The Challenge

The organization already had established IT, cybersecurity, risk management, and data governance practices. However, AI introduced new governance requirements that were not fully addressed through the existing management frameworks.

Some of the key challenges identified included:

• No centralized AI governance framework covering the complete AI lifecycle.
• AI-related roles, responsibilities, and accountability were not formally defined.
• No consolidated inventory of AI systems and AI use cases.
• AI-specific risks were not consistently identified and assessed.
• AI impact assessment criteria had not been formally established.
• Controls around responsible AI, transparency, human oversight, data quality, and AI system monitoring required further formalization.
• Third-party and externally sourced AI solutions required stronger governance.
• Existing information security, privacy, risk, and technology processes needed to be integrated with AI governance.
• Evidence needed to demonstrate the effective operation of the AIMS before certification.

The objective was therefore not simply to develop a set of policies, but to establish an operational and auditable AI Management System.

MAST Consulting’s Approach

MAST Consulting adopted an end-to-end implementation approach covering the complete ISO/IEC 42001 journey.

1. ISO 42001 Gap Assessment

The engagement started with a detailed assessment of the organization’s existing governance and AI-related practices against ISO/IEC 42001:2023.

MAST conducted interviews and workshops with stakeholders from areas including IT, cybersecurity, risk management, data management, legal/compliance, procurement, business functions, and teams involved in AI initiatives.

The assessment mapped:

ISO 42001 Requirement → Existing Practice → Compliance Status → Identified Gap → Risk → Recommended Action

This provided management with a clear understanding of the organization’s existing AI governance maturity and established the implementation roadmap.

2. AI Management System Scope and Context

MAST worked with the organization to establish the scope and boundaries of the AIMS.

This included identifying relevant internal and external issues, interested parties, regulatory and contractual considerations, organizational AI objectives, and dependencies on external AI technology and service providers.

A formal AIMS scope statement was established to provide clear boundaries for implementation and certification.

3. AI System and Use-Case Inventory

One of the key implementation activities was identifying where AI was actually being used across the organization.

MAST supported the organization in establishing an AI System Inventory / AI Use-Case Register covering information such as:

• AI system or application
• Business purpose
• System owner
• AI provider/developer
• Data used by the AI system
• Intended users
• Internal or external deployment
• Key dependencies
• Potential impact
• Applicable governance requirements
• Risk classification
• Required human oversight

This gave management centralized visibility over AI usage and created a foundation for ongoing AI governance.

4. AI Risk and Impact Assessment Framework

Traditional information security risk assessment alone was not sufficient to address all AI-related risks.

MAST therefore developed an AI-specific risk assessment methodology covering risks associated with areas such as bias and fairness, transparency, explainability, data quality, privacy, security, reliability, inappropriate AI outputs, misuse, third-party dependency, human oversight, accountability, and unintended consequences.

AI risks were documented in an AI Risk Register, with defined risk owners, existing controls, treatment actions, residual risk, and management decisions.

An AI Impact Assessment process was also established to evaluate the potential impact of relevant AI systems on individuals, organizations, and wider stakeholders.

5. Development of the AIMS Governance Framework

Based on the gap assessment and risk analysis, MAST developed and enhanced the governance documentation required to operationalize the AIMS.

The framework included, as applicable:

• Artificial Intelligence Management System Policy
• Responsible AI / AI Acceptable Use principles
• AI Governance Framework
• AI Risk Management Procedure
• AI Impact Assessment Procedure
• AI System Lifecycle Governance Procedure
• AI System Inventory
• AI Risk Register
• Roles and Responsibilities Matrix
• AI Objectives and Monitoring Framework
• Data Governance considerations for AI
• Third-Party AI Governance requirements
• AI Incident Management considerations
• AI Change Management requirements
• AI System Monitoring and Performance Review
• Document and Record Control
• Competence and Awareness requirements

Rather than creating an isolated management system, the AIMS was integrated with relevant existing governance, information security, risk, procurement, privacy, and technology processes.

6. Roles, Accountability and AI Governance Structure

MAST worked with senior management to establish clear ownership and accountability for AI.

