Culture Amp secures ISO42001 for responsible AI governance

Culture Amp has received ISO42001 certification for its artificial intelligence management systems.

The ISO42001 standard is the first of its kind designed for artificial intelligence management systems and provides a framework for organisations to ensure that their deployment and governance of AI technologies adhere to international requirements. For companies, certification means an independent assessment by a third party, validating that the necessary measures are in place to manage AI responsibly.

Culture Amp's newly acquired status confirms the company's processes for developing, deploying, and overseeing its AI meet globally recognised benchmarks for accountability, transparency, and risk management.

The ISO42001 standard assists organisations in aligning AI use with ethical principles, transparency, fairness, accountability, and governance. It goes beyond internal policy by obliging the management system to meet externally verified criteria. This means not only that policies exist but are maintained and continually improved over time.

Caroline Rawlinson, Chief Financial and Operations Officer at Culture Amp, said:

"Earning ISO/IEC 42001 certification is not just a badge, it's a commitment we operationalise every day. It means that our AI practices are externally validated, and that we continue evolving them in a structured, ethical way."

The company's approach towards certification is rooted in its stated philosophy of integrating responsible AI practices across all aspects of its development cycle. This involves the specification of clear roles and oversight pathways, documentation and review for decision logic, as well as maintaining traceability regarding models and data sources. Human oversight and risk assessments are also fundamental to its protocols.

"By adhering to both the letter and spirit of ISO42001, Culture Amp ensures its AI systems operate with integrity, fairness, and resilience," a company spokesperson said.

For Culture Amp, the certification serves as evidence of its stated intention to build, monitor, and adapt its AI technologies within established accountability frameworks.

Samm MacLeod, Chief Information Security Officer at Culture Amp, explained the company's approach to responsibility:

"This achievement underscores how seriously we take responsibility for our customers, our people, and the broader community. We believe that AI must be trustworthy by design. ISO certification, giving our customers confidence that we proactively manage risks and protect their data with rigor and transparency."

MacLeod also highlighted that ISO42001 is aimed at assuring partners and clients about the governance of AI features:

"Our ISO42001 certification, provides clients and partners with assurance that its AI features and analytics are built to internationally recognised governance standards as well as confidence that any risks tied to AI (bias, privacy, fairness) and also ensures we are continuously evolving to stay ahead of emerging threats-delivering trust and resilience in every platform interaction."

The company has also pointed out the relevance of this certification as global regulations around AI continue to take shape. According to Rawlinson:

"As ISO 42001 helps organisations prepare for future regulatory frameworks our customers and partners can rest assured we have a foundation for evolving in tandem with emerging AI regulations, and they have a competitive differentiator in choosing a technology provider that blends innovation with integrity."

ISO42001 outlines a detailed framework that includes requirements not only for technical controls, but also for organisational mechanisms such as governance policies, escalation protocols, and documentation that support transparency and ongoing risk management. Accountability pathways and robust documentation processes are designed to enable organisations to demonstrate compliance if required by regulators or clients.

Globally, public and private organisations are increasingly seeking compliance with recognised standards as AI regulation is anticipated or introduced in different jurisdictions. Certification like ISO42001 adds a level of external scrutiny and offers an independent benchmark recognized across countries and industries.