The ISO/IEC 42001 readiness checklist for Singapore companies.

ISO/IEC 42001 is the first AI management system standard designed to be auditable. Most companies we work with can describe their AI policy in a paragraph; far fewer can produce an inventory.

The standard asks for a management system that can demonstrate context, leadership, planning, support, operation, performance evaluation and improvement — applied to the use of AI in your organisation. None of that is novel. What is novel is the scope: AI is moving faster than your last risk framework, and the standard is built for that velocity.

The first failure mode we see is the inventory. If you cannot list your models, agents, vendor-embedded AI and material use cases with a named owner each, the rest of the standard will not save you. Start with a single spreadsheet if you have to — but start.

The second is leadership. ISO/IEC 42001 requires top management to demonstrate accountability. In practice this means a named AI risk owner at the C-suite or board level, with the authority to halt an AI deployment. If that role does not exist, the audit will not pass.

The third is operation. You need to evidence how AI risks are identified, assessed and treated in the normal course of business — not in an annual exercise. That means controls running continuously, not memos produced once a year.

The fourth is evidence. Your auditor will read minutes, logs and decisions. Make sure those exist, are kept, and tell the story you want them to tell.

For Singapore-based companies, IMDA’s Model AI Governance Framework (2nd Edition) is the practical bridge to ISO/IEC 42001 — the IMDA framework maps cleanly to most of the standard’s clauses, and Singapore PDPA already covers the personal-data layer.

We run a fixed-fee readiness engagement that produces the inventory, the gap analysis and the remediation plan in 4–8 weeks. The hardest week is week one.