Free Assessment

Emma AI Achieves ISO 27001 Compliance

  • October 24, 2025

Product

ISO 27001

Industry

Health Tech / Artificial Intelligence

Company size

2 – 10 employees

Location

Southend-on-Sea, UK

Partner

Tempo Audits

emma-iso27001-certification-axipro

Share This Post

Introduction

In health and social care, trust isn’t optional; it’s everything. Sensitive data flows through every interaction, from patient assessments to daily visit notes. That’s why Emma AI, a fast-growing health tech company based in the UK, decided to pursue ISO 27001 compliance.

With its AI-driven tools transforming how organizations deliver person-centered care, Emma AI needed to ensure that data protection and security governance matched its innovation. Their mission was clear: keep care personal while keeping data protected.

To make it happen, Emma AI partnered with Axipro as its advisory partner, leveraging Drata for automation and Tempo Audits as the independent audit partner. Together, they set out to achieve ISO 27001 certification within just six weeks, a goal that demanded focus, coordination, and expert guidance.

About Emma AI

Emma AI is reshaping how social care providers manage quality, compliance, and efficiency. The platform uses artificial intelligence to help organizations audit faster, document smarter, and deliver better care.

From automating service user reviews to streamlining quality assurance, Emma AI’s technology gives care managers back their most valuable resource, time. Tasks that once took hours now take minutes, freeing professionals to focus on people, not paperwork.

But as Emma AI’s reach expanded, so did its responsibility. Handling sensitive health and social care data meant that ISO 27001 compliance wasn’t just a regulatory box; it was a promise to every partner, caregiver, and service user that data would always remain secure.

Challenge: Scaling Compliance

For Emma AI, the road to ISO 27001 compliance came with familiar challenges that many scaling tech companies face:

  • Tight timelines — six weeks to reach audit readiness.
  • High stakes — working in health and social care meant managing regulated, sensitive information.
  • Growing data infrastructure — ensuring their AI systems met security standards without disrupting ongoing innovation.

Their goal wasn’t just certification. It was to build a stronger foundation of trust, one that matched their mission to bring frontier technology into care with safety, precision, and confidence.

Solution: Axipro’s Guided Transition

Emma AI didn’t just want a certificate; they wanted a system that would strengthen how they worked every day. That’s where Axipro stepped in as their advisory partner.

Together, we mapped out a clear and realistic roadmap for ISO 27001 compliance. The Emma AI team took charge of their internal processes while we provided guidance, templates, and hands-on coaching to help them align with the ISO 27001 framework.

Through Drata, the team automated evidence collection, monitored security controls, and tracked progress in real time. This reduced the stress of manual tracking and made every step transparent and measurable.

With Tempo Audits as the independent audit partner, Emma AI moved confidently through the certification process, backed by expert advice, automation, and a commitment to continuous improvement.

One of Emma AI’s leaders, George Parry, described it best:

Axipro was instrumental in helping us achieve ISO 27001 certification. From start to finish, they were proactive, hands-on, and always on top of the details. They made it crystal clear what evidence was required, so all we had to do was gather and submit it. Their structured approach meant we completed everything within the six-week timeframe they set. I’d highly recommend Axipro to any organisation looking to streamline and accelerate their compliance journey.

Results: Compliance Achieved

In just six weeks, Emma AI reached a major milestone: full ISO 27001 compliance.

Here’s what that meant for the company:

  • A recognized ISO 27001 certification, confirming their commitment to data security and governance.
  • Greater trust and credibility with partners and health organizations.
  • Improved visibility and control over security risks, powered by Drata automation.
  • A stronger compliance culture within the team, and every employee now plays an active role in maintaining information security.

For Emma AI, achieving ISO 27001 compliance wasn’t the end of the journey; it was the beginning of a stronger, more accountable future.

Why Emma AI Chose Axipro

Emma AI chose Axipro because they wanted a partner who could move fast, communicate clearly, and make the path to ISO 27001 compliance easier to navigate.

