Quick answer
OptiTech runs ISO 42001 as a framework on the same machinery as ISO 27001: the AI management system's requirements load as a catalog, your AI system inventory becomes the scoping backbone, impact assessments run as guided workflows with maintained history, and lifecycle controls verify through your development-stack integrations. If you already hold ISO 27001, the shared management-system clauses are covered by cross-mapping from day one.
The inventory does double duty
The AI system inventory you build for 42001 is the same one the EU AI Act workflow uses: every system you build, embed, or procure, with purpose, data, models, and ownership. Each entry carries both its 42001 impact assessment and its AI Act risk classification, so one registration feeds both obligations. Procured AI links into the supplier register, since vendor AI is a supplier risk with extra questions.
Impact assessments and oversight as living records
- AI impact assessments run as structured workflows (affected individuals, potential harms, bias considerations, mitigations) with versioned results, so the auditor sees a process operating over time, not a folder of PDFs.
- Human oversight points are documented per system and, where they're technical (approval gates in deployment pipelines), verified through CI integration checks.
- AI incidents (a model behaving unexpectedly, a harmful output, a data issue in training) run through the incident flow with a lessons-learned step feeding the improvement clause.
One workspace for security and AI governance
The practical win is co-location: your AIMS and ISMS share the risk register, the policy machinery, the evidence log, and the board reporting. When an enterprise customer's questionnaire asks about both security and responsible AI, the answers come from the same control data, consistent by construction.
Get a personalized walkthrough of automated compliance for your team. No commitment required.