Back to Blog
Series · 5 pieces

ISO 42001 and AI Governance

The 2027 ISO 42001 AI audits most mid-market companies will fail, the EU AI Act Article 12 logging requirements, and the 2027-2030 AI assurance market for the firms building this practice now.

Start here — the overview
May 25, 2026·7 min read

The First AI Audits Hit in 2027. Most Mid-Market Companies Will Fail Them.

In 18 months, a new generation of audit opinions will start landing in mid-market boardrooms. The standard is ISO 42001 — and most companies haven't read it.

Read the pillar
The 4-piece series
  1. 2of 5
    May 25, 2026·12 min read

    Scoping and Pricing ISO 42001 Audits: A Practitioner's Guide for Assurance Firms

    Most firms pricing ISO 42001 audits at "ISO 27001 plus 30%" are mispricing them by 50% or more. The five scoping questions, the multipliers, and the math.

    Read
  2. 3of 5
    May 25, 2026·16 min read

    What to Sample in an ISO 42001 Audit: An Evidence Field Guide

    ISO 42001 requires "documented information" but doesn't specify what that looks like for AI. A field guide for what to sample in 2027-era audits.

    Read
  3. 4of 5
    May 25, 2026·13 min read

    The 2027-2030 AI Audit Market: How Assurance Firms Will Differentiate

    By 2030, the firms that started early will have shaped how AI assurance is delivered. Three differentiation dimensions and the talent and pricing trajectory.

    Read
  4. 5of 5
    May 25, 2026·14 min read

    EU AI Act Article 12: What AI Logging Requirements Mean for Audit Firms and Their Clients

    EU AI Act Article 12 is already applicable to high-risk AI systems newly placed on the EU market. What it requires, how it overlaps ISO 42001, and what to do now.

    Read

Ready to put this into practice?

See how vCISO Lite operationalizes the methodology behind this series.

Get Started