ISO 42001 Implementation in 90 Days for Thai Manufacturers

For manufacturers in Thailand and ASEAN considering ISO 42001 implementation, the first question is not “How quickly can we get certified?” It is whether the company can explain which AI systems it uses, for what purpose, who is accountable, and how risks are controlled. This guide shows executives, IT, quality, audit and plant teams how to build an AI inventory, clear ownership, AI impact assessments and supplier evidence in 90 days. The approach covers generative AI, visual inspection, demand forecasting and predictive maintenance already in operation, without assuming that certification is required.

What ISO/IEC 42001 is—and what an AIMS should achieve

ISO/IEC 42001:2023 specifies requirements for an artificial intelligence management system, or AIMS, for organizations that develop, provide or use AI. It is not limited to model developers. A manufacturer that purchases a cloud AI service and applies it in production or administration can also use the standard. ISO’s official explanation highlights leadership, policies and objectives, AI risk management, data governance and lifecycle controls, transparency, evaluation and monitoring, and continual improvement.

The standard is neither a product-performance specification nor a one-size-fits-all checklist. It provides a management framework that an organization applies according to its context, stakeholders, use cases and potential impacts. Companies already operating ISO 9001 or ISO/IEC 27001 can connect familiar practices such as controlled documentation, supplier management, internal audit, management review and corrective action. Existing certification, however, does not remove the need to assess AI-specific issues such as output error, automation bias, data drift and human oversight.

ISO/IEC 42001 certification is voluntary. ISO develops standards; it does not certify companies. If an organization chooses certification, an independent certification body performs the audit. Claims such as “ISO-certified AI” or “ISO 42001 is legally mandatory” should therefore be avoided unless the exact contractual or legal basis is verified. Management should first assess customer requirements, tenders, group policy, regulatory exposure and business risk, and then decide whether third-party certification or an internal conformity assessment creates sufficient value.

Thailand has adopted the national standard มตช. 42001-2567, which the Thai Industrial Standards Institute records as published in the Royal Gazette on 17 July 2024. A Thai operation should consider the national standard alongside contracts and applicable requirements for personal data, employment, occupational safety, product quality and confidentiality. Implementing an AIMS does not automatically demonstrate compliance with every adjacent law.

Why Thai and ASEAN factories need an AI management system

Industrial AI rarely stays inside one IT application. A vision model can affect shipment quality; a demand forecast can change purchasing and inventory; predictive maintenance can influence a shutdown decision. If workers rely on AI-generated work instructions or translations, errors can affect quality and safety. Models, cloud platforms, cameras, sensors, MES, ERP and maintenance vendors may come from different suppliers, making responsibility difficult to trace.

Multi-country manufacturers frequently face gaps such as:

• headquarters buys an AI service while the Thai plant does not fully understand its terms;
• a proof of concept measures accuracy, but production drift and stop criteria remain undefined;
• personnel enter drawings, quotations or customer data into free public AI tools;
• a supplier updates a model without leaving an internal change or revalidation record;
• quality staff know that AI exists but cannot audit inputs, overrides or final human decisions; and
• one procedure is deployed across countries despite differences in language, operating practice and data obligations.

The practical value of ISO 42001 implementation is to turn these gaps from an “AI team problem” into managed business decisions. The test is not document volume. It is whether decisions to approve, change, monitor, suspend and retire AI can be explained and repeated.

A 90-day ISO 42001 implementation roadmap

Ninety days is not a promise of certification. Readiness depends on scope, organizational maturity, number of AI systems, technical remediation and certification-body availability. This roadmap is a practical period for management to define a scope and run a minimum auditable operating cycle.

Days 1–15: define scope and management accountability

Starting with “all AI worldwide” can make the project unmanageable. A useful first scope might be vision inspection at one Thai factory, or generative AI services used by one Thai legal entity. Record the included organization, locations, processes, AI systems, data, external services and exclusions on one page. If something is excluded, retain the reason and the impact analysis behind that decision.

Name the executive sponsor, AIMS manager, business owner, system owner, data owner, risk assessor and internal auditor. People may hold more than one role, but the process should not be designed around self-approval. For a visual-inspection system, production engineering may own the process while quality approves acceptance criteria, and security and privacy specialists review their respective risks.

Management should approve at least the AIMS objectives and scope, risk-acceptance principles, escalation route for serious incidents, and required people and budget. A statement that the company “promotes AI” is too abstract. Operational principles should state, for example, that safety-related automated decisions require human confirmation, customer secrets must not enter public AI services, and material changes require reassessment.