Three reasons stood out:

  1. Trusted Drata Partnership – As one of the most reviewed Drata partners, Axipro understood exactly how to integrate automation into Emma AI’s compliance strategy.
  2. Quick Responsiveness – With a six-week timeline, fast and clear communication made all the difference.
  3. Referrals and Reputation – Like many of our clients, Emma AI was referred through Drata’s partner network, knowing they’d receive expert advisory support backed by proven results.

With advisory guidance from Axipro, automation through Drata, and certification by Tempo Audits, Emma AI achieved ISO 27001 compliance with precision and purpose, without losing focus on what matters most: delivering high-quality, person-centered care.

Ready to Start Your Compliance Journey?

For Emma AI, achieving ISO 27001 compliance wasn’t just a checkbox; it was a milestone that proved their commitment to safeguarding sensitive data in health and social care. It built confidence with partners, boosted credibility with clients, and set a higher standard for data protection across their entire organization.

Your business can do the same. Whether you’re innovating in AI, health tech, or SaaS, the path to ISO 27001 compliance starts with the right guidance and a clear plan.

At Axipro, we help fast-growing companies simplify compliance without slowing down innovation. Through structured milestones, automation with Drata, and trusted audit partnerships like Tempo Audits, we make ISO certification practical, transparent, and achievable.

To take the first step? Book a free consultation with Axipro today and see how easy it can be to turn compliance into your next competitive advantage.

Partner Meet Grow with Axipro today to navigate ISO 27001 with clarity and confidence.

