AI GOVERNANCE · ISO/IEC 42001 · PRODUCT

Make AI governance actionable.

Make AI governance actionable.

Product Leader and ISO/IEC 42001 Lead Implementer, I help organizations assess their AI governance against ISO/IEC 42001, identify governance and risk gaps, and turn them into practical remediation roadmaps that Product and Technology teams can actually implement.

ISO/IEC 42001 Lead Implementer · Product Leader · PhD

Evidence before checklists. Action before paperwork.

Evidence before checklists. Action before paperwork.

An AI governance assessment should do more than identify missing documentation. I look at how the AI system actually works, what evidence already exists, where material governance gaps remain and what should happen next.

01

Understand the AI system

Scope, intended use, stakeholders, architecture and lifecycle.

02

Review evidence

Policies, processes, risk documentation, product practices and technical evidence.

03

Assess alignment

Evaluate applicable ISO/IEC 42001 requirements and controls.

04

Identify material gaps

Separate missing documentation from genuine governance and operational weaknesses.

05

Build the roadmap

Prioritize remediation actions, ownership and evidence needed to close the gaps.

SERVICES

From assessment to action

Two connected ways to make AI governance practical: understand where your organization stands, then equip product teams to act on what the assessment reveals.

The Gap Assessment identifies where an organization stands; the Training equips product teams to close the gaps in practice.

SELECTED WORK

Selected AI Governance Assessments

Practical examples of how I assess different types of AI systems against ISO/IEC 42001, examining intended use, stakeholders and impacts, risk management, lifecycle evidence, monitoring and operational controls, and translate findings into actionable remediation.

CASE STUDY 01 · ANONYMIZED

User-Facing Conversational GenUI System

European B2B SaaS company

ISO/IEC 42001 – Gap Analysis: Target vs Current Maturity

Target — governance maturity target

Current — assessed maturity level

Scale: 0 (No processes) to 5 (Optimized processes)

5.02.65.01.25.01.65.02.35.02.15.01.95.02.25.01.85.02.05.01.5ISO/IEC 42001requirements(clauses 4–10)A.2 Policies relatedto AIA.3 InternalorganizationA.4 Resources for AIsystemsA.5 Assessingimpacts of AIsystemsA.6 AI system lifecycleA.7 Data for AIsystemsA.8 Information forinterested partiesof AI systemsA.9 Use of AIsystemsA.10 Third-party andcustomerrelationships

PRIORITY ACTIONS

Top remediation priorities

1

Define AIMS scope

Define and document the AIMS scope, including organizational, technological and operational boundaries and applicability.

Priority

Critical

Effort

Medium

2

Formalize AIMS roles & authorities

Define, assign, document and communicate AIMS roles, responsibilities and authorities, including responsibility for ISO 42001 conformity and AIMS performance reporting.

Priority

High

Effort

Medium

3

Establish SoA process

Establish a formal AI control-selection and Statement of Applicability process, including Annex A comparison, additional controls and inclusion/exclusion justifications.

Priority

High

Effort

Medium

01 / 02

CASE STUDY 01 · ANONYMIZED

User-Facing Conversational GenUI System

European B2B SaaS company

ISO/IEC 42001 – Gap Analysis: Target vs Current Maturity

Target — governance maturity target

Current — assessed maturity level

Scale: 0 (No processes) to 5 (Optimized processes)

5.02.65.01.25.01.65.02.35.02.15.01.95.02.25.01.85.02.05.01.5ISO/IEC 42001requirements(clauses 4–10)A.2 Policies relatedto AIA.3 InternalorganizationA.4 Resources for AIsystemsA.5 Assessingimpacts of AIsystemsA.6 AI system lifecycleA.7 Data for AIsystemsA.8 Information forinterested partiesof AI systemsA.9 Use of AIsystemsA.10 Third-party andcustomerrelationships

PRIORITY ACTIONS

Top remediation priorities

1

Define AIMS scope

Define and document the AIMS scope, including organizational, technological and operational boundaries and applicability.

Priority

Critical

Effort

Medium

2

Formalize AIMS roles & authorities

Define, assign, document and communicate AIMS roles, responsibilities and authorities, including responsibility for ISO 42001 conformity and AIMS performance reporting.

Priority

High

Effort

Medium

3

Establish SoA process

Establish a formal AI control-selection and Statement of Applicability process, including Annex A comparison, additional controls and inclusion/exclusion justifications.

Priority

High

Effort

Medium

01 / 02

AI GOVERNANCE TRAINING

AI Governance Training

Practical training that helps product teams turn AI Governance principles into everyday working practice, grounded in ISO/IEC 42001.

Foundations of AI Governance & Responsible AI

  • AI Governance and Responsible AI principles, and why they matter for product teams

  • Key AI risks: bias, reliability, transparency, privacy and safety

  • Roles, responsibilities and accountability; how governance, regulatory compliance and business value relate

AI Governance Across the Product Lifecycle

  • Identifying risks and assessing impacts as early as Product Discovery

  • Defining guardrails and human oversight as product decisions

  • Post-release monitoring: assessing real user impact beyond AI performance metrics alone, managing feedback and improvement

Tools & Practices for Product Teams

  • AI System Cards to document the characteristics, purpose, limitations and risks

  • AI Risk Registers and Impact Assessments to identify, evaluate and manage risks and impacts

  • Governance checkpoints, AI Governance Assessment, gap analysis, and remediation roadmap

Get in touch to discuss training for your team

ABOUT

AI governance with a Product mindset

AI governance with a Product mindset

I’m Anastasia Lidia Scotto, a Product Leader and ISO/IEC 42001 Lead Implementer with more than a decade of experience building and delivering digital products across AI, SaaS, education and e-commerce.

My background in Product means I approach AI governance from the perspective of how systems are actually designed, developed, measured and operated, not only how requirements are documented.

Before moving into Product, I trained as a scientist and completed a PhD. That combination of scientific thinking, product execution and AI governance shapes the way I assess AI systems: evidence-driven, structured and focused on practical outcomes.

LET’S TALK

Want to understand how ready your AI governance really is?

Want to understand how ready your AI governance really is?

Want to understand how ready your AI governance really is?

I work with organizations that want a practical view of where they stand, which gaps matter most and what to address next.

I work with organizations that want a practical view of where they stand, which gaps matter most and what to address next.

Based in Italy · Working with European organizations

Anastasia Lidia Scotto

AI Governance · ISO/IEC 42001 · Product

© 2026 Anastasia Lidia Scotto. All rights reserved.