ISO Standards for AI Systems
A certificate is about your management system, not about your model.
What is ISO standards?
ISO preparation means building the documentation, controls and evidence an accredited assessor will examine, most often against the AI management standard or the information security standard, without any claim that we can award the certificate ourselves.
A certificate says an organisation has a management system covering a defined scope, that the controls exist, and that somebody checks them. It does not say a model is accurate, fair or well chosen. Those are different questions with different evidence.
The work itself is mostly evidence. Assessors want to see a control operating over time, which means records created as things happened rather than assembled in the weeks before an assessment. Retrospective evidence is visible as retrospective.
The cost people underestimate is not the assessment. It is the maintenance, because certification is a recurring commitment with surveillance visits, and a system maintained only before an audit produces findings at the next one.
What we cannot do for you
Duara prepares organisations in Kenya for AI and information security standard assessments.
We cannot award certification and will not imply otherwise. That comes from an accredited certification body, and a certificate from a body without accreditation may not satisfy the client who asked for it in the first place.
Who this is for
- A client or tender requires certification
- You are pursuing a standard that covers AI
- A previous assessment raised findings
- You want the discipline rather than the certificate
Industries we serve
- Technology and software
- Financial services
- Business process outsourcing
- Healthcare
- Government suppliers
- Any organisation bidding for regulated work
Problems this solves
These are the ways certification projects disappoint the people who paid for them.
- Certification mistaken for model assurance. A certificate covers the management system, and clients frequently read it as a statement about the AI itself.
- Scope that excludes the AI. A narrow scope on the certificate can leave out the systems the client was actually asking about.
- Evidence produced for the audit. Records assembled shortly before an assessment read as exactly that, and assessors have seen it many times.
- Maintenance underestimated. Certification recurs, and a system that lapses between visits produces findings at the next one.
What we deliver
A gap analysis against the relevant standard, controls implemented where they are missing, evidence accumulated as things happen, and a scope that actually covers what your clients are asking about.
A gap analysis against the relevant standard
Controls implemented where they are missing
Evidence accumulated rather than assembled
A scope statement that answers the client question
Support during the assessment itself
An honest view on whether to pursue it at all
Features
- Scope decided against the question. The scope on a certificate is what clients read, so it needs to include the systems they were asking about.
- Evidence built as you go. Assessors want controls operating over time, and records created shortly before a visit are recognisable as such.
- Controls that people follow. A documented control nobody performs produces a finding, so the design has to survive an ordinary week.
- Maintenance planned from the start. Surveillance visits recur, and treating certification as a project rather than a commitment guarantees trouble later.
- An honest recommendation first. Where nobody is asking for a certificate, we will say the discipline may be worth having and the certificate may not.
Benefits
- Tenders stop being blocked. Where certification is a requirement, having it removes a barrier that no amount of explanation gets past.
- The assessment goes smoothly. Accumulated evidence and controls people actually follow turn an assessment into a review rather than an examination.
- Clients get the right answer. A scope covering the AI systems answers the question asked, which a narrow certificate does not.
- Findings do not recur. A system built to be maintained keeps passing, while one built for a single audit degrades immediately.
Standards that reach AI systems
- AI management system standard. ISO 42001, covering how an organisation governs its use of AI, and certifiable.
- Information security standard. ISO 27001, which covers AI systems where they fall inside the defined scope.
- AI risk guidance. ISO 23894, which is guidance rather than a certifiable standard, a distinction worth knowing before planning around it.
- Scope definition. What the certificate actually covers, which is the part clients read and the part most often set too narrowly.
- Evidence records. Proof that controls operated over time rather than existed on paper.
- Accredited certification. Awarded by an accredited body, since a certificate without accreditation may not satisfy the client who required one.
Not everything published is certifiable. Some standards are guidance that helps you build a defensible approach without any certificate attached, and knowing which is which prevents work aimed at an outcome that does not exist.
How the process works, step by step
Preparation usually runs three to six months depending on the starting position. Most of that is evidence accumulating rather than work being done.
-
Step 1
Free scoping call
We establish who is asking for the certificate and what they want it to cover, which decides the scope.