Days 16–30: create the AI inventory and uncover shadow AI

The AI inventory is the working index of the AIMS, not merely a software list. It should connect each system with responsibility, data, purpose, impact, supplier, change history and monitoring.

Do not rely on the IT asset register alone. Cross-check SaaS purchasing, expense claims, browser extensions, factory PCs, edge devices, inspection cameras and individually opened AI accounts. Instead of asking only “Do you use AI?”, ask whether a tool automatically classifies, predicts, generates text, assesses images or recommends actions.

Immediate blanket prohibition of newly discovered shadow AI may drive use underground. A controlled interim status can specify prohibited data, temporary approver, expiry date, logging and an approved alternative. Uses that can materially affect human safety, employment, customer rights, confidential information or shipment quality should be prioritized for restriction or suspension.

Days 31–45: perform AI impact and risk assessments

AI risk management extends beyond cybersecurity. It should address incorrect output, bias, inadequate explanation, automation bias, use beyond the original purpose, drift, poor data, supplier changes and inability to stop. The purpose of a risk register is not to generate a score. It must show who may be harmed, whether controls are adequate, and who accepts the residual risk.

ISO/IEC 42005:2025 provides guidance for AI system impact assessment. An assessment considers consequences for individuals, groups and society as well as organizational loss. For worker-video analytics, relevant questions include proportionality of monitoring, notice, access, retention and harm from false inference. For visual inspection, assess customer harm from missed defects, waste from false rejection, performance changes caused by lighting or materials, and workers over-trusting the model.

A focused 60–90 minute workshop per AI system can follow this sequence:

1. Define in one sentence the decision that AI supports or automates.
2. Identify affected people, products, processes, rights and contracts.
3. Describe normal, failure, misuse and unavailable-system scenarios.
4. Separate causes related to data, model, interface, people, equipment and suppliers.
5. Map preventive, detective, response and recovery controls.
6. Record residual risk, approver, deadline and monitoring measure.

If a numerical matrix is used, do not automate approval from the score alone. “Impact × likelihood” may help prioritize work, but a low-frequency scenario involving death, major injury or serious legal consequences should receive separate executive attention. Short scenarios that can be explained in Thai, English and the workers’ actual language are often more useful than a complex score.

Days 46–60: assemble supplier evidence and govern data

Buying an AI service does not transfer all accountability to the vendor. Evidence should be managed for procurement, implementation, changes and incidents. Review service specifications, permitted use, data use and deletion, hosting location, access control, subprocessors, model-change notification, performance information, incident notification, logs and exit handling.

A vendor statement that it “uses ethical AI” is not sufficient evidence. Verify how your own use case limits inputs, validates outputs and retains logs. Where a black-box service cannot disclose its internals, risk can still be reduced through acceptance tests, constrained outputs, human review, periodic evaluation, an alternative process and stop criteria. Record unavailable evidence as a supplier risk rather than silently treating it as complete.

Separate training data, evaluation data, production inputs, generated outputs and monitoring logs. Record source, rights, quality, representativeness, changes, retention, deletion and access. In factories using Thai, English, Japanese and Vietnamese, a model tested in only one language may not perform equally across sites. Preserve evaluation by language, factory, product and operating condition.

For practical controls around generative AI, see How to build a secure generative AI environment. When an AI agent can execute business actions, connect permissions, approval, logging and exception handling to the workflow, as explained in AI agent workflow governance in Thailand.

Days 61–75: operate monitoring, change and incident procedures

An AIMS does not work until the lifecycle is used. Connect requests, risk assessment, approval, release, monitoring, incidents, suspension and retirement. Define both the gate from PoC to production and the trigger from production back to suspension.

Monitoring should cover technical performance, business results and control effectiveness. For visual inspection, break “accuracy” into miss rate by defect class, false-reject rate, manual overrides, lighting, material lot and model version. For generative AI, possible measures include prohibited-data events, output correction rate, source-verification rate, reported hallucinations, unauthorized actions and training completion.

The incident procedure should identify who can stop the AI, which manual process takes over, which logs must be preserved, who receives a report and what the supplier must provide. Management should pre-approve the fallback and production impact so that operators do not conceal anomalies out of fear of stopping a line.

Change control must cover more than a new model version. A prompt, threshold, camera, light, material, interface, affected population, purpose, data connection or supplier term can trigger reassessment. A practical three-level process distinguishes document review, focused retesting and full impact reassessment according to materiality.

Days 76–90: close the loop with internal audit and management review

Select representative systems and verify that records match actual work. Do not limit the audit to the presence of forms. Ask users whether they know approval conditions; test whether logs exist; check whether supplier changes reached the inventory; and inspect overdue corrective action. Protect auditor independence so that people are not only auditing activities they designed and operate.

