Frequently asked questions

ISO/IEC 42001 is the first international standard that sets requirements for an artificial intelligence management system: the policies, roles, processes, and controls an organization uses to direct and oversee its use of AI. It was published in December 2023 by ISO and IEC and applies to any organization that develops, offers, or simply uses AI.

No. It is a voluntary international standard. Organizations adopt it to govern AI use in a way they can show to clients, partners, and auditors—not because a law forces them to. Some markets and buyers already treat structured AI governance as a commercial expectation.

AI use is already subject to general rules such as personal-data protection laws in your jurisdiction, sector regulation, and contracts, plus any AI-specific rules in force where you operate. During management-system implementation, those duties are documented in a legal requirements register that the organization keeps up to date. That is not legal advice: interpretation is validated by the client’s legal counsel.

No. Many organizations start by ordering the use that already exists—sometimes informal—and by deciding where to invest.

It is a review of the organization against all ISO/IEC 42001 requirements that shows where it stands, what is missing, and where to start. It uses a compliance checklist and ends in a report with a roadmap.

It depends on scope: the areas, processes, and AI systems covered. The gap assessment defines that scope and, with it, a plan with concrete phases and deliverables before implementation begins.

Yes. Services are independent. You can hire a portfolio diagnosis, an automation project, or a program. Each project is delivered documented and with exportable files, and the organization decides whether its team operates it or monthly maintenance is engaged.

Implementation is a closed project: when it ends, the organization operates the system. If support is needed later, it can hire annual internal audit, addition of a new AI use case, or an update when regulation changes.

The organization. Each automation is delivered with documentation and exportable files so its team can operate it without depending on the consultant. If preferred, continuity can be entrusted to Soto AI Consulting through monthly maintenance.

No. A governance framework replaces improvisation with a known path: each use case is evaluated, approved, built with human oversight, and measured—and therefore scales with less friction.

Yes. Engagements are remote-friendly and the methodology is based on an international standard, so it adapts to each country’s legal framework. The practice is based in Costa Rica.

It is treated with full confidentiality, under a confidentiality agreement signed before sensitive information is shared, and in line with applicable personal-data protection rules.

Start with a free conversation so we understand your context and priorities. If it’s a fit, we propose scope and the first step.