AI Governance Maturity Model: 5 Levels Explained

Pedro Dias July 31, 2026

Most organizations think their AI governance is further along than it is. McKinsey’s 2026 AI Trust Maturity Survey of roughly 500 organizations found an average maturity score of 2.3 out of 4, and only about a third reported level three or higher in strategy, governance, and agentic AI oversight. Adoption is outpacing control, and regulators have noticed. An AI governance maturity model gives you a way to measure that gap honestly. This guide covers what a maturity model is, the six dimensions it should measure, the five levels most models use, and how to assess your own organization and build a roadmap to the next level. What Is an AI Governance Maturity Model? An AI governance maturity model is a structured framework that describes how capable an organization is at governing its AI systems, usually across five progressive levels. The concept borrows directly from the Capability Maturity Model (CMM) that software engineering has used since the early 1990s: define the capability, describe what it looks like at each stage of development, and score yourself against it. The purpose is diagnosis. A maturity model tells you where governance is strong, where it’s theater, and where it doesn’t exist at all. How It Differs from General AI Governance Frameworks Frameworks like the NIST AI Risk Management Framework or ISO/IEC 42001 tell you what good governance contains: policies, risk assessments, accountability structures, monitoring. A maturity model tells you how well you’re doing those things today. The framework is the destination. The maturity model is the odometer. That distinction matters in practice. Plenty of companies can point to an AI policy document. Far fewer can show that the policy changes what teams actually ship. Why Enterprises Need a Maturity Model Three reasons. First, budget: you can’t prioritize governance investment without knowing which dimension lags. Second, accountability: a maturity score gives boards something concrete to track quarter over quarter. Third, regulation: the EU AI Act and frameworks like ISO 42001 assume a functioning management system, and a maturity assessment is the fastest way to find out whether yours would survive scrutiny. Core Dimensions of an AI Governance Maturity Model A useful model measures more than policy coverage. Six dimensions show up consistently across the credible models, including the IEEE-USA flexible maturity model built on the NIST AI RMF. Strategy and leadership. Does the organization have a stated position on AI risk, an executive owner (increasingly a Chief AI Officer), and board visibility? Gartner’s 2025 polling found 55% of organizations now have an AI board or dedicated oversight committee, which means nearly half still govern by improvisation. Policies, standards, and accountability. Written policies mapped to regulations, a RACI matrix for AI decisions, and clear escalation paths. Many organizations adapt the three lines of defense model from financial risk: the teams building AI, the risk function overseeing them, and internal audit checking both. Data governance and model lifecycle. Training data lineage, quality controls, and lifecycle management from development through deployment, monitoring, and retirement. This is where AI governance meets MLOps, and where mature organizations maintain an AI register, a live inventory of every model and system in production. Risk, compliance, and ethics. Risk classification of AI systems, impact assessments, bias and fairness testing, and explainability requirements. Banks will recognize the DNA of model risk management under SR 11-7 here. People, skills, and culture. Training, role clarity, and whether people outside the governance team actually understand their obligations. Tools, automation, and monitoring. Drift detection, automated policy checks, audit logging, and dashboards. Governance that lives in spreadsheets caps out around level three. The 5 Levels of AI Governance Maturity Level 1: Ad Hoc / Initial AI use happens without oversight. There’s no inventory, no policy, or a policy nobody follows. Shadow AI is common, and risk surfaces only when something breaks publicly. Level 2: Developing / Repeatable Someone has been assigned responsibility. A draft policy exists, a partial inventory exists, and reviews happen for high-profile projects. The practices are repeatable but depend on specific people rather than defined processes. Level 3: Defined / Structured Governance is documented, standardized, and applied across the organization. There’s a governance committee, a risk classification scheme, defined lifecycle gates, and mandatory training. Most organizations pursuing ISO 42001 certification are working to reach and formalize this level. Level 4: Managed / Metrics-Driven Governance produces numbers. Coverage rates, review cycle times, incident counts, and risk reduction are measured and reported to leadership. Controls are enforced by tooling rather than goodwill, and audits confirm the system works as described. Level 5: Optimized / Adaptive Governance improves itself. Monitoring feeds back into policy, controls adapt to new model types (agentic systems being the current test), and the organization anticipates regulatory change rather than reacting to it. Almost nobody is here yet, and that’s fine. Level 5 is a direction, not a deadline. Insider Note: In assessments, the most common self-scoring error is claiming level 3 on the strength of documents alone. If your policy says every model gets a pre-deployment review and your inventory shows 40 models but your review log shows 6, you’re at level 2. Evidence beats paperwork every time, and auditors check the logs first. AI Governance Maturity Matrix The matrix crosses dimensions with levels so you can score each one independently. Organizations are rarely uniform: it’s normal to sit at level 3 on policy and level 1 on monitoring. For scoring, keep the rubric simple: 1 to 5 per dimension, scored on evidence you could show an auditor, not on intentions. Board-level indicators (does the board see AI risk reporting?) and operational indicators (does every production model have a completed impact assessment?) should be scored separately, because they fail independently. How to Assess Your Current AI Governance Maturity Start with a baseline self-assessment. Pull together a cross-functional group covering engineering, legal, risk, security, and the business owners of major AI use cases, and score each dimension against the matrix. Half a day is usually enough for a first pass. For each dimension, the

Read More »

How Long Does It Take to Get ISO 42001 Certified?