The management review should cover inventory size, high-impact systems, incidents, monitoring, complaints, supplier issues, corrective action, resource gaps and changes in regulation or customer requirements. Management then decides whether to continue, restrict, invest, suspend, expand the scope or prepare for third-party certification. Record decisions, owners and deadlines.

Day 90 should demonstrate that planning, operation, evaluation and improvement have occurred at least once—not declare certification readiness without evidence. If certification is pursued, ask candidate bodies directly about scope, required operating history, schedule and competence. ISO/IEC 42006:2025 contains requirements for bodies auditing and certifying AIMS and is relevant when evaluating that service. ISO/IEC 42003 should not be presented as a published implementation guide; the ISO catalogue currently lists related work under development.

Department responsibilities: make RACI operational

IT cannot determine business impact alone, while operating departments may lack the information-security, data and supplier view. Assign names for each system:

• executive sponsor: policy, scope, resources and serious-risk acceptance;
• AIMS manager: inventory, governance meetings, audits and improvement;
• business owner: intended use, human decision, procedures and outcomes;
• system owner: architecture, access, logs, changes, stop and recovery;
• data owner: lawful and appropriate use, quality, retention and access;
• quality and safety: product, worker and equipment impact and acceptance criteria;
• legal and compliance: contracts, privacy, labor, claims and regulation;
• procurement: supplier due diligence, evidence, notification and subprocessors;
• users: comply with conditions and report anomalies; and
• internal audit: independently assess conformity and effectiveness.

Naming one accountable person does not mean that person performs every task. It removes ambiguity for decisions such as stopping a shipment, suspending AI, approving an exception or accepting residual risk. Where Thailand and headquarters share responsibility, define immediate local authority and the conditions for escalation.

Keep the AI governance document set lean

A common failure is to create many template policies with no connection to work. Begin with a minimum integrated set:

1. AIMS scope, policy and objectives;
2. AI inventory and system cards;
3. impact and risk assessments;
4. request, approval, change, suspension and retirement workflow;
5. data and supplier evidence;
6. monitoring, incident and complaint records;
7. competence and training records; and
8. audit, corrective action and management-review records.

Reuse existing ISO 9001, ISO/IEC 27001, privacy, product-safety and procurement controls where appropriate. Add AI fields to supplier assessment and add model, data and prompt changes to change control. A single routed request is more useful than a larger document-number catalogue.

How ISO/IEC 42001 relates to NIST AI RMF, ISO/IEC 42005 and the EU AI Act

NIST AI RMF 1.0

NIST AI RMF 1.0 is a voluntary framework organized around Govern, Map, Measure and Manage. NIST is revising AI RMF 1.0 and published a critical-infrastructure profile concept note on 7 April 2026. Organizations should monitor the revision instead of copying the current material into fixed procedures. A practical combination is to use ISO/IEC 42001 for the management-system backbone and NIST resources to deepen risk scenarios and measurement. The two are complementary, not interchangeable.

ISO/IEC 42005 for AI impact assessment

ISO/IEC 42005:2025 provides guidance on AI system impact assessment. Treat assessment as a lifecycle activity, not a pre-launch form. Changes to purpose, population, data, environment or supplier should trigger a review. Connect findings to the inventory, risk treatment, acceptance testing, user information and monitoring.

EU AI Act Article 17

Article 17 of the EU AI Act requires providers of high-risk AI systems to establish a documented quality management system covering areas such as compliance strategy, design, development, testing, data management, records, accountability, post-market monitoring and corrective action. ISO/IEC 42001 certification is not the same as EU AI Act conformity. A company must separately determine its role, the classification of the AI system and the relevant connection to the EU market. A Thai operation may need analysis when supplying into an EU-related value chain, but extraterritorial application should not be asserted without examining the actual offering, contracts and legal facts.

Selecting a certification body or implementation partner

If certification is chosen, confirm the certification body’s AIMS competence, manufacturing and regional experience, language support, proposed scope, schedule and accreditation status. An implementation consultant should not promise an audit pass. Evaluate whether the team can understand factory AI and integrate controls into existing work.

Useful questions include:

• How will you investigate a multilingual Thai manufacturing site?
• How will you distinguish in-house AI, embedded AI and external SaaS?
• How will impact assessment connect to quality, safety and security?
• Which ISO 9001 or ISO/IEC 27001 controls can be reused?
• How do you handle limited evidence from a model supplier?
• How will internal-auditor competence and independence be developed?
• What operating assets remain useful if certification is deferred?

For a broader procurement view, read How to select an AI consulting company in Thailand. Confirm confidentiality, data transfer, subcontracting and any consultant use of generative AI before sharing evidence.

