Case Study
FTI Technology Accelerates ISO/IEC 42001 Readiness for a Global Technology Company
A global technology company engaged FTI Technology to accelerate ISO/IEC 42001 readiness for customer-facing machine-learning systems. The company already had mature security, privacy, engineering and risk practices in place, but they were managed in numerous separate functions. FTI Technology helped convert those practices into a coordinated, auditable artificial intelligence management system built into the company’s product development workflows.
Situation
The company was preparing for an external certification assessment against ISO/IEC 42001, the international standard for AI management systems. It needed to define a practical first-year AI management system scope focused on customer-facing machine learning tools. It also needed to translate the standard’s requirements into operating practices suited to a fast-moving product environment.
Mature controls existed across information security, privacy, legal, engineering and enterprise risk. However, those controls were distributed across functions rather than organized within a unified AI governance framework. Ownership, decision rights, evidence requirements and escalation paths for AI systems were not clearly defined.
The company also lacked consistent processes for system intake, risk classification, impact assessment, approval, deployment, monitoring and change management.
Any new approach needed to distinguish traditional machine learning from generative AI and apply additional review only when warranted. It also could not duplicate the management systems the company already had in place.
Our Role
FTI Technology began by assessing the company’s existing policies, governance structures, engineering practices, technical controls and documented evidence against ISO/IEC 42001. This review separated controls the company could reuse from gaps that required priority attention, so the program built on existing strengths rather than replacing them.
From there, the team designed a proportionate governance model and a set of lifecycle processes tailored to customer-facing machine learning.
Specific work included:
- Defined a proportionate initial AI management system scope and governance model, including the AI policy framework, management oversight, roles, decision rights and escalation paths. This clarified accountability, decision rights and evidence requirements across business, product, engineering, legal, privacy, security and risk functions.
- Developed AI risk-assessment, risk-treatment and impact assessment procedures supported by templates and crosswalks to existing security, privacy and risk frameworks.
- Designed a tiered intake and triage questionnaire with core questions and conditional modules based on system type, third party involvement, automated decisions, direct interaction and other legal, privacy or security triggers.
- Established repeatable onboarding, deployment approval, lifecycle monitoring, change management and documentation, integrated with product and engineering workflows.
- Developed AI objectives, minimum key performance indicators and performance evaluation guidance, together with AI-specific considerations for incident response.
- Delivered implementation artifacts and a prioritized certification readiness gap analysis and roadmap distinguishing near-term requirements from long-term maturity opportunities.
- Provided reusable governance artifacts, including policies, procedures, questionnaires, templates and decision tools, to support consistent adoption and audit evidence.
Our Impact
FTI Technology’s work enabled leadership to identify and prioritize AI readiness gaps and prepare for an external certification assessment. The team established a practical, documented AI management system foundation tailored to customer-facing machine learning and aligned with existing management systems.
Additional results included:
- Conversion of ISO/IEC 42001 certification into repeatable AI lifecycle governance spanning intake, assessment, approval, deployment, monitoring, incident response and continual improvement.
- Reduction of duplicative data collection and unnecessary specialist review by separating initial screening from in-depth assessments and using defined escalation triggers.
- Creation of a scalable governance model that can expand to additional AI use cases without applying one-size-fits-all generative-AI controls to traditional machine learning.