness
• Collect performance metrics
• Adjust based on findings

Deliverable: Operational AIMS with trained personnel

Internal audit is your dress rehearsal for certification.

Week 25-26: Internal Audit

• Conduct comprehensive internal audit
• Use qualified auditors (consider external support)
• Document findings and nonconformities
• Prioritize corrective actions

Week 27-28: Corrective Actions and Management Review

• Address audit findings
• Implement corrective actions
• Conduct formal management review
• Document continual improvement plans

Deliverable: Internal audit report, management review minutes

The final push toward certification.

Week 29-30: Pre-Audit Preparation

• Review all documentation completeness
• Verify evidence availability
• Brief audit participants
• Conduct mock audit if possible

Week 31-32: Certification Audit

• Stage 1: Documentation review (typically 1-2 days)
• Address any Stage 1 findings
• Stage 2: On-site assessment (typically 3-5 days)
• Respond to audit findings

Deliverable: ISO 42001 certification (upon successful audit)