[Short-Form] Pursuing ISO/IEC 42001 Certification: How to Run It with eiso (90-Second Practical Guide)
Author Admin | Date 2026-10-21 | Views 23
Attachment eiso-숏폼-ISO42001-추진-가이드.mp4
For organizations that use AI in their work or provide AI products and services to customers, we have summarized in 90 seconds how to use eiso's ICT Management System Operation when preparing for ISO/IEC 42001 (AI management system) certification. Press the play button above (vertical video, 1 minute 30 seconds).
What auditors look at
A certification audit looks at evidence of operation rather than a single set of documents. The key is whether the following link up with one another: how AI was selected (inventory), how risks and impacts were assessed (risk assessment and impact assessment), which controls were applied and why (Statement of Applicability), and the records showing those controls actually operated (usage approval, monitoring, training, internal audit, management review).
Implementation sequence and eiso operation steps (parentheses show ISO/IEC 42001:2023 clauses)
1. Scope and AI role (4.3): First decide the organization's role among development, supply, and use. Whether the Annex A controls apply depends on the role.
2. AI context analysis (4.1 to 4.4) and AI objective setting (5.2, 6.2): Organize issues using stakeholders, PESTEL, and SWOT, and set the AI policy and AI objectives centered on effectiveness and efficiency.
3. AI selection and AI system inventory: Select AI for each task by evaluating it on 6 axes, and register the role, scope of use, and LEVEL in the inventory. This list is the subject of the risk assessment.
4. AI risk assessment (6.1.2, 8.2, refer to ISO/IEC 23894) and AI system impact assessment (6.1.4, 8.4, refer to ISO/IEC 42005): Assess by likelihood × severity, and for high-risk tasks, assess the impact on individuals, groups, and society by area.
5. Control adoption and Statement of Applicability (6.1.3, 38 Annex A controls): Record the controls chosen in risk treatment and the reasons for exclusions in the Statement of Applicability (SoA).
6. Verification and usage approval, operational management, and documented information management (7.5, Clause 8): Operate only AI that has passed the usage approval gate, and manage versions and changes with the AI operation management register and the latest editions with the document list.
7. Monitoring during use (9.1) and AI legal requirements identification and monitoring: Research AI-related laws and regulations from primary sources and enter them in the legal requirements register, and re-check amendments and compliance status every half year.
8. Internal audit (9.2), management review (9.3), nonconformity and corrective action (10.2), and improvement (10.1): Check in advance with checklists and an AI virtual audit, and let decisions and improvements feed into the next cycle's context analysis and objectives.
When operating ISO/IEC 27001 together
- Integrated operation: Use one risk register, one internal audit, and one management review, while keeping a separate Statement of Applicability for each standard.
- Independent operation by standard: Separate the operating platform for each standard and manage the steps, results, and documents separately.
Implementation tips (expert perspective)
- The inventory → risk assessment → controls → Statement of Applicability must be linked by numbers so that auditors can trace them. Do not skip the sequence.
- For every control declared as "applicable" in the Statement of Applicability, operating records (approval records, monitoring results, training records, etc.) must remain as evidence.
- AI laws and regulations change quickly. Verify them from primary sources, record the date of verification, and mark any effective dates or provisions you could not verify as "verification needed."
- We recommend completing at least one internal audit and one management review before the certification audit so that operating records are in place.
Pricing
- Management system operation usage right: KRW 300,000 per year for the first standard, and KRW 100,000 for each additional standard (excluding VAT, valid for 1 year from the payment date).
Learn more
- ICT Management System Operation guide: https://eiso.co.kr/en/html/sub02_75
- eiso pricing guide: https://eiso.co.kr/en/html/sub02_6
* AI outputs are reference drafts that your company reviews and finalizes, and they do not guarantee certification results. eiso is operated by agents independently of any specific certification body.
Contact: eiso@eiso.co.kr
What auditors look at
A certification audit looks at evidence of operation rather than a single set of documents. The key is whether the following link up with one another: how AI was selected (inventory), how risks and impacts were assessed (risk assessment and impact assessment), which controls were applied and why (Statement of Applicability), and the records showing those controls actually operated (usage approval, monitoring, training, internal audit, management review).
Implementation sequence and eiso operation steps (parentheses show ISO/IEC 42001:2023 clauses)
1. Scope and AI role (4.3): First decide the organization's role among development, supply, and use. Whether the Annex A controls apply depends on the role.
2. AI context analysis (4.1 to 4.4) and AI objective setting (5.2, 6.2): Organize issues using stakeholders, PESTEL, and SWOT, and set the AI policy and AI objectives centered on effectiveness and efficiency.
3. AI selection and AI system inventory: Select AI for each task by evaluating it on 6 axes, and register the role, scope of use, and LEVEL in the inventory. This list is the subject of the risk assessment.
4. AI risk assessment (6.1.2, 8.2, refer to ISO/IEC 23894) and AI system impact assessment (6.1.4, 8.4, refer to ISO/IEC 42005): Assess by likelihood × severity, and for high-risk tasks, assess the impact on individuals, groups, and society by area.
5. Control adoption and Statement of Applicability (6.1.3, 38 Annex A controls): Record the controls chosen in risk treatment and the reasons for exclusions in the Statement of Applicability (SoA).
6. Verification and usage approval, operational management, and documented information management (7.5, Clause 8): Operate only AI that has passed the usage approval gate, and manage versions and changes with the AI operation management register and the latest editions with the document list.
7. Monitoring during use (9.1) and AI legal requirements identification and monitoring: Research AI-related laws and regulations from primary sources and enter them in the legal requirements register, and re-check amendments and compliance status every half year.
8. Internal audit (9.2), management review (9.3), nonconformity and corrective action (10.2), and improvement (10.1): Check in advance with checklists and an AI virtual audit, and let decisions and improvements feed into the next cycle's context analysis and objectives.
When operating ISO/IEC 27001 together
- Integrated operation: Use one risk register, one internal audit, and one management review, while keeping a separate Statement of Applicability for each standard.
- Independent operation by standard: Separate the operating platform for each standard and manage the steps, results, and documents separately.
Implementation tips (expert perspective)
- The inventory → risk assessment → controls → Statement of Applicability must be linked by numbers so that auditors can trace them. Do not skip the sequence.
- For every control declared as "applicable" in the Statement of Applicability, operating records (approval records, monitoring results, training records, etc.) must remain as evidence.
- AI laws and regulations change quickly. Verify them from primary sources, record the date of verification, and mark any effective dates or provisions you could not verify as "verification needed."
- We recommend completing at least one internal audit and one management review before the certification audit so that operating records are in place.
Pricing
- Management system operation usage right: KRW 300,000 per year for the first standard, and KRW 100,000 for each additional standard (excluding VAT, valid for 1 year from the payment date).
Learn more
- ICT Management System Operation guide: https://eiso.co.kr/en/html/sub02_75
- eiso pricing guide: https://eiso.co.kr/en/html/sub02_6
* AI outputs are reference drafts that your company reviews and finalizes, and they do not guarantee certification results. eiso is operated by agents independently of any specific certification body.
Contact: eiso@eiso.co.kr
※ This is a translation of the Korean notice. If there is any difference, the Korean version prevails.
