AI adoption is accelerating everywhere, and so is the pressure to move quickly, but prioritizing speed over things like security creates risk. NUWAVE was one of the first 100 companies in the world to obtain ISO 42001 certification. Continue reading to learn more about why AI governance matters, a practical blueprint for getting started, and highlights from our recent technology roundtable with BSI.
Any organization, regardless of size or sector, that holds customer data and uses AI needs governance. AI delivers the most value when it’s connected to company data, which makes security even more important. Just because a software is functional, doesn’t mean it’s also secure. NUWAVE’s COO, Mark Bunnell, framed safe AI as trusted AI. A polished demo doesn’t show you what’s really going on. Trust comes from partners that prioritize security and invest in standards like ISO 42001.
Many organizations treat AI as an arms race and adopt it before the groundwork is in place, including data classification, data loss prevention, and technically enforced controls. A responsible AI policy on its own is not a governance program.
ISO 42001 is the first comprehensive management system standard for AI, and BSI was involved in its development. It addresses accountability, risk management, and newer requirements such as human oversight, and AI impact assessments. This standard pairs with ISO 27001, which focuses on data security and privacy. According to Omkar Joshi, Managing Director of AI Solutions at BSI Regulatory Services, ISO 42001 has fewer controls, but each goes much deeper.
Adoption is moving quickly. The standard is roughly three and a half years old, and accredited bodies have issued more than 1,000 certificates. While that sounds like a large number, when you measure it against the number of companies using AI worldwide, that figure remains small.
NUWAVE entered the ISO 42001 certification process with ISO 27001, 27018, and 27701 certifications already in place. This came with the advantage of many existing policies, controls, and training practices being carried over. Even with the foundation, however, ISO 42001 certification took approximately six months. For organizations with no prior certifications, the panel recommended planning for six to 12 months, or even longer for organizations that have already deployed AI widely.
That being said, certification is not a finish line. NUWAVE requires monthly training for every employee, because threats are constantly evolving.
You may be wondering, why bother getting certified at all? The return on investment is tangible. Enterprise customers routinely send security questionnaires containing 300 questions or more, and recognized certifications streamline vendor approval. NUWAVE has never failed a customer’s security onboarding, and Bunnell estimated that “more than 50% of the companies that we’re onboarding today, we would not have if we didn’t have 42001.”
Governance helps shape product design, too. iPILOT allows each customer to enable or disable AI and adjust its scope, since industries such as healthcare, banking, and government have different requirements.
Certification claims still require care. ISO 42001 demonstrates a serious, accountable approach to AI and can satisfy contractual and due diligence requirements, but it does not guarantee that AI will always be 100% safe.
While 90 days isn’t enough time to become certified, the panel did come up with guidelines for how to get started:
Implemented correctly, governance accelerates innovation by giving teams a clear, responsible path forward.
Education is the first step, even for organizations not yet pursuing certification. ISO 42001 is best viewed as the first stop on a longer AI assurance journey. For organizations already deep into AI adoption, a short pause to put the right controls in place leads to faster, safer progress over the long term.
Want to learn more about your potential path to ISO 42001? View the full technology roundtable to hear the complete panel discussion on building AI governance end to end.