ISO/IEC 42001 Maturity · Artificial Intelligence Management Systems (AIMS)
Your AI governance, measured against ISO 42001 and turned into a costed action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
ISO/IEC 42001 Maturity · Artificial Intelligence Management Systems (AIMS)
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One ISO/IEC 42001:2023 assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
This mechanism, a level, the level above, and the action linking the two, is what turns a finding into a trajectory.
Are AI use cases recorded and assessed before going into production?
- N1
No recording takes place. Use cases appear within business functions without management being aware of the list.
- N2
An inventory exists, maintained on the initiative of a few teams. It is incomplete and pre-production assessment remains informal.
- N3
Every new use case is declared and assessed against a common template before going into production. A few late declarations still occur.
- N4
Declaration is a condition for access to production environments. Assessments and validation decisions are logged and assigned to a named owner.
- N5
The inventory is reviewed periodically, decommissioned use cases are documented, and lessons from incidents feed back into the assessment template.
Action to move from L2 to L3
Publish a single use case assessment template (purpose, affected individuals, data involved, risk level) and put its review on the agenda of the existing data committee, with a mandatory checkpoint before any production deployment.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon ISO 42001.
What this framework covers
ISO/IEC 42001, published in 2023, is the first certifiable international standard dedicated to the management of artificial intelligence. It follows the common structure of management system standards: context, leadership, planning, support, operation, performance evaluation, improvement. Its distinctive feature lies in two mechanisms specific to AI: the assessment of impacts on individuals and society, kept separate from risk assessment for the organisation, and documented control over the AI system lifecycle, from design to decommissioning, including when the model comes from a supplier.
In practice, the challenge is not understanding the standard but knowing where the organisation actually stands. Are deployed AI use cases comprehensively recorded, including those introduced through a supplier’s software component? Who decides that a system can go into production, and on what documented criteria? Are impacts on affected individuals assessed before deployment, or only noticed after the first complaints arrive? On these three questions, the gap between the governance narrative and actual practice is often wide.
One confusion keeps coming up: ISO 42001 and the EU AI Act do not replace one another. The regulation classifies systems by risk level and imposes enforceable obligations on providers and deployers. The standard describes the internal organisation that allows those obligations to be met over time. A management system aligned with ISO 42001 provides a reusable foundation for demonstrating the required level of control, without exempting anyone from an article-by-article applicability analysis.
The maturity assessment answers a different question from a certification audit. An audit concludes with a finding of conformity or nonconformity. The assessment places each practice on a progressive scale and points to the precise action needed to reach the next level. This is what allows an organisation to prepare for certification without starting the work blind, and to compare business units that are not progressing at the same pace.
Within Datamensio, the framework is ready to use and adaptable. The AI adjusts the themes, questions and levels to your sector and scope, or builds a tailored version from your own documents: AI policy, use case register, model validation procedures.
Reference standard: ISO/IEC 42001:2023
The themes assessed
AIMS context and scope
Definition of scope, the organisation’s roles (provider, deployer, developer), interested parties, statement of applicability of Annex A controls.
Leadership and AI policy
Formalised and communicated AI policy, management commitment, resource allocation, alignment with other management systems.
Roles, responsibilities and governance
Assignment of responsibilities across the lifecycle, decision-making body for use cases, separation between development and validation, escalation of decisions.
AI risk assessment
Assessment method, acceptance criteria, prioritisation of use cases, risk treatment and acceptance of residual risk.
Assessment of impacts on individuals and society
Identification of affected individuals, analysis of effects on fundamental rights, consideration of vulnerable groups, traceability of conclusions.
AI system lifecycle
Design requirements, datasets and their provenance, verification and validation before production, technical documentation, decommissioning conditions.
Data used by AI systems
Data quality and representativeness, bias management, traceability of origin, usage rights, control over retraining data.
Transparency and user information
Disclosure of AI use, explainability proportionate to the use case, documentation provided to deployers, handling of complaints and human recourse.
Suppliers and third parties
Selection criteria, contractual requirements on AI models and services, evaluation of reused components, monitoring of changes imposed by the vendor.
Monitoring, internal audit and improvement
Performance indicators for systems in production, drift detection, internal audits, management review, corrective actions and lessons learned.
A short version of the framework, with 32 questions, is available for the online self-assessment.
Frequently asked questions
Is ISO 42001 certifiable?
Yes, it is a management system standard certifiable by an accredited body, following the same model as ISO 27001. Datamensio measures your maturity and prepares you for the audit: it does not issue any certification.
What is the difference between this assessment and a certification audit?
An audit checks that requirements are met and concludes with a finding of conformity or nonconformity. The assessment places each practice on a maturity scale and points to the action that moves it to the next level. The assessment prepares, the audit validates.
Do we need to already be ISO 27001 certified to get started?
No, but it helps. The two standards share a common structure: context, leadership, planning, performance evaluation. Organisations that already have a management system in place can reuse part of their procedures and documentation.
How does this assessment fit with the EU AI Act?
The Act imposes obligations based on a system’s risk level. The standard describes the organisation needed to meet those obligations over time. A solid ISO 42001 assessment provides a reusable foundation, and the cross-cutting roadmap lets you address both topics without duplicating actions.
How long does the assessment take?
The short version takes 20 to 30 minutes to complete. The full version, run collaboratively, typically spans one to two weeks: most of the time goes into gathering input from data, security, legal and business teams.
Can the framework be adapted to our context?
Yes. You can edit the questions, levels and themes, or start from your own documents to build a tailored version. The AI drafts the content and refines the levels using the CMMI method. The framework remains fully under your control.
Do we need machine learning technical expertise to answer?
The questions focus on governance and management practices, not model architecture. Some require input from a data scientist or architect: the collaborative mode lets you assign those questions to the right person.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European solutions.