ISO 42001 for startups

Why this showed up in your RFP

ISO/IEC 42001 is an AI management-system standard. Large buyers use it as a shortcut: “do you have a system, or just a chatbot?” In 2026–2027 that question is landing on startups that have a policy and no register.

You do not need a registrar next week. You do need a risk register, a management-review note, and owners — written so a customer security reviewer can map them to clauses.

Do not buy the auditor course first

Official implementer training is priced around $1,200 and taught in auditor English. If you are a PM or founder, you will leave with slides and no Monday list. Gabby Software’s ISO 42001 Implementer (ROADMAP 2027) is clause-to-checklist plus those two templates.

Take CASF Foundations first if you still lack a human-oversight policy. ISO 42001 assumes the company can already say how humans review AI. The standard will not invent that sentence for you.

Minimum packet

Scope (which AI systems). Policy (CASF / Policy Writer). Risk register (what can go wrong, who owns it). Management review (last date, next date). Vendor list. Training attestation. That is enough to start a conversation. Notify me on the implementer page when you want the course, not a consultancy SOW.