A Head of Security at a UK SaaS company framed the problem better than I could: "About 40 percent of the ISO 42001 controls look populated from our ISO 27001 work. The other 60 percent need a different kind of evidence than anything we have built before, and the platform is telling me that, but it is not telling me how to build it."
That is an accurate description of what a GRC platform does for an ISO 42001 programme. It surfaces the requirement precisely. It does not tell you how to meet it, and for the AI-specific controls the how is the entire difficulty.
The forty sixty split
The leading compliance platforms all now carry ISO 42001 framework modules. Each provides a control library mapped to evidence requirements, policy templates, a Statement of Applicability structure, automated evidence collection where the control is technically observable, and a buyer-facing trust surface for publishing certification status.
For the portion of ISO 42001 that reuses from an existing information security management system, this works well. Access control evidence, supplier assessment workflow, awareness training records, audit scheduling, and management review documentation are all things a platform handles competently.
For the AI-specific portion, the platform tells you the control exists and provides a template. The substance is yours to produce. The split described above is an approximation rather than a measured ratio, and it moves with the maturity of the existing management system.
What the platform genuinely does
Four things, and they are worth paying for.
Evidence collection. Where a control is technically observable, the platform collects the evidence continuously rather than in a scramble before audit. This is the single largest time saving and it is real.
Control tracking and drift detection. A management system decays between audits. The platform surfaces the decay rather than letting it accumulate until surveillance.
Policy templating. A starting structure for the AI policy suite is faster than a blank document, provided the templates are treated as structure rather than content.
Buyer-facing signalling. A trust page that publishes certification status and provides controlled access to evidence reduces questionnaire volume materially. For an organisation with enterprise pipeline, this alone can justify the subscription.
Where the platform stops
The platform operates the system. It does not design it.
Scope is a judgement. Which AI systems are inside the management system boundary, and which are excluded with justification, determines the size and cost of everything downstream. A platform cannot make that decision because it does not know your commercial context or which buyers are asking.
The risk taxonomy is a design decision. A template risk register gives you rows. It does not tell you how model risk, training data risk, inference risk, automated decision risk, transparency risk, and human oversight risk should be structured for your systems, or what assessment criteria apply to each class.
The AI impact assessment is a multi-stakeholder exercise. It requires product, legal, and engineering input, and practitioner judgement about what the assessment must cover for your risk profile and regulatory exposure.
Lifecycle integration is engineering work. Connecting the management system to the actual development process, so that design controls, validation gates, deployment approval, and monitoring are real rather than documented, happens in your pipeline and your ways of working.
Audit defence is a room with a person in it. When an auditor asks how a control operates and requests the evidence, someone has to answer. No platform does that.
The four areas that need practitioner judgement
For an ISO 42001 implementation, the practitioner effort concentrates in four places.
AI risk taxonomy design. Not what goes in the register, but how the register is structured and how risk is assessed for each class of AI risk. This determines whether the risk work is meaningful or performative.
AI impact assessment. What is assessed, to what depth, involving whom, and how the output feeds risk treatment. Where EU AI Act obligations apply, this connects to regulatory requirements the platform does not model.
Lifecycle control integration. Translating standard requirements into controls that operate inside the engineering process without stopping delivery. This is where most implementations either land or become shelfware.
AI-specific incident response. Distinct from cyber incident response. Model performance degradation, automated decision errors affecting individuals, training data exposure, and adversarial manipulation require different detection, different escalation, and different regulatory reporting.
What this costs, both ways
A GRC platform subscription is a recurring annual cost, typically several thousand pounds upward depending on scale and modules. That is real money and it buys real time savings.
An implementation programme is a one-off cost. Where an organisation holds ISO 27001, the AIMS overlay is materially cheaper than a standalone build because the management system spine already exists.
The expensive path is neither of these. It is buying the platform, assuming it constitutes the management system, discovering at Stage 1 that the AI-specific controls are templates with nothing behind them, and then engaging a practitioner under audit deadline pressure. That sequence costs more than doing it in the right order and it delays the certificate.
The second most expensive path is engaging a practitioner without a platform, then maintaining the evidence base manually. It works, and it consumes internal time indefinitely.
How to use both properly
The division that works: the practitioner designs the management system, the platform operates it.
Scope, risk taxonomy, policy architecture, and control design come first, from someone who has built one before. The platform is then configured to that design rather than the design being bent to the platform's defaults.
Evidence collection, control monitoring, audit scheduling, and buyer signalling run in the platform continuously. The practitioner returns for internal audit, management review, and audit defence.
The test of whether you have this right: ask whether your AI risk register would make sense to an auditor who had never seen your platform. If the answer depends on the tool, the management system is in the tool rather than in the organisation, and that is the finding that surfaces at Stage 2.
Goldline delivers ISO 42001 implementation on your GRC platform of choice, or ours. The practitioner designs the management system, the platform operates the evidence. Explore the ISO 42001 Sprint.