Responsibilities were defined for relevant stakeholders including management, AI system owners, business owners, technology teams, information security, risk, compliance, procurement, data governance, and other relevant functions.

Governance mechanisms were established to ensure that significant AI initiatives could be appropriately reviewed, risk-assessed, approved, monitored, and periodically reassessed.

This helped move AI governance from an informal technology responsibility to an organization-wide management responsibility.

7. Third-Party AI and Supplier Governance

The organization relied on external technology providers for certain AI capabilities.

MAST incorporated AI-specific requirements into the organization’s third-party governance process.

The enhanced assessment considered areas such as supplier responsibilities, data handling, security, transparency, service dependencies, AI model limitations, monitoring, contractual requirements, incident notification, and exit considerations.

This allowed AI supplier risks to be considered before onboarding and throughout the supplier relationship.

8. Awareness and Competency Development

An effective AIMS requires employees and relevant stakeholders to understand their responsibilities when using AI.

MAST conducted awareness and knowledge-transfer sessions covering:

• ISO/IEC 42001 requirements
• Responsible use of AI
• AI governance responsibilities
• AI risks
• Generative AI considerations
• Data and confidentiality risks
• Human oversight
• Reporting AI-related issues
• Organizational AI policies and procedures

Focused sessions were also provided to stakeholders responsible for operating and maintaining the AIMS.

9. Implementation and Evidence Collection

After documentation was established, MAST supported the organization in implementing the required controls and generating evidence of their operation.

Instead of treating certification as a documentation exercise, the project focused on demonstrating that processes were actually being followed.

Evidence included completed risk assessments, AI impact assessments where applicable, approved policies, AI inventories, governance records, training records, monitoring information, supplier assessments, meeting records, management decisions, and corrective actions.

MAST maintained an implementation tracker to monitor outstanding actions and readiness.

10. Internal Audit

Once the AIMS had been implemented, MAST conducted an ISO/IEC 42001 internal audit to evaluate whether the management system was effectively implemented and aligned with the requirements of the standard.

The audit covered governance, risk management, documented processes, operational controls, AI lifecycle activities, evidence, monitoring, and management-system requirements.

Findings and improvement opportunities were documented, and corrective actions were assigned to responsible stakeholders.

11. Management Review

MAST supported the organization in conducting its formal AIMS Management Review.

Senior management reviewed areas such as:

• Status of AIMS implementation
• AI objectives
• AI risks and impacts
• Internal audit results
• Corrective actions
• Changes affecting the AIMS
• Performance and monitoring results
• Resource requirements
• Opportunities for continual improvement

This provided formal management oversight and demonstrated leadership involvement in the AIMS.

12. Certification Readiness and Audit Support

Before the external certification assessment, MAST conducted a final readiness review to identify any remaining documentation, implementation, or evidence gaps.

Outstanding findings were tracked through to closure.

MAST also supported the organization during the certification process by helping relevant teams prepare evidence, understand auditor expectations, respond to observations, and address any identified corrective actions.

The engagement enabled the organization to progress through its ISO/IEC 42001:2023 certification journey with a structured and operational Artificial Intelligence Management System in place.

Key Outcomes

Through the engagement, the Saudi government organization established a structured framework for governing AI across its lifecycle.

The project resulted in a centralized AIMS, formal AI governance responsibilities, an inventory of AI systems and use cases, an AI-specific risk and impact assessment methodology, stronger governance of third-party AI solutions, documented responsible-AI requirements, improved employee awareness, and mechanisms for monitoring and continual improvement.

Most importantly, the organization moved from individual AI initiatives and fragmented controls to an organization-wide governance model for responsible AI.

Project at a Glance

How MAST Consulting Helped

MAST Consulting provided end-to-end ISO/IEC 42001:2023 consulting support—from initial gap assessment and AI governance design through risk assessment, documentation, implementation, internal audit, management review, and certification readiness.

The engagement helped the organization establish a sustainable Artificial Intelligence Management System (AIMS) that supports responsible AI adoption while integrating AI governance into its wider organizational governance and risk-management environment.