ISO/IEC 42001 AI management system in Georgia

What ISO/IEC 42001 is

ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence. It applies to organisations that develop, provide or use AI systems. It asks you to define AI policy and roles, assess AI risks and the impact of AI systems on people and society, control the AI system life cycle from design to retirement, manage data quality and suppliers, and monitor systems in operation. Annex A lists the controls, and Annex B gives implementation guidance.

Why it matters for Georgian companies

Georgia has a growing software development and outsourcing sector in Tbilisi and Batumi, and many companies serve clients in the EU, the UK and the US. Those clients now include questions about AI in vendor due diligence.

The EU Artificial Intelligence Act entered into force in August 2024 and applies in stages: prohibited practices from February 2025, obligations for general-purpose AI models from August 2025, and further obligations, including those for high-risk systems, in later phases. The Act applies to providers placing AI systems on the EU market and to cases where the output of an AI system is used in the EU, so a Georgian company can fall within its scope without an EU office. ISO/IEC 42001 is not a substitute for AI Act conformity, but it gives you the risk management, documentation, data governance and human oversight processes that the Act expects.

Typical clients include:

• Software and SaaS companies that embed machine learning or large language models in their products.
• Fintech, lending and insurance firms that use AI in scoring, fraud detection or customer service.
• Outsourcing and data labelling companies that build or train models for foreign clients.

How BALTUM prepares you

1. AI inventory and scope. We list the AI systems you develop, provide or use, and decide your role for each one.
2. Gap assessment. We compare your current practice with ISO/IEC 42001 and, where relevant, map the EU AI Act obligations that apply to you.
3. AI risk and impact assessment. We set up a method to assess risks to the organisation and impacts on individuals and groups, and apply it to your main systems.
4. Policies and life cycle controls. AI policy, roles, data management, model validation, change control, monitoring, incident handling and supplier requirements for third-party models.
5. Training. Sessions for developers, product owners and management on their responsibilities.
6. Internal audit and management review. We audit the AI management system and prepare the review.
7. Certification support. We help you choose a certification body and support you in stage 1 and stage 2.

The duration depends on the number and complexity of your AI systems and on existing ISO/IEC 27001 processes. We define the plan after the first assessment.

How certification works

Certification follows the usual two-stage audit, then a three-year cycle with surveillance audits. ISO/IEC 42006 sets additional requirements for bodies that certify AI management systems, so ask the certification body for its accreditation for ISO/IEC 42001 and check it with the accreditation body, preferably an IAF MLA signatory.

Related standards and reading

ISO/IEC 42001 shares its structure with ISO/IEC 27001 and ISO/IEC 27701, so the three can run as one system. For the regulatory side, read ISO 42001 and the EU AI Act for Georgian software exporters.

To discuss your AI systems and scope, write to info@baltum.org or use the request form.

Frequently asked questions

Does ISO/IEC 42001 certification mean we comply with the EU AI Act?

No. The AI Act has its own conformity rules. ISO/IEC 42001 helps you build the processes the Act expects, such as risk management, documentation and human oversight, and reduces the work needed for legal compliance.

We only use third-party AI tools. Is ISO/IEC 42001 relevant?

It can be. The standard covers organisations that use AI systems, not only those that develop them. The scope and controls are then smaller and focus on supplier selection, acceptable use, data handling and monitoring.

Can ISO/IEC 42001 be combined with ISO/IEC 27001?

Yes. Both use the same management system structure, so policies, internal audit and management review can be shared and audits can be combined.