Most teams meet ISO 42001 the same way. Someone is handed the standard, reads that it asks for an AI management system, and starts a document. A policy here, a procedure there, a register of risks in a spreadsheet. Months later there is a binder. The binder is not wrong. It just cannot refuse anything.
ISO 42001 is the international standard for an AI management system, and it asks you to govern AI across its whole lifecycle: how you set policy, how you assess impact, how you manage data, how you watch a system in production, and how you record and learn from incidents. Read that list again and notice what it is really asking. It is asking you to prove, again and again, that a specific thing happened before a specific action ran. That is not a document. That is a control.
A control you can run looks different from a control you can file. The filed version says we review high risk changes. The runnable version is a check in your pipeline that sees the change, decides whether it is high risk, and refuses to merge until the review exists, leaving a line that says which rule fired, who approved it, and what the diff was. The first is a sentence. The second is a receipt.
This is the whole idea behind governance as code. Every action is a proposal, and a gate answers in one of three ways. Yes, earned, with evidence. No, refused, and written down. Or held for a human, which becomes a no if nobody approves it in time. Write the rule once in plain words a colleague can enforce, and once as a check a pipeline can enforce, and both produce the same receipt. Now your ISO 42001 evidence is not a story you tell an auditor. It is a trail a stranger can verify.
Start with the controls that already map to an action
You do not have to render the entire standard on day one. Start where a control already points at a moment in your delivery. Change management maps to a merge. Impact assessment maps to the review that gates a new use case. Data quality maps to the step that admits a dataset. Incident recording maps to the alert that fires when a system behaves outside its bounds. Each of those is a place where a check can sit and leave a receipt, and each receipt is evidence for a clause you would otherwise be writing prose about.
It helps to line ISO 42001 up next to the frameworks you may already be using. The NIST AI Risk Management Framework organizes the work into four functions, Govern, Map, Measure, and Manage, and it is explicit that it exists to build trustworthiness into how AI is designed, built, and used. The EU AI Act turns similar expectations into obligations with dates attached. The three are not three projects. They are three views of the same question: can you show, with evidence, that this AI did only what it was allowed to do. A control that runs answers that question once for all three.
The test that tells you it is real
Here is a quick way to know whether a control is runnable or only written. Try to weaken it. Open a change that turns a deny into an allow, and watch what happens. If the pipeline refuses the merge and leaves a record of the attempt, the control is real and your evidence is accumulating on its own. If nothing happens, you have a sentence in a binder, and the next audit will be another month of screenshots.
You can see what one of these checks feels like without installing anything. The Gate Check is ten questions about whether an AI agent is ready to run, each answered yes or no with a piece of evidence you can point at, and it ends with a Gate Card you keep. It runs entirely in your browser and nothing you answer is sent anywhere. It is the smallest possible version of the same move: a control that asks for evidence, not for good intentions.
ISO 42001 does not have to be the year you wrote a binder nobody opens. It can be the year your pipeline started producing the evidence for you. If you want to see this way of working applied to real cases, the Tuesday Letter brings one story from the practice each week and sends nothing else.
The AiGovOps Foundation is a nonprofit publishing open source governance as code for AI safety. Ship safe AI. Never unsafe AI.