Skip to content
EDWartens UK

Free course · AI and machine learning

ISO 42001 and AI Governance

The standard customers have started asking for by name: what an AI management system is, ISO/IEC 42001 clause by clause from context and leadership through the clause 6.1.2 risk assessment and the clause 6.1.4 impact assessment to documented information, the Annex A controls on policy, roles, resources, lifecycle, data, use and third parties, operation, internal audit, management review and certification, the NIST AI RMF and the OECD principles, training data and intellectual property, and the EU AI Act obligations a supplier is asked to evidence.

See the modules

Free to learn. Verifiable certificate £19 when you pass the final exam (optional, VAT included).

Level
Intermediate
Modules
13
Video
9 hours
Price
Free

Outcome

What you will be able to do

Scope an AIMS and write an AI policy top management can sign; build an AI system inventory that finds the entries nobody registered; run the clause 6.1.2 risk assessment against criteria you defined before any scoring, and record who accepted the residual risk; complete the clause 6.1.4 AI system impact assessment on a system you already run; map the Annex A controls to what your organisation already does and hold the statement of applicability; assemble the documented information an auditor asks for first; and place a system in the correct EU AI Act risk tier and operator role.

  • Scope an AIMS and write an AI policy that top management can sign and staff can follow
  • Build an AI system inventory that turns up the tools nobody registered
  • Run the clause 6.1.2 risk assessment against criteria set before any scoring, in both directions of risk
  • Complete a clause 6.1.4 impact assessment for the people an AI system affects
  • Map the Annex A controls to what you already do, and hold the statement of applicability
  • Run operation, internal audit and management review, correct nonconformities, and prepare for certification (clauses 8 to 10)
  • Place a system in the correct EU AI Act risk tier and name the operator role you hold

Software

None required. A spreadsheet is enough for the AI system inventory, the risk register and the impact assessment.

Hardware

None.

Syllabus

13 modules

Each module has video lessons, notes and a short quiz. The final exam closes the course.

  1. 1AI governance: principles, trustworthy AI and the NIST AI RMF4 lessons
  2. 2ISO/IEC 42001: the standard and the AI management system4 lessons
  3. 3Clause 4 and clause 5: scope, leadership and the AI policy4 lessons
  4. 4Roles, resources and the AI stack you have to govern4 lessons
  5. 5Clause 6.1.1: planning, risks and opportunities4 lessons
  6. 6Clause 6.1.2 and 6.1.3: AI risk assessment and risk treatment4 lessons
  7. 7Clause 6.1.4: the AI system impact assessment4 lessonsLab
  8. 8Clause 7: support, documented information and transparency4 lessons
  9. 9Annex A in operation: lifecycle, data, use and interested parties4 lessonsLab
  10. 10Training data, intellectual property and third-party AI4 lessons
  11. 11The EU AI Act: risk tiers, operator roles, deployer duties and penalties8 lessonsLab
  12. 12Clauses 8, 9 and 10: operation, audit, management review, improvement and certification5 lessons
  13. 13Final assessment0 lessons

How it works

How this course works

  1. Watch the video lessonsOne module at a time, at your own pace.
  2. Take the module quizA short quiz at the end of each module shows what stuck.
  3. Keep your notesWrite in My notes beside each module and ask the trainer if you are stuck.
  4. Practise in the labOptionalTry a task from the module in the EDWartens Lab, in your browser.
  5. Sit the final examPass it once you have been through the modules.
  6. Certificate, if you want oneOptionalPaid, and only after you pass. Anyone can check it online.

EDWartens Lab

Practise this in the EDWartens Lab

See what an impact assessment asks about, by running a real fairness check on a model and removing personal data from a ticket export.

Works alongside ISO 42001 and AI Governance. The Lab is ai for industry practice in your browser: no install, no hardware, free to use. Sign in as a learner and it opens with your account.

Open the free lab See the Lab
AI for industry: Build AI models.

Levels to try with this course

Optional. Skip it whenever you like: it never blocks your progress or your certificate.

Why practise in a lab

Technical work is judged on what you can do: wiring, commissioning, finding a fault. Doing a task yourself teaches more than watching it a second time, and a lab lets you try it safely before you meet real equipment. It does not replace working on real hardware.

