ISO 42001 for SaaS gives an Indian product firm one inventory for models it builds and tools it buys. The certificate does not by itself win a US or EU deal. It gives that inventory and the evidence a buyer asks to see. EU AI Act high-risk duties for most Annex III systems have applied since 2 August 2026.

A quote PDF from a US buyer lands on a Thursday. The new tab asks which models touch their tenant. If that answer is a spreadsheet named Final_v7, with a blank owner column, the call slips a week.

What ISO 42001 for SaaS puts on one inventory

ISO 42001 for SaaS is the management system for a firm that ships a model and also rents one. The AI management system, the AIMS, holds every system in scope. That includes the feature in production, the copilot on the support desk, and the vendor model behind an API. A model with no owner is the row a Stage 2 sample will fail.

ISO 42001 for SaaS starts from that list. Write the purpose, the data the system sees, and the person who can turn it off. Clauses 4 to 10 are the loop: context, leadership, planning, support, operation, evaluation and improvement. Annex A has 38 controls, from A.2 to A.10. The Statement of Applicability records which of those controls apply and why.

Staff tools count. A developer who pastes a customer log into a public chatbot has opened a data path your contract may forbid. ISO 42001 for SaaS keeps that shadow use on the inventory once people rely on it for customer work. Name an owner or stop the paste.

An AI system that is already in production needs an owner, a purpose, and a record of how it was tested.

How ISO 42001 for SaaS sits beside the security pack

ISO 27001 asks who can read the data. The AIMS asks what the model may decide or generate, and how you tested that limit. You can run both programs. An accredited ISO 27001 mark is not an AIMS mark. NABCB, under QCI, accredits management-system certification bodies in India. Check the body’s current scope on the NABCB or IAF directory. This article names no certification body.

ISO 42001 for SaaS does not replace the security answers you already send. It adds systems, owners and tests. Stage 1 is the documentation review. Stage 2 is the implementation audit. The auditor should sample a live system and the policy PDF. After the certificate comes a surveillance audit, then recertification around year three.

Put ISO 42001 for SaaS on the internal audit plan once the inventory exists, and sample one in-house model and one bought copilot. Write the finding on the row. A clean policy with a dirty register will not help you on the Monday call.

Seven Step Consulting is a consultancy in Gurugram. It does not issue ISO certificates. A certification body does.

The deal is still the buyer’s

ISO 42001 does not by itself win a US or EU deal. It gives an inventory and evidence when a buyer asks. ISO 42001 for SaaS is that pack, tied to systems you can open on a call. A logo on the site, with Final_v7 still missing owners, will not survive the second email.

High-risk duties for most Annex III systems have applied since 2 August 2026. ISO 42001 does not create a presumption of conformity. For a product sold into Europe, ISO 42001 for SaaS gives the management system and the evidence. It does not close the buyer’s legal review.

If the product scores people for credit, hiring, education or access to an essential service, ask counsel whether Annex III applies before you tell procurement the certificate ends the file.

Where AI compliance for SaaS shows up in the product

AI compliance for SaaS is the habit of tying each release to an owner, a purpose and a record of how it was tested. A release note that only cites a demo score misses the harm a wrong answer can do to a customer.

AI compliance for SaaS covers the model you trained and the model you rent. Write the vendor, the data you send, and what the contract lets you audit. Annex A expects supplier duties to be allocated, with a name on your side.

AI compliance for SaaS also covers prompts. If a customer ticket is pasted into a bought copilot, that paste is a data flow. Record it. An AI risk assessment scores harm to the customer and to the business. A demo-set score is a different number. ISO/IEC 23894:2023 guides the risk work. An AI impact assessment asks who is affected when the output is wrong. ISO/IEC 42005 guides the impact work. Neither guide is a second certificate.

AI compliance for SaaS slips when every squad ships a feature and nobody updates the register. Put the update on the release checklist. A focused firm with a small inventory can be audit-ready for Stage 1 in about 90 days if leadership shows up. That is readiness. Do not treat it as a certificate in 90 days. A full build often takes three to six months, depending on size, AI maturity and how many systems are in scope.

