Skip to main content

AI GOVERNANCE, GUIDED

ISO 42001 Guided.

ISO 42001 implementation directed by a senior practitioner and executed by your own team. Fixed at £9,000 + VAT for a single entity under 50 people. The same standard as a full Sprint, because you are doing the half that does not need a practitioner.

Who this is for

You have a buyer, an investor or a regulator asking how your AI systems are governed, and a team with the capacity to do the writing. What you need is the part you cannot get from a template: an AIMS boundary that names the AI systems your buyers care about, a Statement of Applicability across the 38 Annex A controls that survives an auditor, an AI risk and impact method that is yours rather than a sample, and somebody who tells you when what you have built will not pass.

Who this is not for

If nobody internally owns this, Guided will fail and it will cost you more than the Sprint would have. The programme runs on your team's hours, and on access to the people who build and run the models. Before it starts we agree who owns it and how many hours they genuinely have, and if the answer is nobody we will say so and recommend the Sprint instead.

What Goldline builds

  • AIMS scope and boundary, with the AI systems named
  • AI system inventory and risk classification
  • Risk methodology and the first AI risk assessment
  • The AI impact assessment method and the first assessment
  • Statement of Applicability across all 38 Annex A controls
  • The policy set, written to your operating model
  • Gap register with a named owner and a date on every line
  • Review and written correction of everything your team produces

What your team does

  • Populates the documents with your operational detail
  • Collects and uploads evidence
  • Implements and operates the controls
  • Maintains the model documentation
  • Attends a regular 90 minute working session

What this requires from you

A named internal owner, and 40 to 60 hours of your team's time across the engagement. Leadership available to approve policies and sit the management review. Access to whoever actually builds and runs the models.

Eligibility

Single legal entity. One site or cloud hosted. Roughly fifty people or fewer in scope. A named internal owner. One to five AI systems in scope, with somebody who can describe what each model decides and where a human signs off. Above any of those, the engagement is a Sprint and is priced accordingly.

What is not included

  • Control implementation and configuration changes to your environment
  • Evidence collection
  • The clause 9.2 internal audit. Where Goldline has built your management system, the internal audit must be run independently and cannot be run by us. We tell you exactly what it has to cover. Budget separately for it.
  • Certification body audit fees, paid directly to the certification body
  • Stage 2 attendance, available separately as audit defence

Who issues the certificate

An accredited certification body issues it. Goldline is not a certification body, does not issue certificates in any tense, and will not sell implementation and certification to the same organisation for the same scope. Certification body fees are paid to the body direct, sit outside the Goldline fee and carry no Goldline margin.

As at 11 September 2026 there are five UKAS accredited certification bodies for ISO 42001 in the UK: BSI Assurance UK, LRQA, NQA Certification, ISOQAR and TUV UK. Booking one is a scheduling item that starts early in the engagement rather than at the end of it.

WHO OWNS WHAT

Four phases, and who owns each one.

Guided runs on the Plan, Do, Check, Act cycle, delivered against a PECB Lead Implementer methodology. Goldline sets the direction and holds the standard. Your team does the build. The bar on each phase shows how the effort actually splits, and the accountable owner never moves. Phases are sequenced, not timed.

  • Goldline directs, reviews and holds the standard
  • Your team builds, decides and evidences
  • Neither of us. Independent by requirement

SCROLL RIGHT TO FOLLOW THE PHASES →

PHASE 01 · PLAN

Set the boundary and classify the AI systems

WHAT GETS PRODUCED

  • AIMS scope and boundary, with the AI systems named4.3
  • Interested parties and their requirements4.2
  • AI policy, approved by top management5.2
  • AI system inventory and risk classification6.1.2, A.6.2
  • AI risk assessment and treatment methodology6.1.2, 6.1.3
  • Statement of Applicability, all 38 Annex A controls6.1.3 d
  • Measurable AI objectives and the plan to reach them6.2
GOLDLINE 70%YOU 30%

ACCOUNTABLE
Your top management. Scope, risk appetite and acceptable AI use are decisions only you can take.

PHASE 02 · DO

Build it and run it for real

WHAT GETS PRODUCED

  • AI risk treatment plan with named owners6.1.3
  • AI impact assessment on the systems that need one6.1.4, A.5
  • Data governance for training and inference dataA.7
  • Human oversight and accountability recordsA.3, A.9
  • Model documentation and lifecycle controlsA.6
  • Awareness, competence and records7.2, 7.3, 7.5
GOLDLINE 25%YOU 75%

ACCOUNTABLE
Your named AIMS owner. This is the phase that sets the pace of the whole engagement.

PHASE 03 · CHECK

Prove it works, in front of someone

WHAT GETS PRODUCED

  • Monitoring and measurement results9.1
  • Internal audit across the whole AIMS9.2
  • Management review, minuted, with the required inputs9.3
  • Evidence pack assembled against the SoA
GOLDLINE 30%YOU 70%

Not Goldline. Clause 9.2 requires the internal audit to be independent of the work being audited. Goldline directed this build, so Goldline does not audit it. We hold a network of independent, credentialled auditors and will introduce one, or brief a competent person inside your own organisation to do it properly.

PHASE 04 · ACT

Close the findings and keep it alive

WHAT GETS PRODUCED

  • Nonconformities logged, with root cause10.2
  • Corrective actions closed and evidenced10.2
  • Continual improvement record10.1
  • Stage 1 readiness confirmed and the audit booked
  • Handover: the operating calendar
GOLDLINE 40%YOU 60%

ACCOUNTABLE
Your named AIMS owner. At handover the system is yours to run, and the operating calendar tells you how.

NEITHER OF US

Stage 1 and Stage 2 belong to your certification body

The certificate is issued by an accredited certification body, not by Goldline, and the audit is booked into their calendar. Their fee is paid to them direct, is separate from the £9,000 and carries no Goldline margin. Goldline is not a certification body and does not issue certificates, and will not sell implementation and certification to the same organisation for the same scope.

Why the split is the whole product

Guided is priced flat at £9,000 because the labour sits with you. If Goldline did the Do phase as well, that is a Sprint. The qualifying test is a single entity, roughly fifty people or fewer inside the scope, one to five AI systems, and a named internal owner with the time to do the Do phase. Without that owner the split above does not hold, and the honest answer is a Sprint rather than a cheaper number.

Delivered against the Plan, Do, Check, Act cycle by a PECB certified ISO/IEC 42001 Lead Implementer and Lead Auditor. Every deliverable is keyed to a clause of ISO/IEC 42001:2023 or an Annex A control. Effort splits are typical for a Guided engagement and are confirmed at scoping.

Price

£9,000 + VAT, fixed, whatever your headcount inside the eligibility above. The AI Governance Readiness Assessment, from £2,500 + VAT, credits in full against this. This engagement credits in full against a subsequent Sprint if you decide part way through that you want it delivered rather than directed.

Frequently asked

ISO 42001 Guided.

We use cookies and similar technologies to measure how this site is used, to see which organisations visit, and to measure our advertising. If you accept, we load Plausible, Google Analytics and Google Ads, Microsoft Clarity, which records session replays, and Apollo. Nothing loads until you accept. Read our Cookies policy.