A client's security questionnaire asked "How do you govern AI usage?" We didn't have an answer. So we built one.

That single question on a vendor assessment form set off a chain reaction. Not because we were doing anything wrong -- but because we had no way to prove we were doing things right. AI was woven into everything we do: Claude Code for building features, Copilot for code suggestions, ChatGPT for research and drafting. We had 263 Claude skills, 51 active repositories, and a fully AI-native workflow. But when it came to governance, we had nothing documented. No policy. No inventory. No risk assessment.

The honest answer to that questionnaire was "we don't govern AI usage." And when you build software for clients who trust you with their data, that's not an acceptable answer.

Why We Picked ISO 42001

We could have written a one-page AI policy, called it done, and moved on. That would have answered the questionnaire. But it wouldn't have solved the actual problem.

ISO 42001 is the international standard for AI management systems. It's comprehensive -- it covers governance, risk management, policies, monitoring, and continuous improvement. It's also relatively new, which means most companies haven't implemented it yet. We saw an opportunity to get ahead of what's coming rather than scramble to catch up later.

SOC 2 auditors are already asking about AI controls. Enterprise clients want to see AI policies before signing contracts. The EU AI Act is creating new requirements that will affect companies doing business in Europe. These aren't theoretical pressures. We were already fielding these questions from prospects and clients.

So we decided to pursue the full framework. Not just a policy document -- the complete management system.

What We Actually Built

30 documents across 6 phases. Here's what that breaks down to:

Phase 1: Foundation and Gap Analysis. We started by figuring out where we stood. A clause-by-clause assessment of ISO 42001 requirements against our current practices. This was humbling. We had strong engineering practices but almost no formal governance documentation.

Phase 2: Risk Assessment and Treatment. Every AI use case cataloged, classified by risk level, and assessed for likelihood and impact. We built a risk register, defined treatment plans for high-risk items, and set acceptance criteria for what level of risk is acceptable.

Phase 3: Policy and Objective Setting. The actual policy documents: acceptable use policy, data classification for AI, tool configuration standards, incident response procedures for AI-specific issues like bias detection, data leaks, or hallucinations making it into production.

Phase 4: Implementation and Operation. Roles and responsibilities. Decision authority matrices. Escalation paths. Who approves new AI use cases. Who reviews the risk register. How we evaluate new AI tools before adopting them.

Phase 5: Performance Evaluation. KPIs for AI governance. An internal audit checklist. A management review process. Quarterly self-assessment templates. The mechanisms that keep governance alive instead of letting it rot in a shared drive.

Phase 6: Certification Readiness. A pre-certification action plan. Gap remediation tracking. The documentation package an auditor would need to see.

We built all of this in days, not the typical 6-12 months. That sounds impossible until you consider that we used AI to help build its own governance framework. Claude helped draft policies. We used our existing documentation infrastructure -- 709 files, 278,000+ lines -- as context. The same AI-native workflow that powers our engineering work powered the compliance work.

Meta? Yes. But it also proved the point: AI infrastructure compounds. The investment we'd made in documentation and skills paid off in a domain we hadn't originally built it for.

What Surprised Us

1. It wasn't as heavy as we expected. Most of what ISO 42001 asks you to do is stuff you should already be doing -- documenting how you use tools, assessing risks, defining who's responsible for what. The framework just gives it structure. If you already have decent engineering practices, you're further along than you think.

2. The hardest part was the inventory. Writing policies was straightforward. Cataloging every single way we use AI was not. It's easy to list the obvious tools -- ChatGPT, Claude Code, Copilot. It's harder to remember that your CI pipeline uses an AI-powered code scanner, your documentation tool has AI features you enabled six months ago, and someone on the team signed up for an AI transcription service for meeting notes. You can't govern what you don't know about.

3. Risk assessment forced uncomfortable conversations. We had to sit down and honestly evaluate: what happens if this AI tool hallucinates in this context? What happens if client data gets sent to a model we haven't vetted? What happens if an AI-generated code suggestion introduces a security vulnerability that passes code review? Some of those scenarios had non-trivial consequences we hadn't thought through.

4. The framework made our AI usage better, not slower. This was the biggest surprise. We expected governance to be a tax -- more process, more friction, less speed. Instead, it clarified our practices. The data classification policy meant everyone knew exactly which data could go into which tools. The tool configuration standards meant consistent privacy settings across the team. The incident response procedure meant we had a plan instead of panic. Governance didn't slow us down. It removed ambiguity that was already slowing us down; we just hadn't noticed.