-
Step 2
Gap analysis
Where you stand against the standard, including the controls you already operate without calling them that.
-
Step 3
Controls implemented
Built so people follow them in an ordinary week, since a control nobody performs becomes a finding.
-
Step 4
Evidence accumulates
Records created as things happen, which is the part that cannot be compressed at the end.
-
Step 5
Assessment support
We are with you through the assessment, and the accredited body decides the outcome.
Quality assurance and how we work
The commitments attached to work with somebody else signature at the end.
- We do not award certification. An accredited certification body does. Any supplier suggesting otherwise is describing something that is not certification.
- We will tell you not to pursue it. Where no client or tender requires it, the discipline may be worth having and the certificate may not be.
- We do not manufacture evidence. Records created for an audit are recognisable as such, and the credibility cost with an assessor is not worth the time saved.
- We tell you what maintenance costs. Certification recurs, and organisations who budget for the assessment alone are surprised twice.
- We say what a certificate does not prove. It covers your management system rather than the accuracy or fairness of any particular model.
Frequently asked questions about ISO standards
What does an ISO certificate actually prove?
That a management system exists over a defined scope and that its controls operate. It says nothing about whether a particular model is accurate.
Do clients understand that distinction?
Frequently not, which is why the scope statement matters. It is the part they read, and a narrow one answers a different question.
Which standard applies to AI?
ISO 42001 covers AI management specifically. ISO 27001 reaches AI systems where they sit inside its scope, and many organisations pursue both.
Is there a standard for AI risk?
ISO 23894, which is guidance rather than a certifiable standard. Worth knowing before planning a project around achieving it.
Can you certify us?
No. Certification comes from an accredited certification body, and any supplier implying otherwise is describing something else.
Does accreditation of the body matter?
Yes. A certificate from a body without accreditation may not satisfy the client who required one, which is an expensive way to find out.
Should we pursue certification at all?
If a client or tender requires it, yes. If nobody is asking, the discipline may be worth having and the certificate may not be.
When could we book an assessment?
Three to six months from starting, and most of that is evidence accumulating rather than work being performed.
Why can evidence not be compressed?
Because assessors want to see controls operating over time, and records created shortly before a visit are recognisable as exactly that.
What if we already have controls?
Most organisations do, without calling them controls. A gap analysis usually finds more in place than people expect.
What happens at surveillance visits?
The system is checked again. This is where organisations that treated certification as a project rather than a commitment run into trouble.
What is the real ongoing cost?
Maintenance rather than the assessment. Budgeting for the first audit alone leaves organisations surprised twice.
Can we scope it narrowly to pass more easily?
You can, and the certificate then may not cover what your client was asking about, which defeats the purpose of having it.
Do we need documented policies?
Yes, and they need to be followed. A documented control nobody performs produces a finding rather than a pass.
What if a previous assessment raised findings?
That is a common starting point, and findings usually point at controls designed without regard for how the work actually runs.
Does certification help with regulators?
It can demonstrate a governed approach. It is not a substitute for meeting your sector obligations, which sit separately.
Are you present at the assessment?
Yes, through it. The accredited body decides the outcome and we are there for the questions.
Can a small organisation certify?
Yes, and the scope is usually narrower, which keeps the work proportionate provided the scope still answers the client question.
Who sees our internal documentation?
The preparation team and your assessor, under whatever confidentiality terms you set before we begin.
What does preparation cost?
Starting position and scope determine it, quoted after the gap analysis rather than before it.
Glossary of terms
Standards terms in plain language.
- Management system
- The set of processes by which an organisation governs something, which is what a certificate actually covers.
- Scope statement
- What the certificate applies to, and the part clients read most closely.
- Gap analysis
- An assessment of where you stand against a standard before any work begins.
- Surveillance visit
- A recurring check after certification, which is why maintenance matters more than the first assessment.
- Accredited body
- A certification body recognised to award certificates, without which the certificate may not be accepted.
- Guidance standard
- A published standard offering direction without certification attached, such as the AI risk guidance.
Related services in AI Compliance
Talk to us about ISO standards
Ask the client requesting certification what scope they expect it to cover. That answer decides most of the work.
Start your project