GRC & Risk
Continuous Control Monitoring: From Annual Audits to Real-Time Assurance
Point-in-time audits tell you a control worked on the day it was tested. Continuous control monitoring tells you whether it is working now.
Key takeaways
- ISO/IEC 42001, published in 2023, is the first certifiable AI management system standard.
- It follows the same management-system structure as ISO 27001, so integration is natural.
- Start with an AI inventory — many organizations have unrecognised 'shadow AI'.
- Use it as a backbone for meeting obligations such as the EU AI Act.
What ISO/IEC 42001 is
ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS). It applies to organizations that develop, provide or use AI systems, and it is certifiable by accredited bodies.
What it requires
- Understanding the organization's context and the role it plays — developer, provider or user of AI.
- Leadership commitment and an AI policy.
- AI risk assessment and AI system impact assessment, considering effects on individuals and society.
- Controls covering data quality, transparency, human oversight, lifecycle management and third-party AI.
- Monitoring, internal audit, management review and continual improvement.
How it fits with ISO 27001
Both standards share the harmonised management-system structure, so policies, risk methodology, internal audit and management review can be integrated. Many organizations extend their existing ISMS rather than building a separate system.
The regulatory picture
The EU AI Act introduces risk-based obligations for AI systems, with requirements phasing in over several years. Data protection laws such as GDPR also apply to personal data used in AI. ISO 42001 provides a management structure to meet these obligations consistently.
Practical first steps
- Build an AI inventory — including AI features embedded in SaaS tools and generative AI used by staff.
- Classify use cases by risk — customer-facing decisions and processing of sensitive data deserve the most scrutiny.
- Publish an acceptable-use policy for generative AI.
- Assign ownership for each AI system.
- Perform impact assessments for high-risk use cases.
- Integrate AI risks into the enterprise risk register.
Typical timeline
| Phase | Duration |
|---|---|
| Inventory and gap assessment | 4–6 weeks |
| Policy, roles and risk method | 6–8 weeks |
| Controls and impact assessments | 2–4 months |
| Internal audit and certification readiness | 1–2 months |
Next step: NAZZTEC AI GRC includes privacy and AI governance modules; our GRC consultants can run an AI governance gap assessment.
Frequently asked questions
Is ISO 42001 mandatory?
No. It is voluntary, but it is becoming a recognised way to demonstrate responsible AI governance to customers and regulators.
Do we need ISO 27001 first?
No, but organizations with an existing ISMS can implement ISO 42001 faster by reusing its structure.
Does it apply if we only use third-party AI tools?
Yes. Users of AI systems are within scope, and supplier controls are part of the standard.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
