ISO 42001 support in the Netherlands: who does what?

Two parties are involved in ISO 42001 that you should not confuse. A consultant helps you set up the AI management system. A certifying body then assesses whether the system meets ISO/IEC 42001, as described in the audit process. The EU AI Act  also applies by law. The person who supports you with the set-up mainly determines how fast and how well your project runs, not whether you receive the certificate.

Two roles, two responsibilities

A certifying body must be independent. It may not design your system itself, otherwise it would be assessing its own work. This follows from the independence requirements for certification bodies (ISO/IEC 17021-1), which the Raad voor Accreditatie (RvA, Dutch Accreditation Council) supervises. A certifying body may provide general training. A consultant may do more: they help you with policy, risk analyses and documents.

An easy way to remember it: the consultant builds the house, the certifying body inspects the house.

In a small organisation, one person can combine the roles of project leader and internal auditor. In a larger organisation it makes sense to split those roles.

What can a consultant do for you?

Consultants differ widely. Some specialise in AI governance, others come from information security or quality management and have learned the AI side along the way. That is not the wrong background, but do ask about concrete AI experience.

You can reasonably expect this from a good consultant:

• A gap analysis with a clear score per clause, see gap analysis
• Help with the AI register and choosing the scope
• An AI policy that management can approve and that fits your organisation
• Support with the AI risk analysis and impact assessments
• Training for staff, for example on AI literacy
• Preparation for the certification audit, including a mock audit

What you should not expect from a consultant: that they take over responsibility. The AI system remains the property of your organisation, and so do the decisions about risks.

Five questions to ask

Ask a consultant these questions before you commission them. The answers say a lot about quality.

1. How many projects have you completed where AI systems were within scope? A concrete answer is better than “we know the standard well”.
2. How do you ensure you do not carry out the certification audit yourselves? A consultant who also acts as auditor for the same client has an independence problem.
3. What exactly do you deliver? A quote should be built up per deliverable, not only as an hourly rate.
4. What do you do if the gap analysis shows the scope is too large? A good consultant proposes a smaller scope rather than extending the project.
5. Who works on the project, and is it the same person who writes the quote? The latter is not always the case, and you want to know who you will be working with.

Checklist for comparing quotes

Use this list to compare quotes side by side. For each point, mark yes, no or unclear.

• The quote describes the phases and what is delivered in each phase
• The scope is stated explicitly, including which AI systems are covered
• There is an owner or contact person for each phase
• The consultant states that the certification audit is carried out by another party
• There are agreements on rework if the audit produces findings
• The costs are split into advice, training and any software
• There is a reference or case study from a comparable sector

For the costs of the whole project, including the audit itself, read costs and timeline. That overview gives you a reference for what a quote should at least cover.

Support for small organisations

For a small company, full support is often not necessary. A gap analysis and a few hours of coaching per month may be enough to get your documents in order. Many start-ups then opt for an internal auditor. Read ISO 42001 for start-ups for the lean approach.

Larger organisations that already have an ISO 27001 or ISO 9001 system can reuse part of the structure. Ask the consultant how they do that. See integration with existing systems for the options.

When do you not need a consultant?

You can also set up the system yourself if you have someone in-house who knows the standard well, has time and can steer the decision-making process. Then use the step-by-step plan as a guide, and have the gap analysis and the internal audit carried out by someone who did not build the system themselves.

For the certification itself you always need an external body. An overview of who does this in the Netherlands is available on certifying bodies.

Frequently asked doubts

Is there a legal obligation to hire a consultant? No. ISO 42001 is a voluntary standard and the law does not require a consultant. You do need to be able to demonstrate that your system works, and that is not always possible without experience.

Can the same party advise and carry out the audit? That is not permitted for the certifying body, because it would be assessing its own work. A consultant who also acts as certifier for your organisation is a red flag.

What if the consultant stops halfway through? That happens. Make sure all intermediate products are with you, such as the policy, the register and the risk analyses. If they only exist in the consultant’s systems, you are left with nothing.

How do I know whether the consultant is doing good work? Ask to see the gap analysis and the policy before paying for the next phase. A good consultant shows them to you and explains why choices have been made.

What do I have to do myself when I hire a consultant? You remain the owner of the system. Schedule fixed time for the project leader and name one internal contact person who can make decisions.

Further reading

• Step-by-step plan for ISO 42001 certification
• The ISO 42001 audit process
• Common mistakes with ISO 42001
• Frequently asked questions about ISO 42001