Governance before technology
Rules are defined before building. No tool is implemented without knowing who supervises it, what data it uses, and what risks it implies.
Methodology
AI with Judgment: from the standard to practice
AI with Judgment is Soto AI Consulting’s methodology for adopting artificial intelligence responsibly. It translates ISO/IEC 42001 into five phases with concrete deliverables, following the Plan–Do–Check–Act cycle.
First, how AI is used in the organization is defined, who is accountable for each system, and which risks are accepted. Then, with those rules clear, automations and use cases that create value are implemented.
Principles
Five principles guide every decision
Proportional risk
Not every AI use needs the same level of control. An internal writing assistant is not governed the same way as a system that intervenes in decisions about customers.
Human accountability
AI supports decisions; it does not replace them. Each system has an owner with authority to supervise, correct, or stop it.
Transparency and traceability
The organization knows which AI it uses, with what data, for what purpose, and with what results—and can explain it to whoever needs to know.
Continuous improvement
The framework is not a static document. It is measured, reviewed, and evolves with the business and technology.
The five phases
A continuous improvement cycle
The first three phases build the framework; the fourth puts it into operation together with use cases; the fifth verifies that it works and improves it—and feeds a new cycle.
01
Context and scope
Which artificial intelligence is in use today, with what data, under what obligations, and how far the management system should reach.
ISO/IEC 42001 reference: Clause 4
- Initial compliance checklist: gap diagnosis against all requirements.
- Maturity assessment report.
- Inventory of AI uses.
- Proposed scope of the management system.
- Initial map of AI opportunities.
02
Leadership and policy
AI governance is a leadership decision. Commitment is formalized, usage rules are set, and it is defined who is accountable for what.
ISO/IEC 42001 reference: Clause 5 · controls A.2 and A.3
- AI policy approved by leadership.
- Published responsible-use policy.
- Roles and responsibilities matrix.
03
Risk and impact
Each AI use is evaluated for risk and impact on people and the organization, a treatment is decided, and where to invest first is prioritized.
ISO/IEC 42001 reference: Clause 6 · control A.5
- AI risk matrix.
- Impact assessments.
- Statement of applicability of controls.
- Roadmap of prioritized use cases.
04
Controlled operation
The framework goes live. This is also the moment for automations and prioritized use cases, implemented within the rules already defined.
ISO/IEC 42001 reference: Clauses 7 and 8 · controls A.4 and A.6 through A.10
- Register of implemented controls, with owner and evidence.
- Documented procedures for the AI lifecycle.
- Use cases in production, with operational documentation and owner.
05
Evaluation and improvement
The management system is verified to work, use cases meet their objectives, and the organization learns from each cycle.
ISO/IEC 42001 reference: Clauses 9 and 10
- Final compliance checklist: internal verification of all requirements.
- Internal audit report.
- Management review record.
- Improvement plan for the next cycle.
Cross-cutting axis · People and culture: training by profile, awareness, communication, change management, and a consultation channel, in all phases.
Scope and verification
All requirements, within agreed scope
The methodology always covers all requirements of the standard. What is adjusted to each organization is scope: the areas, processes, and AI systems the management system covers. Within that scope, clauses 4 through 10 and applicable Annex A controls are addressed; those that do not apply are excluded with documented justification.
Progress is measured with a compliance checklist that walks every requirement. It is applied twice: at the start, as a gap diagnosis, and at the end, as internal verification. Comparing both shows clearly the before and after.
Principles
Built for responsible AI use
The methodology follows the principles that responsible AI programs share across markets: human oversight, transparency, fairness, accountability, security, and data protection under the rules that already apply where you operate. ISO/IEC 42001 gives those principles a structure you can implement and show.
How success is measured
Indicators in three dimensions
Governance
Standard requirements met, AI uses inventoried with an owner, policies approved and communicated, people trained.
Risk
Risks evaluated and treated, AI-related incidents and nonconformities closed on time.
Value
Hours freed, shorter cycle times and fewer errors in processes touched, team adoption, and return on investment.
Contact
The first step is a conversation
Every organization starts from a different place. A free initial conversation helps understand the starting point, business priorities, and the right scope.