Responsible AI in practice: Lessons from our ISO 42001 journey

As AI adoption accelerates across assessment, organizations face growing pressure to demonstrate that innovation is matched by robust governance.

In this article, Becca Murdoch, Chief Information Officer at Surpass, shares how the company became the first assessment technology vendor to achieve ISO/IEC 42001 certification, a key way to demonstrate that AI innovation is being implemented transparently and with appropriate safeguards – and offers practical lessons for others beginning the journey.

As AI becomes increasingly embedded in assessment, organizations are being asked an important question: how can you demonstrate that AI is being used responsibly, ethically and with appropriate oversight?

Earlier this year, Surpass Assessment became the first vendor in the assessment industry to achieve ISO/IEC 42001 certification, the international standard for Artificial Intelligence Management Systems.

ISO/IEC 42001 is the world’s first international standard for Artificial Intelligence Management Systems (AIMS), providing a structured framework for the governance, oversight and risk management of AI technologies. The certification is awarded following an independent third-party audit that verifies an organization has established effective controls, policies and processes to manage AI responsibly.

For assessment organizations, where trust, fairness, validity and data integrity are paramount, certification demonstrates that appropriate controls, risk management processes and oversight are in place to address issues such as fairness, transparency, bias, safety, and data integrity. It provides customers, regulators, and stakeholders with assurance that AI innovation is being managed within a structured, accountable framework built on trust and continuous improvement.

According to Becca Murdoch, Chief Information Officer at Surpass, who led the certification program, the decision was driven by a desire to strengthen trust.

“For us, certification was not about claiming perfection. Rather, it was about providing independent assurance that our approach to AI governance is structured, transparent and based on recognised best practice.”

Becca Murdoch, Chief Information Officer

“We wanted to objectively demonstrate to clients that we’re using AI ethically, managing associated risks systematically, and that we have appropriate controls and oversight in place. Independent certification provides an additional layer of confidence and accountability.”

While the certification itself was achieved in just seven months, Becca is keen to point out that the real journey started much earlier.

Surpass Assessment’s AI governance program began more than three years earlier with an AI policy, AI objectives and the creation of an AI Community Advisory Board. “By the time we pursued certification, many of the foundations were already in place.”

Another major advantage was Surpass’s long-standing ISO 27001 certification.
“The standards share a common structure, so we weren’t building a completely new management system. We were extending existing risk management, audit and governance processes to include AI-specific considerations.”

Two areas became particularly important. The first was supplier governance. As an AI provider that integrates third-party AI technologies rather than developing foundation models, much of Surpass’s AI risk sits within its supply chain. Enhanced supplier reviews examined areas such as governance practices, training approaches and incident management.

The second introduced an AI Readiness Assessment to evaluate new AI-enabled services before they go live.

For organizations considering ISO 42001, Becca offers three pieces of advice:

Don’t start from scratch if you don’t have to. Many organizations already have governance processes that can be adapted.
Focus on where your AI risk actually sits. Your priorities may be very different depending on whether you’re developing, deploying or providing AI systems.
Expect evolution rather than perfection. AI is changing rapidly, and the standard is designed around continuous improvement, not a one-time exercise.

Ultimately, says Becca:

“…the greatest value has not been the certificate itself, but the framework it provides for ongoing governance. In a sector where trust, fairness and validity are paramount, demonstrating responsible AI practices is becoming as important as the technology itself.”