Pedro Dias July 30, 2026

Most organizations get ISO 42001 certified in 2 to 9 months. Companies that already hold ISO 27001 regularly land in the 2 to 5 month range, while enterprises with sprawling AI portfolios and no existing management system can take 12 months or more. The audit itself only takes days. Almost the entire calendar goes into building and operating your AI Management System (AIMS) long enough to produce evidence an auditor can actually check. That is the short answer. The longer answer depends on your starting point, your scope, and how quickly you can get a certification body on the schedule. This article breaks down the full timeline phase by phase, the factors that stretch or compress it, and what the recertification cycle looks like once you hold the certificate. Typical ISO 42001 Certification Timeline at a Glance ISO/IEC 42001:2023 is the first international standard for AI management systems, published in December 2023. Because it follows the same harmonized structure as ISO 27001 and ISO 9001, the certification process will feel familiar to anyone who has been through a management system audit: build the system, run it, pass a Stage 1 and Stage 2 audit, then maintain it through annual surveillance. Here is how timelines typically break down by company size. Average Timeline for Small Businesses Small companies move fastest because scope stays contained. A startup with two or three AI systems, a handful of decision makers, and short approval chains can finish scoping in a week and get policies signed off in days rather than weeks. The realistic floor for a small business starting from scratch is around 3 months. With an existing ISO 27001 program and a compliance platform already collecting evidence, 2 months is achievable. Average Timeline for Mid-Sized Companies Mid-sized companies usually take 6 to 9 months. The AI inventory is growing, more departments are touching AI systems, and risk assessments have to cover more use cases. Coordination becomes the hidden cost: getting engineering, legal, and product to agree on an AI policy takes longer than writing the policy itself. Average Timeline for Enterprises Enterprises should plan for 9 to 12 months, sometimes longer. The main drivers are AI system sprawl across business units, longer procurement cycles for certification bodies, and audits that take more days. The Stage 2 audit for a large multinational can run two weeks or more on its own, and internal alignment before the audit takes far longer than the audit itself. Breakdown of the ISO 42001 Certification Timeline by Phase The phases below overlap in practice. Treat the durations as effort estimates for a reasonably resourced program, not a strict sequence. Phase 1: Scoping and Gap Analysis (2–4 Weeks) Everything starts with two questions: which AI systems are in scope, and how far is your current governance from what the standard requires? The gap analysis maps your existing policies and controls against the standard’s clauses and Annex A controls, and produces the project plan for everything that follows. Get the scope wrong here and every later phase inherits the mistake. Phase 2: AIMS Design, Leadership, and AI Policy Development (2–4 Weeks) This phase establishes the skeleton of the management system: the AI policy, governance roles, objectives, and the leadership commitments the standard requires. Executive sign-off is the gating item. The documents are not hard to write. Getting senior leadership to formally own AI governance is where programs stall. Phase 3: AI Risk and Impact Assessments (2–6 Weeks) ISO 42001 requires both AI risk assessments and AI impact assessments, and the distinction matters. Risk assessments look at what could go wrong for the organization. Impact assessments look at consequences for individuals and society, which is a newer discipline for most teams. This phase takes longer when you have many AI systems, high-risk use cases, or no prior methodology to adapt. The output feeds directly into your Statement of Applicability (SoA), the document that maps which Annex A controls you have selected and why. Insider Note: Impact assessments are where auditors probe hardest, because they are the most distinctive part of ISO 42001 compared with ISO 27001. A recycled security risk register with “AI” pasted into it will get picked apart in Stage 2. Build the impact assessment methodology properly the first time. Phase 4: Controls Implementation (2–10 Weeks) The longest phase. Here you implement the Annex A controls selected in your SoA: AI system lifecycle documentation, data governance for training data, human oversight mechanisms, transparency measures, supplier management for third-party AI, and so on. Duration depends almost entirely on the gap analysis results. Organizations with mature engineering practices often find they already do much of this and just need to document it. Organizations without formal AI development processes are building from zero. Phase 5: Documentation, Training, and Evidence Collection (2–8 Weeks) Certification requires proof that the system operates, not just that it exists on paper. That means records: training completion logs, risk assessment outputs, review meeting minutes, monitoring reports. This phase runs partly in parallel with implementation, but it cannot be compressed below a certain floor because auditors want to see evidence generated over time, not a folder of documents all created the week before Stage 1. Phase 6: Internal Audit and Management Review (2–4 Weeks) The standard requires an internal audit of the AIMS and a formal management review before the certification audit. This is your dress rehearsal. A good internal audit surfaces nonconformities while they are still cheap to fix. Skipping or rushing it is a false economy that shows up later as Stage 2 findings. Phase 7: Stage 1 Certification Audit (1–2 Weeks) The certification body reviews your documentation and assesses readiness for Stage 2. The audit itself takes 1 to 3 days for most organizations. The auditor examines your scope statement, AI policy, risk and impact assessment methodology, SoA, and internal audit results, then issues findings. The 1–2 week window covers the audit plus the report. Phase 8: Closing Nonconformities (2–4 Weeks) Almost every Stage 1 produces findings.

Read More »