5. AI was genuinely good at building its own governance. We used Claude to draft policies, generate risk assessment templates, and structure the audit program. It had access to our operating system documentation, understood our workflows, and produced drafts that needed editing -- not rewriting. The irony of using AI to govern AI isn't lost on us, but the output speaks for itself.

What We'd Do Differently

Start with the AI system inventory. We began with gap analysis, which is what the standard suggests. In hindsight, we should have started by cataloging every AI tool and use case first. The inventory informs everything else -- you can't assess gaps or risks against systems you haven't identified. If you do one thing this week, start a spreadsheet of every AI tool your organization uses, who uses it, and what data it touches.

Don't try to do all 6 phases at once. We had the advantage of a small team and strong documentation infrastructure. If you're a 50-person company, trying to build the entire framework simultaneously will overwhelm people. Start with Phase 1 (gap analysis) and Phase 2 (risk assessment). Those two phases give you the biggest return because they tell you where you actually stand and where the real risks are. The policies can come after.

Get leadership buy-in early. AI governance dies if only engineering cares about it. The acceptable use policy affects marketing, sales, customer support -- anyone who touches AI. The risk register needs input from people who understand business impact, not just technical risk. If your CEO doesn't understand why this matters, the framework becomes shelfware.

The Honest Disclosure

We are pursuing ISO 42001 certification. We are not certified. Our target is Q4 2026.

I'm being explicit about this because I've seen too many companies imply credentials they don't have. We built the framework. We use it daily. We believe it's solid enough to pass an audit. But we haven't gone through that audit yet.

Here's why I think that honesty is actually a strength: we're in the same position as most of the companies we work with. We know exactly which parts of the process are hard because we just went through them. We know where the gotchas are. We know which documents took three drafts to get right and which ones were straightforward. We're not selling from a textbook or reciting what we learned in a certification course. We're sharing what we built, what worked, what didn't, and what we'd change.

If you need someone who's already certified to stamp your documents, you need an accredited certification body. We're not that. What we are is practitioners who can get you ready for that engagement -- so when you do hire the certification body, you're prepared rather than starting from scratch at their billing rate.

Who Needs This Now

Not everyone needs ISO 42001 compliance today. But some companies need to start yesterday.

If your clients ask about AI in security questionnaires. This is the trigger that started our journey. If you're fielding these questions and scrambling for answers, you need at minimum an AI policy framework and a system inventory.

If you're an MSP managing other companies' technology. Your clients are asking you about AI governance because their auditors are asking them. Having documented AI practices isn't just good hygiene -- it's a competitive differentiator when you're bidding for contracts.

If you handle sensitive data with AI tools. Legal tech companies processing contracts. Healthcare companies using AI for patient communications. Financial services companies using AI for analysis. If the data is sensitive, the governance isn't optional.

If you're thinking about the EU AI Act or SOC 2 AI controls. These aren't hypothetical anymore. SOC 2 auditors are actively asking about AI. The EU AI Act has compliance deadlines. Getting the foundation in place now is cheaper than rushing to comply under a deadline.

If "everyone uses AI however they want" describes your organization. That's where we were. It felt fine until someone asked us to prove it was fine. The gap between "we use AI responsibly" and "here's the documentation proving we use AI responsibly" is the gap that governance fills.

What We Offer

We took everything we built for ourselves -- 30 documents, 6 phases, the full ISO 42001 framework -- and turned it into a service we call AI Governance Readiness. We adapt our framework for your company: your size, your industry, your AI usage, your compliance targets.

The engagement runs 4-6 weeks. You get an AI system inventory, a policy framework, risk assessments, a governance structure, a compliance gap analysis, and monitoring foundations. These aren't empty templates. They're our working documents with real content, customized for your organization.

We deliver everything into your repository, not ours. We train your team on how to maintain it. When we leave, the framework keeps working.

If you're facing questions about AI governance -- from clients, auditors, regulators, or your own leadership team -- and you don't have answers yet, the practical next step is to document current usage, identify control gaps, and define what “audit-ready” should mean for your team before you buy tooling or policy theater.

I run Namos Labs, a human-first AI product studio. We're pursuing ISO 42001-aligned governance because we think practical AI controls are going to become table stakes very quickly.