Artificial Intelligence Governance and Management

AI governance and ISO/IEC 42001 certification

Use artificial intelligence with legal certainty, ethics and trust. We structure AI policies, roles, risks, impacts and controls — and prepare your organization for certification.

Assess my AI governance Chat on WhatsApp

Why now

Using AI without governance has become a business risk

Your employees already use AI — with or without permission. Without a policy, an inventory and an impact assessment, the company is exposed to data leaks, discriminatory decisions, loss of customer trust and regulatory liabilities in Brazil and Europe.

Governance doesn't slow innovation down: it's what lets you scale AI safely.

Case study · ISO 42001 · Jul/2024

Cartório Leandro Félix

One of Brazil's first AI Management System certifications, built on ISO 42001, ISO 42005 (impact), ISO 38507 (governance), ISO 23894 (risk) and TR 24368 (ethics). Another certification is planned for 2026.

What we deliver

From AI inventory to certification

AI assessment and inventoryMapping of systems, vendors, use cases and data involved.

AI Management System — ISO 42001Scope, policy, roles, objectives, Annex A controls and evidence.

AI policies and controlsAcceptable use, responsible development and governance (ISO 42001 and ISO/IEC 38507).

AI risk mappingIdentification and treatment with ISO/IEC 23894 and the NIST AI RMF.

AI Impact Assessment reportIn line with ISO 42001, ISO 42005, ISO 27557 and ISO/IEC TR 24368.

Regulatory complianceRisk classification and obligations under the EU AI Act and Brazil's PL 2338/2023.

Internal audit and readinessFinal sweep and support during the certification audit.

TrainingEXIN AI Compliance Officer path and in-company training.

Frequently asked questions

Straight answers

What is ISO/IEC 42001?

It is the international standard for Artificial Intelligence Management Systems (AIMS). It defines how an organization establishes policies, roles, risk and impact assessment, controls and continuous improvement to develop or use AI responsibly.

My company only uses third-party AI. Do I need governance?

Yes. Employees using AI tools expose the organization to data leaks, biased decisions and regulatory liabilities. An acceptable-use policy, a system inventory and a risk assessment are the starting point.

How do ISO 42001, the EU AI Act and Brazil's PL 2338/2023 relate?

The EU AI Act and Brazil's AI Bill (PL 2338/2023) set legal obligations by risk level. ISO 42001 provides the management system that organizes and evidences compliance with those obligations.

How long does ISO 42001 certification take?

It depends on scope and current maturity. The initial assessment defines the plan and timeline. We have already taken a Brazilian organization to one of the country's first ISO 42001 certifications.

Keep exploring

Your company already uses AI. Is it governed?

Start with an AI governance maturity assessment.

Assess our AI maturity Chat on WhatsApp