ISO 42001

ISO/IEC 42001 is the first international standard for an AI management system. It asks an organisation that builds or uses AI to know which AI systems it runs, to assess their risks and their impact on people, to keep humans in control, to log what the systems do and to manage the suppliers behind them. Accredited bodies certify it on a three-year cycle.

Where we are

Vaulty is not ISO 42001 certified. Some of what the standard expects is built into how Vaulty works. Every figure in an answer comes from a query you can see, so a person can check it. The assistant changes something in your systems only after a human approves. Activity is logged. No model is trained on client data, and the model runs on Microsoft Azure in the EU data zone, on your own Azure, or on hardware you control.

What is planned

A written AI policy, an inventory of the models we use and where they run, an impact assessment for each use of the assistant, a formal release gate based on test sets of real business questions, documented responsibilities shared with our model provider, and a process for reporting and handling AI incidents. Certification will follow our ISO 27001 work. This card will change only when an accredited body has certified us.