AI
"Algorithmic security compliance" for an external AI vendor is easiest to make concrete by asking for a specific, independently-verifiable certification rather than a general assurance. ISO/IEC 42001, published in 2023, exists precisely to give buyers something checkable: a vendor claiming responsible AI governance can now be asked "are you actually certified, and by whom, and for which product?"
What to request during a vendor audit
1. Request the ISO/IEC 42001 certificate and check its scope. Confirm it covers the specific AI product/service you're evaluating and that the certifying body is properly accredited (e.g., UKAS, ANAB, or an equivalent national accreditation body).
2. Check the certification date and renewal cycle. Certification is valid for three years with annual surveillance audits — an expired or long-unrenewed certificate is a signal worth following up on.
3. Combine it with the standard vendor security stack. ISO/IEC 42001 addresses AI governance specifically; pair it with SOC 2 Type II (general security controls) and a signed Data Processing Agreement (data handling) for a complete picture — no single certification covers everything.
# AI-specific vendor audit checklist
[ ] ISO/IEC 42001 certificate requested and scope confirmed
[ ] Certifying body accreditation verified (UKAS/ANAB/equivalent)
[ ] Certification date checked against the 3-year validity cycle
[ ] SOC 2 Type II report requested (general security controls)
[ ] Signed DPA in place (data handling terms, GDPR Article 28)| Evidence Type | What It Actually Verifies |
|---|---|
| Vendor's own "responsible AI" marketing page | A stated intention, not independently verified |
| ISO/IEC 42001 certification (scope-checked) | An accredited third party's audit of a demonstrated, operational AI management system |
Treat certification as a starting point for the conversation, not the end of it — ask what specific controls the vendor's AIMS covers and how it applies to the product you're actually buying. A certificate with the wrong scope, or one that's lapsed, tells you as much as having no certificate at all.
Practical Challenge
Using the checklist above, request ISO/IEC 42001 certification details from an AI vendor you use or are evaluating, and confirm the scope actually covers the product in question.
Concept Check
Sources & Further Reading
- ISO/IEC 42001:2023 — AI Management Systems — the official standard reference.
- A-LIGN: Understanding ISO 42001 — a practical explainer of certification requirements and the audit process.