ISO/IEC 42001 at allclouds.pl. We Certified What We Were Already Doing
Most posts about certification begin with self-congratulation. This one begins with an admission: ISO/IEC 42001 did not change the way we work with AI. And that is the most important point in this article.
The First Bureau Veritas Certificate of Its Kind in Poland
Bureau Veritas Polska awarded allclouds.pl an ISO/IEC 42001:2023 certificate for its Artificial Intelligence Management System. We are the first organization to receive this certificate from Bureau Veritas in Poland — which says something about both us and the market: AI management is only now becoming a discipline that is audited rather than merely declared.
The scope of certification covers the work our business is built on: our TWIN:DESK and PROXY:AI products and the CDF (Cognitive Deployment Framework) implementation methodology. All of them operate within a documented, auditable AI management system — from strategy and risk assessment through model testing to monitoring and continual improvement.
What the Auditor Found
This brings us back to the admission in the opening paragraph. Before the standard appeared, the team's daily work was already governed by an internal AI-Operating & Working Agreement — a document known to everyone in the company and open to improvement proposals from every employee. It is based on three pillars that the auditor could verify in practice, not merely in a binder:
- The final decision belongs to a human. AI supports analysis, but verification and accountability remain with the employee — this is a control point embedded in processes, not a slogan.
- Full transparency of operation. The use of AI is documented and communicated to stakeholders. The client knows where AI is used in our work and who is accountable for it.
- Data sovereignty. Sensitive information remains within the organization's infrastructure — a principle we apply internally in the same way that we design it for clients.
Preparing for certification was therefore less about building something new and more about mapping existing practices to the standard's requirements. This distinction defines two types of certification: one in which a management system is created for an audit, and another in which the audit confirms a system that already exists. We know from our clients' experience what the first approach looks like. We wanted the second.
As Paweł Borowicz, Head of Enterprise Risk at Bureau Veritas Polska, observed, clients and regulators now expect documented AI management and clear accountability frameworks — and an organization that itself works intensively with AI every day is a natural candidate for demonstrating that it consciously manages the risks of this technology.
What This Changes for Our Clients
For a regulated-sector organization, a supplier's certificate is not a diploma for the wall — it shortens the organization's own audit work. When assessing an AI system provider, a bank's or infrastructure company's compliance team must answer the questions posed by the EU AI Act, DORA and NIS2: who controls the system lifecycle, how risks are managed and where the human sits in the decision loop. A certified AI management system at the supplier means that a significant part of these answers has already been confirmed by an independent body.
ISO/IEC 42001 also joins the Integrated Management System that we have maintained for years: ISO 9001, 27001, 27017, 27018, 22301 and 14001. We list them together not for decoration, but because they work together in practice — AI management without information security and business continuity management would be a facade.
Why This Matters at All
Implementing artificial intelligence is not solely a technological challenge — above all, it is a matter of control, methodology and compliance. Without the right approach, implementations stall: a project remains stuck as a pilot that no one is willing to approve for production. It is equally important that deployed AI gives its users sovereignty — independence from the supplier and the right to decide. Without it, it is difficult to speak of AI Business Solutions; what remains is renting someone else's service on someone else's terms.
The certificate does not solve these problems by itself. But it requires the things that do solve them: measurable processes, assigned responsibilities and a human present where the decision is made.
This is not another certificate for the gallery. It confirms that artificial intelligence management can — and must — be done methodically.
We thank Bureau Veritas Polska and the Enterprise Risk team for conducting the certification process professionally.