Using AI in your business? Why your IT partner's ISO 42001 certification matters

Somebody in your business is already using AI. They may have pasted a client email into a chatbot to tidy the wording, or asked a free tool to summarise a contract. Nobody decided that was fine. It just happened.

For most small and medium-sized businesses, the question is no longer whether to use AI. It is whether anyone is in charge of how it gets used. That is the gap ISO 42001 was written to close, and it is why we chose to certify to it.

What ISO 42001 is, in plain English

ISO 42001 is the first international standard for managing artificial intelligence. It was published in December 2023 and sits alongside standards you may already know, such as ISO 27001 for information security.

It does not test whether a particular AI tool is clever. It tests whether an organisation has a working system for using AI responsibly, and whether that system holds up when an independent auditor looks at it. In practice that means:

• Clear ownership. Someone is named as accountable for AI use, rather than it being everyone's job and therefore nobody's.
• Risk assessment before rollout. What could go wrong with this tool, with this data, for these people, and what are we doing about it?
• Rules about data. Which information may go into which tool, and which never may.
• Records. What was used, where, and what it was allowed to do, so decisions can be explained later.
• Regular review. AI tools change every few months. The management system has to keep up.

Why this matters to a Kent business and not just a tech company

Your data is the real exposure. UK GDPR still applies when personal data goes into an AI tool. A free public chatbot is not a safe place for client details, staff records or anything covered by a confidentiality duty. For law firms, accountants, care providers and anyone handling sensitive data, that is a compliance problem before it is a productivity one.

Your clients are starting to ask. Security questionnaires and tender documents increasingly include questions about how suppliers use AI. A supplier who can answer with a documented policy and an independent certificate has a much easier conversation than one who says "we're careful."

Rules are tightening. UK businesses that sell into the EU may fall within the EU AI Act, and UK regulators are paying attention to AI use too. A management system built around a recognised standard is far easier to adapt than a set of habits.

Unmanaged AI creates cost and mess. Duplicate subscriptions, tools nobody adopts and workflows that break when one person leaves are all common. Governance sounds dull, but it is what stops AI projects becoming expensive experiments.

What ISO 42001 does not mean

We would rather be straight about this than oversell it.

• It is not a guarantee that no AI tool will ever make a mistake. AI tools make mistakes. The standard is about managing that risk, not pretending it away.
• It does not certify a specific product. It covers how an organisation governs AI, within the scope of its own management system.
• It does not make your business compliant automatically. We still need to look at how you work and what data you hold.

A rare certification

AI governance is still new for most IT providers. When we asked Google's AI Mode on 3 November 2026 which IT support companies in Kent are publicly verified as holding ISO 42001, it named CT1 Technologies as the only one it could find, and noted that while many regional providers hold ISO 27001 or Cyber Essentials, ISO 42001 is relatively new and rare.

AI-generated answers change and aren't a formal register, so treat that as a snapshot rather than a guarantee. It does match what we see: plenty of providers talk about AI, very few have had their approach independently audited.

Five questions to ask any IT provider about AI

Whether or not you work with us, put these to anyone who offers to bring AI into your business:

1. Who is accountable for AI at your company, and what is written down? Ask to see the policy.
2. What happens to our data? Which tools, which regions, whether it is used to train models, and how it can be deleted.
3. How do you assess a tool before recommending it? You want to hear about risk, not just features.
4. What can we check independently? A certificate from an accredited body is checkable. A promise is not.
5. What will you advise against? A good partner will tell you which tasks AI should not touch.

What this looks like when we work with you

Our AI work starts small and stays reversible. We find the repetitive tasks that eat hours, pick one, pilot it alongside the manual process and measure the result. If the numbers aren't there, we say so and stop.

Every rollout includes a written policy covering which data can go where, who may use what, and what gets logged, in a form your team can actually follow. Much of the useful work happens inside tools you already pay for, such as Microsoft 365, so we check what your licences include before suggesting anything new. You can read more on our AI Integration page.

Where to start

If you're not sure what AI use is already happening in your business, start there. Our posts on whether your business is ready for AI and where to start with AI walk through it, and you can read how we got certified in We've achieved ISO 42001.

Or book a free 30-minute IT health check. We'll look at your security and how AI is already being used, and tell you plainly where the risks and the opportunities are, with no obligation and no hard sell.

FAQ

What is ISO 42001?

The international standard for AI management systems, published in December 2023. It sets requirements for governing, deploying and monitoring AI responsibly.

Does my business need ISO 42001?

Most small businesses don't need to certify themselves. It is worth choosing suppliers who have, particularly if you handle sensitive client or customer data.

Is it the same as ISO 27001?

No. ISO 27001 covers information security in general. ISO 42001 covers how AI is governed. They complement each other, and ours build on one another.

Is it safe to use ChatGPT or Copilot with client data?

It depends on the tool, the licence and your data. Public free tools are generally not appropriate for confidential or personal data. Business versions with the right settings can be. That is exactly what a written policy should spell out.