ISO 42001 certification in Uganda: AI management systems
ISO 42001 certification in Uganda is becoming a question for banks, telecoms, insurers, health providers, universities, public agencies and technology firms that build, buy or rely on artificial intelligence. ISO/IEC 42001 is the international standard for an AI management system: the policies, roles, risk assessments and controls an organisation uses to develop or use AI responsibly. NAM QMS trains people on the standard, runs a free gap analysis and helps organisations implement the system. We do not issue the certificate.
What an ISO 42001 AI management system covers
ISO/IEC 42001 follows the same high-level structure as ISO 9001 and ISO 27001: context, leadership, planning, support, operation, performance evaluation and improvement. What is new is the subject. The organisation has to decide which AI systems are in scope, what role it plays for each one (developer, provider or user), and which risks those systems create for the organisation, for the people affected and for society.
- An AI policy and clear responsibilities for AI decisions
- AI risk assessment and AI system impact assessment
- Controls from Annex A, chosen and justified in a statement of applicability
- Data quality, transparency, human oversight and supplier controls
- Internal audit and management review of the AI management system
ISO 42001 training for individuals, implementation for organisations
Training is for individuals: risk, compliance, data, IT and quality professionals who need to understand the standard or audit an AI management system. Implementation is for organisations and institutions. We work with the team that owns your AI systems to set the scope, write the policy, run the risk and impact assessments and build the records an auditor will sample. Implementation is quoted after the free gap analysis, because the work depends on how many AI systems you run and how you use them.
Organisations that already hold ISO 27001 have a head start. Document control, internal audit, management review and supplier management carry over. The AI-specific parts, such as impact assessment, data governance for training data and human oversight of automated decisions, still need their own work.
Free gap analysis before you commit
The free ISO gap analysis starts with an inventory: which AI systems you build, which AI services you buy, and which decisions they influence. We then compare your current practice with the requirements of ISO/IEC 42001 and tell management what is in place, what is missing and how large the scope should honestly be. It is a briefing, not an audit and not a certificate.
Getting ISO 42001 certified: what ready means
NAM QMS does not issue ISO certificates and is not a certification body. An independent accredited certification body plans the audit and issues the certificate if it decides the system meets the standard. For ISO 42001, ready means the AI systems in scope are listed, roles are assigned, risk and impact assessments are current, the chosen controls are actually operated, internal audits have tested them, and management has reviewed the results. Then an accredited certification body that audits ISO/IEC 42001 can carry out its own assessment.
ISO 42001 does not certify an AI model as safe or accurate, and it does not replace legal duties such as Uganda's Data Protection and Privacy Act. It shows that the organisation manages AI with a system. Compare the other standards on the ISO certification in Uganda hub.
Other standards for organisations
Questions organisations ask
What is ISO 42001?
ISO/IEC 42001 is the international standard for an artificial intelligence management system. It sets requirements for how an organisation governs, develops, provides or uses AI systems responsibly, including risk assessment, impact assessment and controls.
Does NAM QMS issue ISO 42001 certificates?
No. NAM QMS trains people and helps organisations implement the AI management system. An independent accredited certification body audits the system and decides whether to issue the certificate.
Who needs ISO 42001 certification in Uganda?
Organisations that build AI products, offer AI-enabled services, or use AI in decisions about customers, patients, staff or citizens, and that need to show clients, regulators or tenders that the AI is governed.
We already have ISO 27001. Do we still need ISO 42001?
If the requirement is AI governance, yes. ISO 27001 covers information security. ISO 42001 adds AI risk and impact assessment, data governance, transparency and human oversight. The two systems can share document control, internal audit and management review.
How do we start?
Book the free gap analysis. We list your AI systems, compare current practice with the standard and recommend a scope. Implementation support is then quoted for your organisation.
Next step for your organisation
If your organisation is considering ISO 42001 certification in Uganda, book the free gap analysis. We will map your AI systems, show what the standard asks for and plan the work before a certification body is invited.
Book a free ISO gap analysis