A working system that operationalises the standard, integrates with the Institute's other systems, and runs on AICOB and AEIOR
ISO/IEC 42001 is the management system for the everyday running of AI in the organisation. It asks the organisation to establish, implement, maintain and continually improve an AI management system. Issues are worked through against the requirements of the standard. They are not parked until audit week.
The AI Assurance Institute's ISO/IEC 42001 AI Management System is that system in operation. It operationalises the standard. The clauses are not a reading list. They are the work: scope, leadership, planning, support, operation, performance evaluation and improvement, applied to named AI systems. Conformity with ISO/IEC 42001 is the result of running that work. The Institute does not certify the organisation. A certification body does. The system is built so the organisation can work toward that assessment, and so the same work can be sampled by a second party or a third party. It is not a tick-box exercise.
ISO/IEC 42001 states what must be achieved. It does not hand over the operating model. A pack of completed templates is not that model. An assessor looks at whether the system runs, who owns which duty, and what evidence the processes left.
Operationalising the standard means the requirements are turned into assigned work:
Templates, checklists and downloads can sit inside the system. They record work. They are not the AIMS.
The AI Assurance Institute's Platform is built as a hub with operational registers around it.
Gates sit on that line. Work does not advance because a form was filled. It advances when the assigned control has been completed and the record exists. The same foundation can carry ISO/IEC 42001 and, where the organisation also has a high-risk duty, the EU AI Act quality management work, without a second set of files.
The platform uses the AI Assurance Institute's Control Objectives for AI Systems (AICOB). AICOB is the operating model that turns governance outcomes into assigned processes, controls, measures and assurance. ISO/IEC 42001 lands on that model. A control objective says what has to be true. The control is the work that makes it true. The measure is how the organisation knows. Assurance is the sample of that work.
The work runs on the Institute's AEIOR process model: Act, Establish, Implement, Operate, Review.
That line is how ISO/IEC 42001 is operated without inventing a parallel factory. The standard's Plan-Do-Check-Act rhythm sits on AEIOR. AICOB is what the organisation is trying to achieve at each step. The platform is where the step is assigned, run and kept.
This is also the integrated configuration. ISO/IEC 42001 can run together with the organisation's other management systems, and with the Institute's other platforms, rather than as an island.
An organisation that already runs a quality, security or privacy management system does not start again. The AIMS takes the leadership, the document control, the competence records and the improvement loop that already exist, and adds the AI-specific work the standard requires: intended purpose, AI risk, the lifecycle, and the controls that are particular to a system that learns or that changes a decision. Integration is shared process and shared evidence. It is not a logo on a combined manual.
The same is true of the Institute's other systems:
The product name changes with the topic. The method does not. Fields are filled by the people who own the duty. The record stays with the system.
Organisations that must show conformity with ISO/IEC 42001, whether they are preparing for certification or running the system after it. Teams that need one working AIMS, not a checklist library. People who have to show an assessor how work was assigned, how it ran, and what it left behind. Organisations that want the AIMS integrated with the management systems and the Institute platforms they already run.
The AI Assurance Institute's ISO/IEC 42001 AI Management System is available on the Nextcloud platform. The processes are the same. The choice is the environment. Nextcloud is the option for organisations that want the AIMS inside a collaboration platform they control, and for organisations that will have to show the record to an assessor, a customer or another external party without exporting it into a mailbox.
Nextcloud is an open-source collaboration platform. It is available worldwide. Its reputation and its public-sector adoption are strongest in Europe, and it is less widely known outside Europe than the large commercial clouds. That is familiarity, not availability. A company anywhere can run it on its own infrastructure, or with a host, and take the same advantages.
Those advantages matter for a management system:
European public administration has already made that choice at scale. The German federal administration, French ministries, the Austrian federal ministry for economic affairs, the National Assembly of the Republic of Serbia, Dutch research and education infrastructure, and the European Commission are among the bodies that use Nextcloud when files have to stay under the organisation's control. Nextcloud Files has been awarded the French ANSSI CSPN security certification. Partners operate it inside environments certified to the German BSI IT-Grundschutz. An independent reference data protection impact assessment has been published. None of that makes a deployment automatically compliant. It is why regulated organisations treat Nextcloud as a platform they can defend.
The standalone platform remains available. Same AICOB controls. Same AEIOR process model. Same integration with the Institute's other systems. Nextcloud is the environment around them, for organisations that want it.