AI compliance for SaaS has a personal-data side when customer text sits in prompts or training. Main DPDP Act fiduciary duties commence on 13 May 2027. The full rulebook is not already in force.

AI compliance for SaaS at mid-market, with several models, usually costs more staff time than a single chatbot. The bands below are 2026 India market ranges for one legal entity. They are not a Seven Step fee.

What the enterprise security questionnaire AI tab asks

Procurement already holds your ISO 27001 answers. The enterprise security questionnaire AI tab is the new page. It asks for the inventory, the purpose of each system, whether customer data trains a model, who may approve a new tool, and how you watch the output after go-live.

Answer the enterprise security questionnaire AI section from the register. If sales writes a paragraph and engineering cannot point to the row, you have two stories. Buyers compare them on the call.

An enterprise security questionnaire AI response that says the firm follows good practice is not a record. Name the system. Name the last test. Name the person who can roll it back.

Keep the enterprise security questionnaire AI file beside the Statement of Applicability. A control marked applicable needs a record. A control marked out with one line and no reason is a Stage 1 finding.

Refresh the enterprise security questionnaire AI pack when the inventory changes. A model added after you sent the PDF is the question that stalls legal review.

The enterprise security questionnaire AI deadline is often shorter than a release cycle. The inventory has to exist before the email. A weekend list has no owner on Monday.

Scope, fees and the three invoices

ISO 42001 for SaaS inventory covering in-house models and bought copilots
What the buyer asks Record you should already hold
Which model touches the tenant Inventory row with an owner and a purpose
Who can switch it off A named rollback
What was last tested The test record and the date

ISO 42001 for SaaS is the work of filling the evidence column before the questionnaire arrives.

ISO 42001 for SaaS on a single product usually sits in the ₹4 lakh to ₹8 lakh consulting band. Several customer-facing models push ISO 42001 for SaaS consulting into the ₹8 lakh to ₹15 lakh band. Both figures are 2026 India market ranges for one legal entity, not a Seven Step fee. The certification body sends its own invoice, often about ₹2 lakh to ₹8 lakh for Stage 1 plus Stage 2. That too is a market range.

Ask the quote PDF to split consulting, the certification body and your staff time. ISO 42001 for SaaS looks cheap when the third line is missing. A surveillance year is part of ISO 42001 for SaaS. Leaving it off the PDF does not take it off the three-year cost.

Book the scope before the Monday deadline

If the questionnaire is already in the inbox, book a SaaS readiness call. We will read the inventory, the bought copilots and the gaps a Stage 1 reviewer would mark. The read is not a certificate. Write through https://www.sevenstepconsulting.com/contact-us/

Questions people ask before they buy

Does a certificate win the US or EU deal?

No. ISO 42001 for SaaS gives the inventory and the evidence a buyer asks to see. The buyer still runs its own review. ISO 42001 does not create a presumption of conformity with the EU AI Act, and it does not by itself win the deal.

Should bought copilots sit on the inventory?

Yes, when staff use them on customer data. A vendor brand on the API does not take the row off your register. Record the data you send and the person who can turn the integration off.

Is an ISO 27001 certificate enough for the AI tab?

It covers information security. It does not list what the model may do. You still need an AI system inventory, an AI risk assessment, an AI impact assessment and a Statement of Applicability for Annex A of ISO/IEC 42001.

How fast can a small product firm be ready?

If the inventory is small and leadership shows up, the firm can be audit-ready for Stage 1 in about 90 days. That is not a certificate. Stage 2 comes after. Many builds take three to six months.

Who can issue the certificate?

A certification body issues it. A consultant does not. Check the AI management system scope on the NABCB or IAF directory before you sign. ISO 42001 for SaaS stays a consultancy project until that body completes Stage 2.

If the board wants the questionnaire answered from one file, book a SaaS readiness call. We will separate in-house models from bought tools and name the gaps. ISO 42001 for SaaS is the scope of that call, and the call does not issue a certificate. Use https://www.sevenstepconsulting.com/contact-us/