CSOAI
Initializing...
Free forever · No credit card
CSOAI
Initializing...
ISO/IEC 27001:2022 AI-ready kit — £999 one-time + £199/mo monitoring (optional)
Certification bodies and enterprise buyers now expect AI assets — models, embeddings, prompts, inference endpoints — inside your ISMS. We provide the threat library, risk register, and Statement of Applicability to make it pass.
AI assets missing from most ISMS scopes
Quick Scope
£9one-time
AI asset inventory template and 20-question ISO 27001 + AI scope check.
Get £9 Quick ScopeISO 27001 AI Kit
£999one-time
Threat library, risk register, SoA mapping, supplier governance pack, and one signed attestation.
Buy — £999Audit-Prep Bundle
£4,950one-time
Kit + 2-day engagement + internal audit run + 90-day support.
Buy Audit-Prep — £4,950Enterprise
£1,499/month
Continuous ISMS monitoring, quarterly risk reviews, and unlimited attestations.
Talk sales — £1,499/moAI threat library & risk register
Pre-populated risk register with AI-specific threats: model exfiltration, prompt injection, training-data poisoning, supply-chain compromise, and insider misuse.
ISO 27001:2022 control mapping
Every Annex A control mapped to AI assets, owners, evidence sources, and statement of applicability rationale.
Supplier & model-provider governance
Due-diligence checklists and contract clauses for OpenAI, Anthropic, Google, AWS Bedrock, and open-weight model hosts.
Internal audit programme
12-month audit schedule, checklists, and non-conformance tracker tuned to an AI-first ISMS.
ISO 27001 provides an excellent information security baseline, but it does not cover AI-specific governance such as model risk management, bias, explainability, or AI system lifecycle. Most organisations pair it with ISO/IEC 42001 for a complete AI management system.
Model weights, checkpoints, LoRA adapters, embeddings, prompt templates, inference endpoints, vector databases, training datasets, evaluation datasets, fine-tuning pipelines, and third-party API keys should all be classified and owned.
We provide a Statement of Applicability with control-by-control applicability, implementation status, evidence references, and AI-specific notes. Organisations without an ISMS can use it as a starting point; those with an ISMS can use it as a gap fill.
Yes. The kit is designed as a delta: AI risk treatment, AI asset inventory, and updated SoA justifications that integrate with your existing ISO 27001 management system.
For organisations with no prior ISMS, certification typically takes 6-12 months. With an existing ISMS, the AI delta can be addressed in 4-8 weeks using the kit.
Building a full AI management system?
See the ISO 42001 AIMS kit →MEOK AI Labs · CSOAI LTD · UK Companies House 16939677