AI Governance

A practical breakdown of what ISO 42001 adds beyond ISO 27001 and which parts of an existing ISMS already meet AI Management System requirements. If you already hold ISO 27001, I get why the first instinct with ISO 42001 is to reuse everything: the internal audit checklist, the management review agenda, and even the risk methodology. Some of that instinct is right. The mistake is stopping there. ISO 42001 borrows the same high-level structure every recent ISO management-syste

If you've been in a vendor security review, an RFP response, or a board risk conversation about AI in the last two years, there's a decent chance someone has said the words "NIST AI RMF" without explaining what it actually is. This post is that explanation.