Myth: ISO 42001 Is Only for Big Tech

Let us retire a myth: ISO 42001 is only for big tech companies with compliance departments the size of small towns.

The standard was written to scale. Nothing in it demands a particular company size, budget, or headcount. It demands a management system appropriate to your context — and a ten-person company's context is simply smaller.

In fact, small businesses have the most to gain. When you are small, one AI mistake can be existential: a biased hiring tool, a data mishap, a customer who loses trust. You cannot afford a compliance department, but you also cannot afford to wing it. A simple, honest AI management system — a short policy, a risk list, named owners, regular check-ins — costs little and protects everything.

I love small businesses, and here is what I tell them: you do not need the enterprise version. You need the principles, right-sized. Write the one-page policy. List your AI uses and risks on a single sheet. Review it quarterly over coffee. That is a management system. It counts.

Big tech does not own responsible AI. The standard belongs to anyone willing to run the loop: plan, do, check, act.

Start small. Stay honest. Scale the system as you scale the business.

I explain frameworks; I don't give legal counsel.