Opens in a new tab
October 13, 2026

Beyond the hype: A chief legal officer’s guide to ISO 42001 & AI risk

author photo

Virginia Llewellyn

Chief Legal & Administrative Officer

Every legal and compliance team evaluating AI vendor platforms faces the same tension: your product teams want to move fast, but your risk tolerance demands caution. Between privacy concerns, hallucination risks, and incoming enforcement from the EU AI Act, modern enterprises need a framework that enables safe innovation without taking on unmitigated exposure.

Today, I’m proud to share that following an independent audit by A-LIGN, Airship has officially achieved ISO 42001 certification—the global benchmark for Artificial Intelligence Management Systems (AIMS), 

Why we prioritized ISO 42001  

Many software vendors rely on self-reported policies when discussing AI safety. As a lawyer, I know those promises don’t hold up during a security review or regulatory audit. ISO 42001 is different: it requires continuous, third-party proof that AI governance is embedded directly into how software is designed, tested, and maintained.

What this means for legal, compliance and procurement teams

I know the first question your team will ask is what, exactly, the auditor examined. Our certification followed a multi-stage external audit that tested both the design of our AI management system and evidence that its controls operate in practice. The certification is maintained through annual surveillance audits and full recertification every three years, so the assurance is ongoing.

In practical terms, the certification gives your team third-party evidence that Airship has implemented and operates:

  • Accountable AI Governance: Defined leadership accountability, cross-functional oversight through our AI Advisory Committee, and repeatable, scalable AI governance procedures, including governance of the third-party AI models integrated into our platform.
  • AI Risk Management: AI risk and impact assessments are conducted on Airship AI systems to identify, assess, treat, and monitor AI risks throughout the AI system life cycle.
  • Data Governance: Robust controls over what data is made available for our AI systems during development and in production, with customer data protections built in by design.
  • Life Cycle and Operational Controls: Ongoing product testing and monitoring from design through decommissioning.
  • Continual Improvement: Internal evaluations and customer feedback drive ongoing improvements to both our AI products and our governance program.

We take a thoughtful approach to defining our AI systems. Our governance doesn’t stop at the underlying technology; it extends to how customers deploy AI capabilities through our platform and how end users experience the results. For your business teams, the result is an AI partner whose governance has already been vetted by an independent auditor—meaning less bespoke due diligence and a faster path to putting AI to work.

Built-in guardrails for real-world execution

A policy is only as good as the technology that enforces it. ISO 42001 validates the management process, but Airship complements that framework with native, product-level safeguards designed to protect your brand in daily execution:

  • Strict Data Privacy & Isolation: Your data remains yours. Personal and end-user data are never used to train or fine-tune public AI models.
  • Brand Protection: Content generation is tethered to compliance controls and brand parameters designed to reduce hallucinations and unvetted messaging.
  • Transparent and Explainable AI: AI-powered features are clearly labeled throughout the platform, supported by detailed documentation explaining how each capability works.
  • Human-Guided Workflows: Role-based access controls and built-in approval queues provide a clean separation between content creation and sign-off, helping prevent unauthorized content from going live.

For legal and security teams, these safeguards mean you don’t have to manually audit every single AI interaction. The platform gives you the controls to apply your governance policy consistently.

Accelerating procurement & regulatory readiness

If you’ve led security reviews or legal evaluations for software purchases recently, you know that AI governance has quickly become a major bottleneck in procurement. Security teams are rightly asking tougher questions, and evaluation cycles are stretching longer.

Because ISO 42001 aligns closely with other leading AI governance frameworks, including the NIST AI Risk Management Framework and supports efforts to meet obligations under the EU AI Act, it provides immediate clarity during procurement:

  • Reduces Procurement Friction: ISO 42001 acts as a recognized, independently audited stamp of trust, helping shorten security vendor compliance reviews.
  • Supports Regulated Vendor Oversight: For brands in financial services, healthcare, telecommunications, and insurance, ISO 42001 provides independent evidence to support the  strict third-party oversight and algorithmic fairness expectations your industry faces.
  • Future-Proofs Your Tech Stack: Paired with our alignment with evolving AI regulations, including the EU AI Act, this certification gives you a durable governance foundation  as global AI laws take effect.

Setting the standard together

Achieving ISO 42001 certification reflects Airship’s foundational commitment to operating as a responsible AI pioneer and empowering our customers to do the same.

Innovating with AI shouldn’t require taking on uncalculated legal risk. With ISO 42001 certification covering the AI capabilities we provide in the  Airship Experience Platform, your teams get the green light to build deeply personalized, high-impact customer journeys with  confidence.

To review our compliance standards, documentation, and trust capabilities, or to request a copy of our ISO 42001 certificate, visit the Airship Trust Center.