ISO 42001 software should store the AI system inventory, the owners, the risks, the impacts, the Statement of Applicability, evidence dates and tasks. It will not write your policy or decide intended use. A consultant still earns the fee by arguing scope with leadership and building the first records a tool can then hold.

What ISO 42001 software has to store

Buy ISO 42001 software after you know which systems are in scope. A purchase before the inventory is a login for an empty room. ISO 42001 software can hold the inventory, the owners, the risk, the impact, the Statement of Applicability, the evidence dates and the tasks. If a screen cannot show those on one system, keep looking.

ISO 42001 software will not decide intended use. That sentence is a human decision: what the system is for, and what it must not do. A field can store it. A model inside the tool should not invent it. Do not expect ISO 42001 software to write the AI policy. The first policy is a leadership argument. The file slot comes after someone signs.

A spreadsheet named Final_v7 is a file, not a system of record. It will not chase an owner when a review date passes. Ask whether ISO 42001 software can show a control owner and a last-evidence date on one screen. If ISO 42001 software cannot export what a certification body will sample, you still have a tour of menus, not a record. Switching ISO 42001 software mid-audit is how evidence dates get lost. Pick late enough that scope is real, and early enough that Stage 1 is not a folder of PDFs named final.

What ISO 42001 software should store: inventory, risks, controls and evidence
Record The tool can hold it A person still decides
Inventory row Yes Whether the system is in scope
Owner Yes Who that person is
Risk Yes Score and treatment
Impact Yes Who is affected, and the residual effect
Statement of Applicability Yes Applicable or not, and why
Evidence date Yes Whether the test was real
Task Yes What is actually late
Intended use A field only The sentence itself
AI policy A file slot The words leadership will sign

Map your ISO 27001 records before you add ISO 42001 software, so the same incident is not typed twice. Access reviews, supplier files and incident logs can be linked. They should not be copied into a second story that drifts by March. The AI management system still needs its own rows: purpose, impact, data for the model, human oversight. Annex A is not a skin on ISO 27001.

A platform is not the policy

An AI governance platform is the workspace, not the policy. Treat an AI governance platform as the system of record for owners and tasks. If the AI governance platform cannot name a model owner, it is a dashboard. Your AI governance platform should show impact and risk as linked records on the same system. An AI risk assessment that lives in email, and an impact note that lives in a slide, will disagree the week a buyer asks.

Do not pick an AI governance platform because the brochure says Annex A. Open a system you actually run. Time how long it takes to see owner, intended use, last test and open tasks. An AI governance platform that hides evidence dates will fail a surveillance audit conversation, because the auditor asks “when” and the screen answers “somewhere”. Start with one product line on the AI governance platform before you migrate every subsidiary.

What the workspace will not appoint

An AIMS tool should store the management system records, apart from the model metrics. Accuracy graphs belong to the engineering team. The AIMS needs scope, policy, objectives, audit, management review and the control records. Use an AIMS tool for the inventory once the list stops fitting on one tab. An AIMS tool does not appoint the person who runs the management system. That name comes from leadership. The right AIMS tool shows overdue tasks without a Monday export to someone who already knows the dates by heart.

If your AIMS tool is a folder of PDFs, say so in the scope meeting. Pretending a shared drive is a workflow makes Stage 1 polite and Stage 2 painful. Keep the AIMS tool’s user list shorter than the all-staff mailing list. Everyone does not need edit rights on the SoA. The owner, the control owners and the internal auditor do.

ComplAi is an AIMS tool for teams that want the records off a spreadsheet. It is Seven Step’s own GRC workspace. A demo is a look at that workspace on a real inventory shape. There is no invented module list behind the name. ComplAi does not decide your scope, and it does not sign your policy.

Suites the firm already pays for

Generic GRC software AI teams already own can be extended if it holds a system inventory with an owner and a purpose. Many suites track policies well. What GRC software AI buyers see in a demo often tracks models poorly. Sit through it with your inventory, not the vendor’s sample bank.

Ask whether the GRC software AI field for intended use is something a human fills. Do not assume GRC software AI add-ons understand Annex A. A control library that stops at information security will leave impact, data provenance and intended use as free text nobody reviews. A bank may already pay for GRC software AI that risk staff never open.

If GRC software AI evidence is exportable, a consultant can work in it. If every view is a picture that cannot be sampled, you will rebuild the pack in the month before Stage 2. Choose GRC software AI owners can search by system name. Search by policy title alone sends you back to the binder you were trying to leave.

Demand this in the demo Why it matters at audit
System inventory with owner A model with no owner fails fast
Intended use as a human field The tool must not invent purpose
Risk and impact linked The two questions stay distinct
SoA row: applicable, why, owner Blank cells are a Stage 1 problem
Evidence with a date A dated test, not a vague claim
Task that goes late in public Reviews do not live in chat
Export an auditor can open A tour of menus is not a sample

Where ISO 42001 software stops and a consultant starts

A tool marketed as ISO 42001 software still needs a human to argue scope with leadership. Good ISO 42001 software then stores the sentence leadership actually signed. Engineering will say the pilot is out of scope. The board will say the customer already uses it. Someone has to write the sentence and get it signed. That someone is not a workflow engine. The consultant earns the fee on the first policy, the first honest inventory, and the fight about what “in production” means. After that, the tool earns its fee by keeping dates, owners and evidence from rotting.

It is ISO 42001 software in the plain sense when it holds those records and a named person can find them. Review access to ISO 42001 software the way you review access to the model: named people, not a shared login. Bring the auditor a sample from ISO 42001 software, not a tour of menus. If the export matches the story you tell in management review, the tool is doing its job.

Certification is still a certification body’s work. Check NABCB or IAF scope before you treat a logo as proof the body is accredited for an AI management system. Software does not get you through Stage 1. The DPDP Act’s main fiduciary duties commence on 13 May 2027. A date field can remind you. It cannot interpret the rule. EU AI Act Annex III duties have applied since 2 August 2026. The tool can store the impact note. It will not draft a legal opinion.

Market ranges for consulting in India in 2026, not Seven Step fees, often sit near ₹4 lakh to ₹8 lakh for a startup or single-product firm, and higher when several systems are in play. Software is a separate invoice. Staff time to fill the first rows is the cost people forget. No product ranking and no review-site score belong on this page.

Building the AIMS often takes three to six months. A tool chosen before scope becomes shelfware. A tool chosen after the inventory exists is what a surveillance audit can return to.

See the workspace on your inventory

Ask for a ComplAi demo when the spreadsheet has become the risk. We will open the workspace against the shape of your inventory, not against a fictional bank. Write to https://www.sevenstepconsulting.com/contact-us/. The wider implementation path is on https://www.sevenstepconsulting.com/iso-42001-aims-artificial-intelligence-management-system/.