Service · Wolff Applied AI

AI Management System (AIMS) – aligned with ISO/IEC 42001

A living, audit-ready AI management system instead of a binder — aligned with ISO/IEC 42001 and the EU AI Act.

6–10 weeksDuration
On requestInvestment
7Deliverables
Book an intro call All services

Why this offer matters now

In 6–10 weeks we build an AI management system (AIMS) aligned with ISO/IEC 42001 — as a living system, not a binder. Building on the Wolff Applied AI reference model, we develop context and scope (chapter 4), AI policy and roles (chapter 5), a risk methodology with an AI risk register and a Statement of Applicability covering the Annex A controls (chapter 6), as well as the management cycle of document control, internal audit and management review (chapters 7/9/10). The system runs as a working portal module, is immediately maintainable and prepared for later certification — it remains expressly organisational consulting, not legal advice, and is aligned with ISO/IEC 42001, but is not a certification.

Starting point

Many organisations have an AI policy but no system that governs AI across its lifecycle: risks, impacts, suppliers, audits and reviews remain disconnected. ISO/IEC 42001:2023 is the first international standard for AI management systems; clients, public procurement bodies and auditors increasingly ask for robust AI governance. The EU AI Act has required AI competence (Article 4) since 02.02.2025 and will require transparency (Article 50) from 02.08.2026; without a documented, lived system, due diligence is hard to demonstrate. Pure template packages go stale quickly — what is needed is a maintained, audit-ready system that grows with the organisation.

Your benefit

  • An AI management system aligned with ISO/IEC 42001, audit-ready, with all core building blocks of chapters 4–10.
  • A working system instead of a binder: all building blocks live as maintainable records in the WAI portal module — you get a system you already use on the day of handover.
  • A Statement of Applicability covering the Annex A controls with a reasoned applicability and implementation status.
  • An AI risk register and AI system impact assessments that reflect real systems and data flows.
  • A lived management cycle: document control, internal audit and management review with traceable evidence.
  • Demonstrable organisational diligence towards supervisory bodies, clients and auditors — as alignment with ISO/IEC 42001, expressly without legal advice and without a certificate.

A good fit when …

  • You want to govern AI permanently (policy, risks, controls, audit, review) instead of leaving it at a one-off policy.
  • Clients, supervisory bodies, procurement bodies or auditors ask you for robust AI governance.
  • Several AI systems are in use whose risks and impacts have so far remained disconnected.
  • You want to keep a later certification open as an option but need a working system now.

How we work

4 phases, 4 gates — you decide at every transition.

  1. 01

    Context, Policy & Gap Analysis

    In the kickoff with management, compliance/data protection and IT, we clarify goals, scope and existing rules. A gap analysis against ISO/IEC 42001 (chapters 4–10 and Annex A) delivers the as-is/to-be finding; context and scope (chapter 4), AI policy (5.2) and the role/RACI model (5.3) are established.

    Gate — your approvalG1: scope fixed, AI policy and RACI ready for approval, gap finding complete.
  2. 02

    Risks, SoA & Impact

    We develop the risk methodology and an AI risk register linked to the AI inventory (6.1) and assess the applicability and implementation status of every Annex A control in the Statement of Applicability. AI system impact assessments (6.1.4) and a supplier/LLM provider register (8.x) reflect real systems and data flows.

    Gate — your approvalG2: risk register substantiated, Statement of Applicability across Annex A assessed, impact assessments available for each in-scope system.
  3. 03

    Operations & Management Cycle

    We set up approval/review processes and document control (7.5), define AI objectives/KPIs (6.2) with a measurement source and a deviation/corrective-action process (10). A first internal audit (9.2) and a first management review (9.3) are actually carried out and documented.

    Gate — your approvalG3: document control in place, first internal audit and first management review actually carried out.
  4. 04

    Handover & Enablement

    We hand over the living system to those responsible, train them in upkeep and the review rhythm, and run through an approval/review case. An awareness briefing (Article 4 competence) and a recommendation for the next steps, including the certification option, complete the project.

    Gate — your approvalG4 (acceptance): living AIMS handed over, those responsible trained; "aligned with, not certified" and "not legal advice" featured in all external documents.

What you receive

  • Living AIMS in the portal module

    All building blocks as maintainable, versioned records in the WAI portal module "Management System" — a working system instead of a stack of documents.

  • ISO/IEC 42001 gap analysis

    As-is/to-be finding across chapters 4–10 and Annex A with a prioritised build-out backlog.

  • Context, scope & AI policy

    Documented scope (chapter 4), an AI policy ready for signature (5.2) and a role/RACI model (5.3).

  • Risk methodology, AI risk register & SoA

    Assessment logic (6.1), a populated risk register and a Statement of Applicability across the Annex A controls.

  • AI system impact assessments & supplier register

    Impact assessments per in-scope system (6.1.4) and third-party/LLM provider governance (8.x/A.10).

  • Management cycle

    Document control (7.5), a first internal audit (9.2) and a first management review (9.3) with evidence.

  • Handover & awareness package

    Trained responsible parties, upkeep/review rhythm, awareness briefing and next steps including the certification option.

Base package plus optional modules

The base package stands on its own. Optional modules dock on now or later — you decide how far you go.

Management review support

We facilitate and document a management review (9.3) beyond the first one included in the base package — as a recurring pacemaker for leadership. Reinforces the lived cycle but does not replace internal responsibility for decisions.

available now

Internal audit as a service

We carry out a further internal audit (9.2) as a neutral external service and document findings and improvement potential. Useful to book later on an annual rhythm; it remains organisational consulting, not certification.

available later

Certification preparation

A separate project that specifically prepares the system aligned with ISO/IEC 42001 for an external certification audit (evidence base, maturity, mock audit). Separately scopable later; the certification itself is carried out by an accredited body.

available later

Good to know & honest scope

Good to know

Prerequisites

  • Naming of contacts from management, compliance/data protection and IT.
  • Access to existing rules, AI inventory/tool overview, list of data processing agreements and data-protection documentation.
  • Willingness of leadership to approve the AI policy, the Statement of Applicability and the scope.

Your involvement

  • Availability of those responsible for workshops, risk/impact assessments and the first audit and management review.
  • Approval decision by leadership on policy, SoA and scope.
  • Naming of the people responsible for maintaining the living system after handover.

Credit: A preceding AI Governance Starter Package can be credited proportionally when commissioned directly.

Honest scope

  • –A certification, a certificate or a standard logo — the system is aligned with ISO/IEC 42001 but is expressly not certified.
  • –Legal advice or a legally binding assessment: the service is organisational consulting, not legal advice.
  • –A separate certification-preparation project (separately scopable on request).

Note: not legal advice. Content with a legal dimension (e.g. EU AI Act, GDPR, ISO/IEC 42001) is professional orientation, not legal counsel.

Key facts

Target group
Organisations (50–500 employees) and public bodies that want to not just organise AI but govern it permanently — with a lived management system instead of a one-off policy. Addresses management, compliance, data protection and IT, especially where clients, supervisory bodies, procurement bodies or auditors ask you for robust AI governance.
Duration
6–10 weeks
Price
On request
Credit
A preceding AI Governance Starter Package can be credited proportionally when commissioned directly.
Recommended next step
AI Retainer

You receive a clear, individual proposal before any engagement. Under § 19 UStG no VAT is charged; any ancillary costs (e.g. model/hosting/API fees, travel) are not included.

Next step

Ready to get concrete?

Let us clarify in a free intro call whether this offer fits your situation — honestly and without sales pressure.As a follow-up we then recommend AI Retainer.

Non-binding · online or on site · reply < 24 h

Book an intro call AI Retainer