Building an AI Management System at a national telco
Inside the first ISO 42001 certification programme at a Tier-1 telecom operator: governance, model inventory, evaluation gates and the audit surprises.
Inside the first ISO 42001 certification programme at a Tier-1 telecom operator: governance, model inventory, evaluation gates and the audit surprises.
Written by Dr. Nadia Al-Hashimi and pressure-tested on live ai governance engagements before publication, this case study is designed to move a programme forward the same week you open it.
Every section is annotated with the decision it should unblock, the owner it should sit with, and the evidence it should leave behind — so the artefact still holds up under audit twelve months later.
- Field-tested against real Stage 1 and Stage 2 audit findings
- Mapped to the controls and cadences the AI Governance faculty deploy in cohort work
- Editable, credit-line optional — use it inside your organisation without attribution
- Includes evidence pointers, owner fields and a first-90-days cadence
- Heads of GRC, CISOs, DPOs and internal audit leads
- Lead Implementers and Lead Auditors preparing for cert cycles
- Consulting teams standing up client programmes
Book a demo with the faculty who wrote this.
Walk through the case study with a MAST practitioner — mapped against your controls, your evidence and your next audit window.
Implementing ISO/IEC 42001: a 90-day operating model
A staged plan to stand up an AI Management System: scoping, risk register, control mapping to ISO 27001/27701, and the first three internal audit cycles.
AI governance: from policy to operating control
Where most AI policies fail in practice and the seven control patterns (model inventory, evals, human-in-the-loop, incident response) that actually hold up under audit.
AI model risk register — ISO 42001 aligned
Model inventory, intended use, data lineage, evaluation cadence and residual risk scoring — pre-wired for AIMS internal audits.