ISO 42001 practical guidance: start with an AI-use register | 5 October 2026
Updated: 3 days ago
Practical guidance • Week commencing 5 October 2026
No material new announcement was verified for this week’s AI-management topic in the official sources checked on 5 October 2026. This article therefore offers practical guidance, not a new deadline or regulatory announcement.
Which ISO 42001 edition are you looking at?
ISO lists the international standard as ISO/IEC 42001:2023, first published on 18 December 2023. BSI’s UK and European adoption, BS EN ISO/IEC 42001:2026, was published on 31 March 2026. BSI explicitly says there are no technical differences from BS ISO/IEC 42001:2023. The different year is not, by itself, a reason to rebuild your system or assume a new certification transition deadline.
This week’s action: build a one-page AI-use register
Our suggested starting point is to record each AI tool or AI-enabled function, its business purpose, supplier, accountable owner, information entered and the decisions its output influences. Include everyday uses such as tender drafting, customer replies and staff scheduling. These are examples, not assumptions about your organisation.
Then choose one use case to review. Ask: could confidential data be exposed? Could an inaccurate or biased output affect a person or client? Who checks important outputs, and when must a concern be escalated? Record the control, owner, review date and evidence that the control operates. Keep the record proportionate and update it when the tool or purpose changes.
This is Clause Ten’s practical implementation suggestion, not a complete checklist or a substitute for the authorised standard. ISO 42001 addresses organisational AI management; a tidy register alone does not demonstrate conformity.
Connect AI oversight with information security
ISO/IEC 27001:2022 concerns information-security management. Existing access, supplier, incident and document-control processes can be useful foundations, but an information-security system does not automatically cover every AI impact. Review both the information handled and the effects of AI-assisted decisions.
Security-business watch: ACS and BAS
The SIA announcement published on 8 June 2026 describes plans to introduce a new business approval scheme. That forward-looking announcement is not evidence that ACS has ended. No new ACS cessation date was verified in this review. Continue following applicable ACS obligations and official SIA instructions; do not treat proposals, programme milestones or pilots as final transition requirements.
Need help turning the register into a working system?
Clause Ten Consulting can help with scoping, gap analysis, responsibilities, policies, staff briefings, internal audits and management review. Independent certification bodies make certification decisions; consultancy does not guarantee certification or scheme approval.
Comments