Blog

Last reviewed: 7 October 2026. This list is refreshed quarterly; provider details re-verified each cycle. Keyword data note: the last volume data for the head term “compliance as a service” (~250 MSV, KD 1) is stale, our tooling lapsed before this review, and is quoted for direction only, not treated as current. The live SERP…

A manual penetration test of a web application and its API typically costs between about €3,000 and €20,000 in Europe, £5,000 and £18,000 in the UK, and $5,000 and $30,000 in the US, depending on scope. Under most quotes sits day-rate maths: a fair day rate is around £1,000 to £1,500, so divide any quote…

ISO 27001 addresses information security management; ISO 42001 addresses AI management. They can work together, but using AI does not automatically mean you need both certificates. Start with your risks, actual customer requirements and the scope you need independently assessed. ISO 27001, ISO 42001. Your situation A sensible starting point Customers need assurance over information…

Yes, ISO 42001 can apply to organisations using third-party AI, not only those training models. Whether certification is worthwhile is a separate decision, based on your risks, obligations and assurance needs. A supplier’s certificate does not automatically cover your organisation’s use of its system. ISO 42001 explained. Reason to consider certification now Reason to assess…

No particular compliance platform is required for ISO 42001. Drata or Vanta can help you manage evidence and workflows, but buying software is not the same as implementing or certifying an AI management system. Decide whether the platform solves a real operating problem for your team. ISO 42001. Situation What to assess You already use…

You do not need a Data Protection Officer simply because you sell software or handle personal data. The decision depends on your processing activities, whether you are a public authority and any additional applicable law. A small company can need a DPO; a large private company is not automatically exempt or automatically required to appoint…

An ISO 27001 surveillance audit checks continued conformity during the certification cycle. Recertification assesses renewal for the next cycle. Your certificate’s expiry date is therefore not the only date to plan around: keep the external audit schedule, internal audit programme and corrective actions visible throughout the year. NQA certification process. Checkpoint Purpose Planning implication Initial…

There is no official GDPR certificate. No EU body issues one, no company can hold one, and any provider selling a “GDPR certified” badge is selling something the regulation does not recognise. What exists instead: approved certification schemes under Article 42 (Europrivacy is the first), ISO 27701 as the certifiable privacy management standard, and the evidence…

Target queries: “iso 42001 internal audit requirements” · “iso 42001 clause 9.2” · “who audits an AI management system” Last reviewed: 28 August 2026. This page is refreshed quarterly; the next scheduled review is November 2026. Volatile facts are date-stamped where they appear. The direct answer: ISO/IEC 42001:2023 clause 9.2 requires your organisation to run internal audits of its…

UK GDPR and EU GDPR are substantively near-identical, because UK GDPR is retained EU law. Comply with one properly and you are most of the way to the other. The differences that create real work are administrative: a second representative, second transfer contracts, a second regulator, an annual ICO fee and fines in a different…