We help organizations implement AI management systems, interpret regulatory obligations and test how AI systems actually perform. The work runs from policy and control design through technical assessment, documentation and audit preparation.
A governance document may describe the right process and still tell you little about what happens in production. We examine how requirements are assigned, what evidence is retained, how exceptions are handled and whether testing supports the claims being made about the system.
Three verbs. That is the entirety of what serious GRC work requires and what most advisors only do one of. We do all three, at the control level, with documentation that holds up when a regulator or certification body arrives.
Gap analysis against ISO 42001, EU AI Act, DORA, CMMC or NY LL144. We map your current posture, identify what's missing, and produce a prioritised remediation roadmap not a list of things you already knew.
We build the controls, policies, and procedures that the standard requires. Implementation means documentation that works, not a policy document filed and forgotten. We operate at the control level, not the summary level.
Our team carries Certified Lead Auditor credentials across ISO 42001, 27001 and 27701. We conduct internal audits, prepare organisations for certification body assessment, and provide independent verification of AI systems.
Two principal areas sit at the center of our AI practice. We also work with sector-specific security and algorithmic accountability obligations.
ISO/IEC 42001 provides a management-system framework for organizations that develop, provide or use AI. We help define responsibilities, establish risk and impact assessment processes, select and implement controls, and assemble evidence that those processes are operating.
We start with system classification and the obligations attached to the organization's role. For providers of high-risk AI systems, we work with technical documentation, risk management, human oversight, post-market monitoring and quality-management requirements. EN 18286:2026 provides a harmonized route for the Article 17 QMS requirements it covers.
For financial entities within DORA's scope, we examine ICT risk management, incident processes, operational resilience testing, third-party oversight and the Register of Information. Work is grounded in the regulatory requirements and the operational records needed to demonstrate how they are met.
DORA services →CMMC assessments depend on the information a contractor handles and the requirements in its solicitations and contracts. We support the control inventory, evidence collection, gap remediation and assessment preparation around applicable NIST SP 800-171 and CMMC requirements.
CMMC services →For covered hiring and promotion tools, we assess audit scope, data suitability, selection and scoring outcomes, impact ratios, publication requirements and required notices. A usable bias audit requires a defensible method, not just a summary score.
LL144 enquiry → View a selection-rate analysis example →Documentation can establish what an AI system is supposed to do. Testing examines what it does under specified conditions.
Our technical assessments may include output evaluation, subgroup analysis, model-behavior testing, dataset review, change and version tracking, and examination of the evidence supporting system performance claims. We report methods, observed results, limitations and actions needed to investigate or correct a finding.
Organisations that achieve all three of these ISO certifications have a strong position against current and emerging data, privacy, and AI regulations globally. We implement and audit across all three.
Extension to ISO 27001 for privacy information management. Maps directly to GDPR obligations and demonstrates structured privacy governance to regulators and partners.
The internationally recognised information security management system standard. Foundation for DORA ICT requirements, CMMC alignment, and supply chain trust.
The first international AI management system standard. The explicit foundation of EN 18286:2026 and the EU AI Act's harmonized compliance architecture.
An assessment should make it possible to trace a claim to a requirement, a test, a record or a finding. These two examples show the level of detail we regard as useful.
Jump to: ISO/IEC 42001 gap assessment · Algorithmic bias analysis
| Ref | Area assessed | Evidence issue | Why it matters | Corrective action / closure evidence |
|---|---|---|---|---|
| QMS-01 | System inventory | The workflow is listed as one application, but its model dependency, retrieval source and human approval point are not separately documented. | Owners cannot reliably assess the consequences of a supplier-model change or a changed data source. | Update the system inventory with components, dependencies, accountable owners, data flows and review triggers. |
| QMS-02 | Risk and impact assessment | Accuracy is assessed, but foreseeable impacts of unsupported answers, exposure of sensitive content and third-party model changes have no explicit acceptance criteria. | A risk register may exist without guiding actual release decisions. | Record impact scenarios, evaluation criteria, accountable approvers, treatment decisions and acceptance evidence. |
| QMS-03 | Change management | Releases require product-owner sign-off, but no documented re-evaluation thresholds exist for prompt, retrieval or model changes. | A sign-off alone does not show that material changes were tested. | Define change classes, required regression tests, approvals and retention of test results. |
| QMS-04 | Evidence traceability | Policies, test records and exception decisions are dispersed across documents and tickets. | An assessor may be unable to follow a requirement through to operating evidence. | Establish a requirements-to-control-to-evidence index with versioned records and accountable owners. |
| Requirement / question | Responsible role | Evidence to retain | Pass condition |
|---|---|---|---|
| Who approves AI risk acceptance? | Named risk owner | Signed risk decisions, criteria and exception log | Authority and decision criteria documented; material exceptions escalated |
| What happens when the underlying model changes? | System owner | Supplier change log, impact assessment, regression-test record | Defined change classification and required tests completed before release |
| How is human oversight performed? | Operations lead | Reviewer instructions, sampled approval logs, escalation records | Reviewers can intervene and exceptions are traceable |
| How are findings closed? | Control owner | Corrective-action plan, evidence of implementation, effectiveness check | Closure is supported by re-tested or independently reviewed evidence |
What the example demonstrates: A management-system assessment is not a checklist of policies. It tests whether responsibility, risk decisions, changes and records connect to the actual AI workflow.
