Skip to content
itmad

Capabilities / Certification

ISO/IEC 42001 AI Management System Certification in Sri Lanka

itmad audits ISO/IEC 42001 AI management systems in Sri Lanka: two-stage audit, three-year certificate, Sri Lanka-based and travelling auditors.

Request this service

ISO/IEC 42001 is the first management system standard for artificial intelligence, and itmad audits ISO 42001 AI management systems for organisations in all industries in Sri Lanka. itmad audits with both Sri Lanka-based auditors and a travelling team, and has worked in Sri Lanka for more than 5 years. ISO 42001 certification from itmad follows a two-stage audit and produces a certificate that runs for three years with annual surveillance audits.

What ISO/IEC 42001 is

ISO/IEC 42001 specifies how an organisation governs the AI that the organisation builds, buys or deploys: the policies, risk controls, oversight and lifecycle management that keep an AI system accountable rather than opaque. ISO 42001 certification is independent confirmation that the AI governance exists and operates.

Who ISO 42001 applies to

An organisation in Sri Lanka needs ISO 42001 certification when a customer or supplier programme asks for independent proof of its AI governance. ISO/IEC 42001 applies to any organisation that develops AI products, embeds AI in its services, or deploys third-party AI at scale, and to any organisation whose clients ask how its AI is governed. The standard is written to apply regardless of sector or the specific technology, so the standard fits a bank's credit-scoring model as readily as a health provider's diagnostic tool or a public body's citizen-facing chatbot. itmad audits ISO 42001 for organisations in all industries in Sri Lanka.

What ISO 42001 requires

  • AI policy and objectivesA stated position on how AI is used, aligned to organisational purpose and to legal and ethical obligations.
  • AI risk assessmentIdentifying risks that the AI system poses to individuals, groups and the organisation, and treating the risks proportionately.
  • AI system impact assessmentAssessing consequences for people affected by the system, including fairness, safety and rights.
  • Data governanceControl over the data used to train, test and run AI systems, including quality, provenance and appropriate use.
  • Lifecycle managementDefined controls across design, development, verification, deployment, operation and retirement of AI systems.
  • Transparency and accountabilityRoles, responsibilities and records that allow the behaviour of the system to be explained and answered for.
  • Human oversightMechanisms that keep meaningful human control over AI decisions where the stakes require human control.
  • Third-party and supplier controlManaging AI components, models and services obtained from others, proportionate to their effect on outcomes.

Certification in Sri Lanka

An ISO 42001 certificate states the certified scope, including the AI systems covered, and a Sri Lankan buyer or supplier programme checks that scope wording. Each Sri Lankan buyer or supplier programme sets acceptance conditions for ISO 42001 certificates.

How itmad delivers ISO 42001 in Sri Lanka

itmad delivers ISO 42001 audits in Sri Lanka through Sri Lanka-based auditors and a travelling team, and certifies organisations in all industries. ISO/IEC 17021-1 prevents a certification body from designing or implementing the management system that the body certifies, and itmad does not. itmad provides the audit, the certification decision, and optional pre-assessment that identifies gaps without prescribing how an organisation closes those gaps.

The ISO 42001 certification process

ISO 42001 certification cycle: stage 1 documentation review, stage 2 implementation audit, certificate issued for three years, annual surveillance audits, recertification before expiry

Stage 1 of an itmad ISO 42001 audit reviews the AI management system documentation, confirms the scope of AI systems covered, and establishes readiness, raising gaps early enough to be closed. Stage 2 of an itmad ISO 42001 audit assesses implementation: whether the governance runs as documented, whether risk and impact assessments are real and current, whether data controls hold in practice, and whether human oversight functions where the system requires human oversight.

ISO 42001 timeline

An ISO 42001 certificate from itmad is valid for three years, with surveillance audits in each intervening year and full recertification before the certificate expires.

ISO 42001 with other management system standards

ISO/IEC 42001 shares the high-level management system structure used by ISO 9001 and ISO/IEC 27001. An organisation already certified to ISO/IEC 27001 finds the context, leadership, planning and evaluation clauses familiar, and integrated auditing covers those common elements once rather than repeatedly. The pairing of information security and AI governance is a natural one, since AI risk is closely tied to the data behind the AI.

What itmad provides

  • Stage 1 report identifying readiness gaps before the main audit
  • Stage 2 audit report with findings supported by objective evidence
  • Nonconformities classified by severity with defined response timescales
  • Certificate of registration stating the certified scope and the AI systems covered
  • Certification mark for use under the terms of itmad's mark and seal policy
  • Annual surveillance audits and reports through the three-year cycle

Frequently asked questions

What is ISO/IEC 42001?

ISO/IEC 42001 is the first management system standard for artificial intelligence. ISO/IEC 42001 specifies how an organisation governs the AI that the organisation builds, buys or deploys.

How does ISO 42001 certification work with itmad in Sri Lanka?

itmad audits ISO 42001 in two stages. Stage 1 reviews the AI management system documentation and confirms the scope of AI systems covered. Stage 2 assesses whether the governance runs as documented, whether risk and impact assessments are real and current, and whether human oversight functions where required. The ISO 42001 certificate is valid for three years, with surveillance audits in each intervening year.

Does itmad use auditors based in Sri Lanka?

itmad uses both Sri Lanka-based auditors and a travelling team for ISO 42001 audits in Sri Lanka. itmad has worked in Sri Lanka for more than 5 years.

What does ISO 42001 require?

ISO/IEC 42001 requires an AI policy and objectives, AI risk assessment, AI system impact assessment, data governance, lifecycle management, transparency and accountability, human oversight, and third-party and supplier control. The ISO 42001 requirements sit inside the same high-level management system structure used by ISO 9001 and ISO/IEC 27001.

Does ISO 42001 apply to AI bought from suppliers?

Yes. ISO/IEC 42001 requires control of AI components, models and services obtained from others, proportionate to their effect on outcomes. The standard is written to apply regardless of sector or the specific technology.