ISO/IEC 42001 for a procurement function: where to start

Why procurement is a natural first scope

Procurement handles supplier data, contracts and payments: sensitive inputs, financial consequences and, in utilities and the public sector, procurement rules that an auditor will check. It is also where AI is already running, often without anyone having listed it. A function-level scope for ISO/IEC 42001 is therefore both urgent and tractable: the processes are documented, the systems are known, and the controls map onto existing segregation of duties in Source-to-Pay.

The first ninety days

IAPro.ai, OREDJA’s AI governance capability, structures the readiness path in four steps.

• Use-case register: every AI use in procurement and supply chain, planned or in production, with its purpose, owner, inputs, outputs and the decision it influences.
• Risk and impact classification: for each use case, the harm it could cause (to suppliers, to the organisation, to individuals), its EU AI Act class where applicable, and the controls that make it acceptable.
• Decision rights and thresholds: what the agent may do alone, what a person must approve, and how exceptions are escalated, written into the procurement procedures.
• Monitoring and audit trail: logging of inputs, outputs and overrides, drift indicators, incident handling, and the evidence an auditor will ask for at stage 1 and stage 2.

Certification, and whether you need it

Certification is issued by an accredited certification body after a stage 1 documentation audit and a stage 2 implementation audit, with annual surveillance and recertification every three years; ISO/IEC 42006 sets the requirements for those bodies. Many organisations stop at readiness: the management system in place and audited internally, certification kept as an option when a client, a regulator or a tender asks for it.

The practical test is simple. If a client asked tomorrow which AI touches their contracts, who approved it and how deviations are caught, could procurement answer in a day? The management system is what makes the answer yes.

How it connects to the EU AI Act

The management system is built so that the obligations of the EU AI Act for the organisation’s risk classes are covered by the same policies, registers and controls, not by a parallel compliance exercise. A procurement use case classified once serves both the standard and the regulation.