Selection rate = number selected ÷ number evaluated in the category.
Impact ratio = category selection rate ÷ highest selection rate in the relevant comparison.
Analyze sex, race/ethnicity and intersectional groups as applicable; separately account for missing/unknown data.
| Category | Evaluated | Selected | Selection rate | Impact ratio |
|---|---|---|---|---|
| Men | 250 | 125 | 50.0% | 1.00 |
| Women | 250 | 100 | 40.0% | 0.80 |
| Total | 500 | 225 | 45.0% |
| Category | Evaluated | Selected | Selection rate | Impact ratio |
|---|---|---|---|---|
| White | 200 | 110 | 55.0% | 1.00 |
| Black | 120 | 48 | 40.0% | 0.73 |
| Hispanic / Latino | 100 | 40 | 40.0% | 0.73 |
| Asian | 70 | 26 | 37.1% | 0.68 |
| Unknown | 10 | 1 | 10.0% | Not assessed |
| Total | 500 | 225 | 45.0% |
The highest observed selection rate among the known intersectional groups is 60.0% for White men. The figures below use that rate as the denominator for impact ratios.
| Category | Evaluated | Selected | Selection rate | Impact ratio |
|---|---|---|---|---|
| White men | 110 | 66 | 60.0% | 1.00 |
| White women | 90 | 44 | 48.9% | 0.81 |
| Black men | 60 | 30 | 50.0% | 0.83 |
| Black women | 60 | 18 | 30.0% | 0.50 |
| Hispanic / Latino men | 50 | 20 | 40.0% | 0.67 |
| Hispanic / Latino women | 50 | 20 | 40.0% | 0.67 |
| Asian men | 25 | 9 | 36.0% | 0.60 |
| Asian women | 45 | 17 | 37.8% | 0.63 |
Ten records have unknown race/ethnicity (five men and five women), with one selection overall. These are retained in the population reconciliation and reported separately rather than silently discarded.
What the example demonstrates: A defensible technical assessment shows the denominators, methods, calculations and limits of inference not just a pass/fail badge.
Identify systems, intended uses, affected parties, organizational roles, applicable requirements and the evidence already available. Document exclusions rather than leaving them implicit.
Map requirements to processes, owners and retained records. Distinguish documented policy from evidence that a process has operated.
Perform technical assessment or sample-based verification appropriate to the system and the engagement. Record methodology, results and limitations so the work can be reproduced or challenged.
Provide a prioritized register, evidence index and specific conditions for closing findings. The aim is to make subsequent review more efficient, not produce a report that no one uses.
No. ISO/IEC 42001 addresses an AI management system; it does not automatically demonstrate conformity with every applicable AI Act obligation. EN 18286:2026 addresses the EU AI Act's Article 17 quality-management requirements and, as a cited harmonized standard, supports presumption of conformity only for the requirements it covers.
A gap assessment establishes the distance between current practices and a defined set of requirements. An audit evaluates evidence against specified criteria using a documented methodology. Some assignments combine both, but their purpose, independence conditions and conclusions should not be confused.
At minimum, we need to understand the system's intended use, its role in decisions, the version or configuration under review, the available test data and the relevant criteria. If those elements are missing, establishing them is usually the first task.
Across the United States, state legislatures are establishing formal frameworks for independent AI verification third-party organisations authorised to assess AI systems for risk, bias, and regulatory conformity. California's SB 813 created the first state-level Independent Verification Organisation designation. Similar frameworks are being watched and debated in other jurisdictions.
MeasurementPros is tracking these developments closely. Our credentials, our technical depth in AI governance, and our existing audit practice across ISO 42001, NY Local Law 144, and the EU AI Act put us in a natural position as these frameworks mature. We are building toward independent verification capability the infrastructure, the independence standards, the assessment methodology so that when designation pathways open, we are ready. If you are a business that will need independent AI verification as these requirements take shape, we are worth talking to now.
Our team operates across GRC, analytics, and AI governance every day. When you engage MeasurementPros, you work directly with the people who have the credentials not a junior consultant supervised from a distance.
An expert data wrangler with a passion for client performance, John has spent decades solving quantitative business problems and advising performance-driven organisations on implementation and strategy. BS, Massachusetts Institute of Technology.
Leah leads the effort to make sure clients see benefits fast. Based in Austin, she works across verticals and ensures the client journey is smooth, clear, and results-driven.
Scott lives for creating quantifiable value by uncovering and presenting actionable insights that empower clients to make better decisions faster and more accurately. MBA, F.W. Olin School of Business at Babson College. BS, University of New Hampshire.
Mira assists with all aspects of delivery from deep dives into client data to setting up and monitoring complex analytics accounts. A master of many quantitative disciplines.
Michal works within our Analytics Operations centre, connecting clients with solutions on a timely and often urgent basis. Deeply schooled in the architectures of ecommerce and direct response datastreams.
A specific system, a regulation, an upcoming audit or a set of unresolved control questions is enough to begin. We can help define the boundary of the work and the evidence needed.
Please do not send confidential source data, credentials or regulated personal information through a general inquiry form.