Estimated reading time: 7 minutes
ISO 42001 scales to fit a 30-person business. The standard itself is not the problem. The problem is that most small businesses read it, feel the size of it, and never start. Governance stays a folder nobody opens. This page covers what ISO 42001 actually requires at this scale, and how our 90 Day AI Challenge gets the governance foundation built and running in your business in three months, not eighteen.
What ISO 42001 Actually Requires (and What It Does Not)
The standard is built around risk assessment and accountability, not a stack of procedural checklists. Documentation requirements scale to the size of the business and the complexity of the AI in use.
A 30-person company needs functional compliance governance: clear ownership, a working risk register, and staff who understand their role. It does not need a dedicated compliance department.
The standard asks for staff training on AI-specific risks, clear ownership of oversight activities, and documented decisions. Scalability concerns mostly dissolve once leadership treats this as a governance quality problem, not a governance volume problem.
Why Small Businesses Stall on ISO 42001 Alone
Most small businesses that try this alone get stuck in the same place: nobody owns it. The AI policy sits half-written because the person responsible for it also runs sales, or finance, or the whole business. Generic templates do not match the tools your team actually uses, because nobody has mapped what those tools are. Eighteen months out, the folder still says draft.
This is the gap the 90 Day AI Challenge closes. Someone builds it with you, on your actual workflows, on a fixed timeline, and hands you a working system at the end rather than a template you still have to finish yourself.
How the 90 Day AI Challenge Gets You There
The engagement runs in three phases. Each one maps directly onto a part of what ISO 42001 actually asks for.
Month 1: Audit
We map every AI tool already running in your business, score the risk and the opportunity in each one, and build the business case. This is the AI system mapping and risk assessment ISO 42001 asks for, done in the first month instead of drifting for a year.
Month 2: Activate
We draft the AI policy, the responsibility matrix, and the risk register with you, then put the first workflow into production with your team trained on it. This is where governance stops being a document and starts being how your business actually operates.
Month 3: Accelerate
We expand adoption across the team, track the results, and hand over a governance framework and playbook your business owns and can keep running without us.
What You Get At the End of 90 Days
A working AI policy. A risk register that reflects your real tools, not a generic template. A trained team using AI inside clear rules. A measured first result.
This is the foundation ISO 42001 certification is built on, not the certification itself. Certification readiness is a further step once the foundation is in daily use, realistically the next 12 to 18 months depending on how far your business wants to take it.
The Core Governance Essentials We Build With You
Small businesses cannot implement every ISO 42001 control at once, so we prioritise the handful that cover most of the standard’s intent:
- An AI policy statement defining acceptable use, data handling, and accountability
- A responsibility assignment matrix so every AI decision has a named owner
- A basic risk register scoring bias, privacy, and safety impacts across your actual tools
- Incident response procedures for when an AI tool gets something wrong, built on the same structure as our incident response checklist
These four elements cover most of what ISO 42001 actually asks for at this scale. Everything else layers on top once the foundation is running.
Not Sure Where You Stand Right Now
If you want the wider picture on how AI consulting works for NZ SMBs before you book a call, read our AI consulting explainer. If you want a quick read on where your business currently stands, take the 15-minute AI Readiness Audit.
Frequently Asked Questions
Can a Small Business Implement ISO 42001 Without Hiring External Consultants
A small business can build the foundation itself if someone owns it full time for the effort it takes. In practice, most 30-person businesses do not have that spare capacity, which is why the 90 Day AI Challenge exists: a fixed, 1 to 1, 90-day engagement that builds the governance foundation for you rather than leaving it as a project nobody finishes.
How Much Does ISO 42001 Certification Cost for a Small Business
Certification itself typically costs 10,000 to 50,000 dollars depending on scope and the certifying body, on top of the work to build the governance foundation first. The 90 Day AI Challenge covers the foundation stage at 4,997 dollars a month for three months. The standalone value of the included work is 39,000 dollars plus.
Does ISO 42001 Apply if We Only Use Third Party AI Tools
Yes. Using third party AI tools does not remove your responsibility for how they are governed. ISO 42001 asks for oversight of vendor risk and tool selection regardless of whether the AI was built in house or bought in.
Is the 90 Day AI Challenge the Same as ISO 42001 Certification
No. The 90 Day AI Challenge builds the governance foundation: policy, risk register, and a trained team using AI in production. Certification is a separate, later step once that foundation is in daily use. We built our own foundation the same way before we went on to certify.
How Long Does Full ISO 42001 Certification Readiness Take After the 90 Days
Realistically 12 to 18 months from a standing start, depending on how much of the standard your business wants to pursue. The 90 days gets the foundation built and running. Certification readiness builds on top of that at a pace that matches your business, not a generic template.