  • Practise safely, so a mistake costs nothing.
  • The lab checks your work like a site test, so you know when it is right.
  • Free, in your browser, with nothing to install.

Certificate

An optional certificate when you pass

Learning is free. Pass the final exam and you can have a certificate for £19, including VAT, with a number employers can check online. It records that you completed a free online course; it is not a regulated qualification or a CPD certificate.

  • Your name, the course, its study time and your final exam score
  • A unique certificate number and a QR code to its verification page
  • Issued by Wartens Ltd; add it to your LinkedIn profile in one click
  • Pay now or after you pass: it is issued the moment you pass the final

How the certificate works

Sample certificate for ISO 42001 and AI Governance

Credits

Who made the lessons

The video lessons belong to their creators. EDWartens wrote the study plan, notes, quizzes and the final exam.

  • Dr. David, Privacy & AI Educator

    the AIGP certification masterclass lessons used for the framework layer: governance principles, trustworthy AI, the OECD principles, the NIST AI RMF, risk management, standing up a governance body, the AI tech stack, intellectual property and web scraping, and the EU AI Act tiers, operators and enforcement

  • Hemang Doshi

    the ISO/IEC 42001 implementation lectures that give the course its clause spine, from clause 4 to clause 7.5, including 6.1.2 risk assessment, 6.1.3 risk treatment and 6.1.4 impact assessment

  • risk3sixty

    the ISO Bytes walkthroughs of the Annex A controls: AI policy, AI roles, resources, impact assessment, the AI system lifecycle, data, information for interested parties, use, and third-party and customer relationships

Questions

About this course

Who is this course for?
Quality and internal-audit staff who already run ISO 9001, IATF 16949 or ISO 27001 and are being asked to add AI, and engineers in plants, GCCs and IT services firms who have shipped a model that a customer's auditor now wants to see governed. IT services firms and global technology centres were among the first organisations certified to ISO 42001, and they recruit AI governance analysts and AI auditors out of exactly these roles.
Does this make me an AIGP or an ISO 42001 lead auditor?
No, and the page will never say otherwise. The IAPP AI Governance Professional certification and the ISO/IEC 42001 lead implementer and lead auditor qualifications are paid, externally examined credentials awarded by those bodies, and this course is neither of them. The lessons here come from AIGP masterclass material and from AI governance practitioners, so the body of knowledge overlaps closely, but what you finish with is an EDWartens Certificate of Completion. Employers who ask for a lead auditor certificate will still ask for it, and classroom lead implementer or lead auditor training is a paid, multi-day course that typically costs from several hundred to a few thousand US dollars.
What do I need before this course?
No coding and no experience of building AI systems. Time inside any management system helps a great deal, because clauses 4 to 10 will already look familiar; if you have never worked in one, the first two modules build that vocabulary before the clause work starts.
Do I need to buy a copy of ISO/IEC 42001?
Not to complete the course. The modules teach the clause structure and what each clause asks an organisation to produce, using freely available lessons. The standard itself is a copyrighted document sold by ISO and by national standards bodies, and this course does not reproduce its text. Any organisation actually implementing an AIMS should buy a copy.
What are the practice tasks?
Each module ends with a task on a system you can see: an AI system inventory, six risk statements scored against your own criteria, a one-page clause 6.1.4 impact assessment, a document gap list marked exists, uncontrolled or missing, a lifecycle record reconstructed backwards, and an EU AI Act tier and operator-role call for three systems. If your organisation builds nothing, run all of them against a bought-in tool your team already uses, such as a chatbot or a coding copilot.
Is the course really free?
Yes. Every module, practice task and assessment. You create an account so your progress is saved and the assessments can be marked. The certificate is the only paid item, and only if you want it.
What certificate do I get?
An EDWartens Certificate of Completion, issued when you have finished every module and passed the final assessment at 60 per cent, with a verification code anyone can check. It is not a vendor credential, not an accredited certification, and is never described as one.
Who made the video lessons?
The creators named in the Credits block at the foot of this page, on their own YouTube channels. EDWartens did not make the videos and the creators are not affiliated with EDWartens. What EDWartens wrote is the study plan, the notes, the practice tasks and the assessments.

The Professional Module is five live days of Siemens PLC, HMI and SCADA with an instructor, then a resume session and a CPD certificate.

See the Professional Module