Map the AI estate
Create an inventory of AI systems, owners, purposes and affected processes. Include experiments that have quietly become operational tools. Without a current register, risk reviews can miss the systems that matter most.
Across the 4A path
Govern AI as it is built,
used and changed.
Create the roles, registers, controls and evidence needed to manage AI risk across discovery, delivery and operation. Assess readiness against ISO/IEC 42001 without turning governance into an afterthought.
Engagement basedEngagementAcross the 4A pathWhere it fits
Fox IT India / AI Governance and ISO/IEC 42001 ReadinessThe challenge
Governance added at the end is expensive to repair.
As AI moves into real workflows, leaders need to know which systems exist, who is accountable, how they are evaluated and when humans must intervene. A management-system approach makes those answers repeatable across use cases.
01No central view of AI systems or owners
02Risk questions appear after a prototype is ready to launch
03Evidence for review is scattered across teams
The decision this work supports
Make the next commitment with the evidence in view.
AI governance should answer concrete operating questions: which systems are in use, why they are used, who is accountable, how risks are evaluated, and what happens when an output is wrong. ISO/IEC 42001 provides requirements for an AI management system. Readiness work helps an organisation find gaps and build a practical improvement plan; it is not a claim of certification.
Inside the engagement
How the work actually happens.
The sequence is adapted to the challenge, while each decision and output remains visible to the people who will own the result.
Assess risk and decisions
For each use case, examine impact, data, human oversight, evaluation and change control. Define who approves deployment and who can pause a system when evidence changes.
Build evidence into delivery
Record the reason for the use case, testing performed, known limits and operating controls as the system is built. This is easier and more reliable than reconstructing the history months later.
Review the management system
Compare current roles, policies and practices with the organisation's goals and relevant ISO/IEC 42001 requirements. Prioritise gaps, assign owners and establish a recurring review cycle.
Method lineage and further reading: view the source methodology ↗
What changes
Clearer accountability and audit-ready evidence.
The result is a clearer decision and work your team can use after the engagement.
AI system register
A current inventory with purpose, owner and operating context.
Risk and control map
The checks appropriate to each use case and its impact.
Evidence trail
Decisions, testing and changes recorded as the work happens.
Readiness roadmap
Prioritised gaps against the organisation's management-system goals.
The tangible outputs
Documents and evidence that travel with the work.
Every deliverable has a purpose in the next decision. Fox IT will agree the exact format with your team before the engagement begins.
AI system register
A maintained view of systems, use, owner and context.
Control and risk map
The decisions and checks appropriate to each system.
Evidence trail
A record of evaluation, approvals and important changes.
Readiness plan
Owned work to strengthen the AI management system over time.
The working team
The right people need to shape the answer.
Organisations building or using AI across several functions and needing a consistent management approach.
- Executive AI governance sponsor
- Risk and compliance leads
- Technology and data owners
- Business system owners
What to prepare
Bring any existing AI inventory, policy material, risk assessments and examples of current use. Incomplete records are common and are useful input to the first mapping exercise.
Ways to work with Fox IT
Choose the level of support the team needs.
Governance baseline
A focused view of current AI systems, decision rights and the most urgent gaps.
Management-system readiness
A broader programme to define policies, evidence, controls and review routines aligned to the organisation's goals and ISO/IEC 42001 requirements.
Common questions
Questions to settle before you begin.
Good work starts with clear expectations about scope, people, evidence and the decision at the end.
Does this certify us to ISO/IEC 42001?
No. Fox IT's readiness work helps prepare an AI management system and identify gaps. Certification, if pursued, is performed through an appropriate independent certification process.
Can governance start after a pilot?
Yes, but it is more efficient to start while the use case is being framed. Existing pilots can be assessed and brought into a consistent register and control process.
Will every use case need the same controls?
No. The process should be consistent, but controls should reflect the purpose, impact and risk of each AI system.
How does this fit the 4A path?
It is horizontal. Discovery records assumptions, Alignment sets decision rights, Activation tests controls, and Amplification monitors systems and value in use.
Start a conversation
Ready to explore AI Governance and ISO/IEC 42001 Readiness?
Talk through your challenge with a senior Fox IT consultant and choose the right next step.
Talk to Fox IT A focused conversation about your goals and constraints.