Estimating effort and cost

Cost depends less on headcount than on the number and diversity of AI systems, maturity of existing controls, availability of supplier evidence, languages, sites and whether certification is included. Compare proposals by work package: scoping, inventory, impact workshops, procedures and workflow, technical logging or access controls, training, internal audit, certification audit, translation, travel and annual operation.

Any estimate should label its assumptions. For example, assume 12 in-scope AI systems, an average of 6 person-hours per system for inventory validation and impact assessment, and 160 person-hours for common procedures, training and internal audit. The initial internal effort would be 12 systems × 6 person-hours + 160 person-hours = 232 person-hours. This is a planning assumption, not a market rate or standard benchmark. Additional work for high-impact validation, data cleanup, technical remediation, translation and certification should be estimated separately.

Common implementation failures

Working backward from an audit date before building the inventory

Templates cannot establish risk, ownership or monitoring if the actual AI population is unknown. Build the inventory in the first 30 days and select representative systems.

Applying the same control level to every AI system

Meeting summarization and shipment release do not have equal impacts. Scale review, approval and monitoring to impact, data and execution authority, while retaining the justification for low-risk classification.

Substituting supplier claims for the organization’s assessment

Third-party reports are useful but do not reflect your data, people and process. The deploying organization must define acceptance tests and operating conditions.

Explaining safety with average accuracy alone

A high average can hide missed critical defects or poor performance under specific conditions. Combine condition-specific measures, error consequences, human checks and stop criteria.

Treating one awareness course as competence

General users, business owners, developers, procurement and auditors need different capabilities. Record checks of understanding, practical exercises and refreshers.

FAQ on ISO 42001 implementation

What is ISO/IEC 42001?

It is an international standard specifying requirements for an AI management system used by organizations that develop, provide or use AI. It connects AI-specific risk and opportunity with policy, roles, operation, evaluation and improvement.

Is ISO 42001 certification mandatory for Thai companies?

Certification is voluntary, although a customer, tender or group policy may require it. Thailand has published มตช. 42001-2567 as a national standard. Legal and contractual requirements still require separate verification.

Does ISO certify companies?

No. ISO develops standards. Independent certification bodies perform certification audits when an organization elects that route.

How is an AI impact assessment different from a risk assessment?

Impact assessment considers consequences for people, groups, the organization and society. Risk assessment examines uncertain scenarios, likelihood, controls and residual risk. In practice, impact findings should feed risk treatment and monitoring.

Can we reuse ISO 9001 or ISO/IEC 27001 controls?

Yes. Document control, supplier management, audit and corrective action can be integrated. AI-specific inventory, impacts, human oversight, model and data change still need explicit treatment.

Can the initial scope cover only generative AI?

Yes, if the boundary is justified. Other AI systems with material business or human impact should not be ignored; record exclusions and a plan to expand.

Can certification be completed in 90 days?

This 90-day plan targets an operating foundation, not guaranteed certification. Readiness, findings and auditor availability determine the actual schedule.

Does ISO/IEC 42001 certification demonstrate EU AI Act compliance?

No. It may support organized evidence and quality management, but EU AI Act obligations require a separate assessment of the system and the organization’s legal role.

Conclusion: what should exist after 90 days

The most valuable outputs are not a certificate or a shelf of policies. They are an executive-visible AI inventory, named accountability, use-case impact assessments, supplier evidence, and real records of change, monitoring and suspension. Run one limited scope through internal audit and management review, and the organization retains practical AI governance whether it later seeks certification or not.

TOMAS TECH helps manufacturers connect ISO 42001 implementation with existing quality and information-security systems and with the actual AI, MES and IoT environment of Thai factories. You can contact us for an initial scope review, an AI inventory workshop or a pilot around one system—even before deciding whether certification is appropriate.

References and primary sources

• ISO, “ISO 42001 explained: What it is and why it matters”: https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html
• ISO, “ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system”: https://www.iso.org/standard/42001
• Thai Industrial Standards Institute, มตช. 42001-2567 (Royal Gazette publication: 17 July 2024): https://service.tisi.go.th/license/web/index.php?ifdr=159&r=site/viewnac
• ISO, “ISO/IEC 42005:2025 Artificial intelligence — AI system impact assessment”: https://www.iso.org/standard/42005
• NIST, “AI Risk Management Framework”: https://www.nist.gov/itl/ai-risk-management-framework
• EUR-Lex, Regulation (EU) 2024/1689, Article 17: https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng
• ISO/IEC JTC 1/SC 42 catalogue: https://www.iso.org/committee/6794475/x/catalogue/