Common mistakes in ISO 42001

ISO 42001 is new. That means there are not yet decades of best practice. But the first implementations already show what works and what does not. With the EU AI Act becoming more concrete, it is important to get it right. This page describes the most common mistakes and how to avoid them.

Mistake 1: treating AI governance as an IT project

The biggest misconception is that ISO 42001 is an IT project. That the IT department or the data science team will sort it out.

Why this goes wrong: AI governance affects the whole organisation. Legal needs to think about liability and compliance. HR deals with AI in recruitment. Marketing uses AI for personalisation. Finance needs to value risks.

If only IT is involved, you miss crucial perspectives. The impact assessment becomes too technical. Risks go unrecognised because nobody outside IT is thinking about them.

What to do instead: Set up a cross-functional team. Make sure legal, compliance, HR, the business and IT are represented. Make a member of the board ultimately accountable.

The EU AI Act makes board members explicitly responsible for AI governance. It is no longer an IT matter. It is a governance responsibility.

Mistake 2: not knowing where your AI is

Many organisations discover during implementation that they have more AI than they thought.

Hidden AI:

Spreadsheets with predictive formulas
Purchased software with AI components
Cloud services with machine learning features
Marketing automation tools
Chatbots that nobody manages any more

Why this goes wrong: You cannot manage risks of systems you do not know about. Your impact assessment is incomplete. Your scope is wrong. The auditor finds systems that are not in your documentation.

What to do instead: Start with a thorough inventory. Ask each department what they use. Check your procurement and contract records. Look at API connections and data integrations.

Mistake 3: treating the impact assessment as a box to tick

The AI impact assessment is new for most organisations. There is a strong temptation to rush through it. Filling in a template without really thinking.

Signs of a poor impact assessment:

All questions answered with “not applicable”
No concrete examples of who is affected
Only positive impacts named
No measures for identified risks

Why this goes wrong: The auditor sees through it. More importantly, you miss real risks. If your AI discriminates or harms people, you only discover it when it is too late.

What to do instead: Take your time. Involve people from outside the project team. Ask difficult questions: what if the AI makes mistakes? Who would be disadvantaged then? Could you explain that to the newspapers?

Mistake 4: copying ISO 27001

ISO 42001 looks like ISO 27001. The structure is the same. There is a strong temptation to copy your existing ISMS and add “AI”.

Why this goes wrong: ISO 42001 is about different matters than information security. Concepts such as bias, fairness and explainability are fundamentally different from confidentiality and availability.

The Annex A controls are completely different. You need to work through them again, not copy and paste them.

What to do instead: Use your ISO 27001 system as the basis for the shared processes: governance, audit, document control. But treat the AI-specific parts as new work that deserves real attention.

Mistake 5: too much documentation

Some organisations think more documentation is better. They write hundreds of pages of procedures that nobody reads.

Signs of over-documentation:

Procedures for processes that do not exist
Documents that contradict each other
Nobody knows where anything is
Updates are not tracked

Why this goes wrong: The auditor asks whether people know the procedures. If the answer is “no”, you have a problem. Unrealistic documentation is not followed.

What to do instead: Document what you actually do. Keep it short and clear. Make sure people know the documents and can find them. Update regularly.

An auditor once said: “I would rather see two pages that you follow than a hundred pages that sit in a drawer.”

Mistake 6: ignoring subjective concepts

Terms such as “fairness”, “bias” and “explainability” are new to many compliance teams. They are subjective and hard to put into practice.

The reaction that does not work:

Skipping the controls because they are too vague
Filling in “we treat everyone equally” without any justification
Waiting until someone tells you what it precisely means

Why this goes wrong: These concepts are at the core of ISO 42001. If you ignore them, you miss the point of the standard. And the EU AI Act will also enforce these strictly.

What to do instead: Accept that there are no perfect answers. Start with what you can do:

Test your models on different demographic groups
Document how decisions are reached
Create a process for people to challenge decisions
Seek external advice if you get stuck

Mistake 7: no ownership per AI system

In many organisations it is unclear who is responsible for specific AI systems.

Symptoms:

“That belongs to IT” / “That belongs to the business”
Nobody feels responsible for updates
When incidents happen, everyone points at each other

Why this goes wrong: Without an owner, risks are not managed. Updates are not made. The impact assessment becomes outdated. At the audit, nobody can answer questions.

What to do instead: Appoint an owner for each AI system. This is someone who:

Is responsible for the risk and impact assessment
Makes decisions about changes
Can answer the auditor’s questions
Escalates problems

Mistake 8: forgetting suppliers

Many organisations use AI from third parties. Purchased models, APIs from large tech companies, AI components in software.

Why this goes wrong: ISO 42001 says you are responsible for the AI you use, even if you do not build it yourself. A bias in a purchased API is your problem.

What to do instead: Map your AI suppliers. Assess the risks. Set contractual requirements. Ask for documentation on how the AI works and how it was trained.

Read the Annex A controls on suppliers (A.10).

Mistake 9: implementing once

Some organisations treat certification as a project. Done is done. The certificate hangs on the wall and everyone returns to business as usual.

Why this goes wrong: AI changes continuously. Models are updated. New systems are added. Laws and regulations evolve. A static system goes out of date quickly.

At the first surveillance audit it turns out the documentation no longer matches reality. Risk analyses are a year old. Nobody has looked at them since.

What to do instead: Plan structural maintenance:

Quarterly reviews of risk analyses
Updates to documentation when things change
Annual management review
Ongoing monitoring of AI performance

Mistake 10: starting too late on the EU AI Act

The EU AI Act has strict deadlines. August 2026 for high-risk AI. Some organisations wait until the last month.

Why this goes wrong: An ISO 42001 implementation takes at least 4-6 months, often longer. The conformity assessment for the AI Act comes on top of that. Anyone starting in May 2026 will not make August.

What to do instead: Start now. ISO 42001 builds the structures you need for the AI Act. The extra steps for AI Act compliance are then manageable.

How the ISO 42001 auditor thinks

Understanding how auditors look at things helps you avoid mistakes.

Auditors look at:

Consistency: do you do what you say?
Evidence: can you demonstrate it?
Understanding: do employees understand the system?
Improvement: do you learn from what goes wrong?

Red flags for auditors:

Procedures that are not followed
Documents that are not up to date
Employees who cannot answer questions
Risk analyses without follow-up

ISO 42001 implementation checklist

Before you go to the audit, check yourself:

Do I know where all our AI is?
Does every AI system have an owner?
Has the impact assessment been done seriously?
Are the documents up to date?
Do employees know the policy?
Have suppliers been assessed?
Is the board involved?
Is there a plan for maintenance?