TP has been ISO 42001 certified for some time now. This places the company among the first group of organizations worldwide to hold this certificate. The ISO 42001 standard helps organizations develop and use AI applications in a controlled and responsible manner.

 

TP is ISO 42001 certified. Part of the process involved reviewing and extensively documenting all processes from A to Z where AI is applied and how this is done. The final stage was an audit by BSI in February 2026, eleven months after the start of the project.

ISO 42001 fits into TP's DNA

“We were actually already ahead of this certification process,” reflects. Herman Stuiver, IT Director Benelux, Nordics and Suriname, back.

"Our TP.ai FAB proposition In other words, Foundational AI Backbone – which is our offering aimed at specific verticals where we strictly focus on results – already largely met the high requirements of ISO 42001. The fact that we have now taken this extra step is a logical consequence of how TP develops new services. Standardization and reliability are a fundamental starting point for us.

Stuiver explains that ISO 42001 is much more than just a checkbox. “It is a fully-fledged AI management system that guarantees you develop and manage AI in a controllable, ethical, and transparent manner. You must be able to account for exactly which Large Language Models (LLMs) you use, how you monitor risks, and how the guardrails are set up. You must also be able to demonstrate which API calls are made per case, so that every result is 100 percent reproducible. Moreover, the standard demands clarity regarding the role of humans: when is there a human in the loop? You force yourself to organize all your AI activities in a fully auditable way. In regulated sectors, that is an absolute must today.”

ISO/IEC 42001 is intended for organizations that offer or use AI products or services, and ensures the responsible development and deployment of AI systems. The certificate can only be obtained after an accredited third party has conducted an audit. The certification is valid for three years; annual oversight audits are required. DNV and BSI have been accredited by the since January 2025. Accreditation Council for ISO 42001 certification in the Netherlands. The certificate has not yet been obtained by a great many organizations. Recently, CRM giant Pega, messaging company CM.com, CRM player Salesforce, WFM player Calabrio, and CCaaS providers Talkdesk, Zendesk, and Genesys, among others, obtained the certificate. Hyperscalers such as AWS, Google, and Microsoft have also obtained the certificate for their AI activities.

No paper tiger

ISO 42001 is therefore not a certificate that ends up in a desk drawer after the audit, says Stuiver. “On the contrary. Our solutions must be built securely and transparently 'by design'. Of course, this involves not just simply logging actions, but continuous quality control and proactively managing reliability. ISO 42001 is therefore literally embedded in the architecture of all our AI tools and all the processes surrounding them. As soon as we sit down with a client, the principles of this standard form the starting point for the collaboration.”

He emphasizes that AI is a layered technology. “The major vendors, such as OpenAI, Gemini, Anthropic, or the European Mistral, build the fundamental base models. On top of that, you have technology partners who develop specialized applications. TP adds the last mile; think of the orchestration of all these technologies. We connect the models and applications to the customer’s complex, business-critical processes. Everyone has access to AI technology by now, but it is precisely in that last mile that we want to offer the greatest added value.”

Remove complexity

Being compliant with ISO 42001 sounds like a labor-intensive process. Doesn't it come at the expense of your speed of innovation?

“Your speed will actually increase,” says Stuiver. “Anyone currently working according to ISO 42001 is immediately prepared for the EU AI Act. You build a strategic lead. Companies that only incorporate aspects such as privacy, security, and transparency after the fact are taking irresponsible risks. Consider the dangers of AI that starts hallucinating, makes wrong decisions, or exhibits unwanted bias in the outcomes. By working according to this standard, we remove a huge amount of complexity for our clients. They can innovate in a future-proof manner and without fear of the unknown.”

This is particularly crucial for organizations making the transition from a traditional, rule-based chatbot to advanced generative AI, says Stuiver. “Companies outsource end-to-end processes to us. We act on their behalf and bear the responsibility for quality. ISO 42001 is our quality seal in this regard.”

New roles

As mentioned, TP is by nature geared towards standardizing work processes. Therefore, obtaining the certificate in itself has not led to major changes within the organization, says Stuiver. “However, the orchestration function, the continuous fine-tuning of models, and the integration of specific domain knowledge are taking an increasingly prominent place. As a result, we see our roles evolving and the share of specialized AI functions within TP growing rapidly.”

When asked how TP monitors compliance, Stuiver paints a clear picture: “Our global Global Privacy, Risk & Compliance Office provides strict oversight, and we conduct rigorous internal audits. But compliance is absolutely not solely their responsibility. It is woven into our daily way of working and into all our processes. It is an organization-wide responsibility, in which our AI teams use the ISO standard as a standard design principle.”

Good preparation for the EU AI Act

ISO 42001 is a good stepping stone towards the EU AI Act, which entered into force in phases (see box further down). “The overlap is significant,” explains Stuiver. “Think of the obligation for transparency, the use of human supervision, and the active mitigation of bias. ISO 42001 forces you to firmly embed this in your customer contact processes.”

Stuiver also views the standardization as the missing link in the so-called 'golden triangle'. “Together with ISO 27001 for information security and ISO 27701 focused on privacy, it forms a rock-solid foundation. Security and privacy were already our USPs, but in the AI ​​era, this three-pronged approach is absolutely indispensable.”

EU AI Act – ISO/IEC 42001 aligns well with the EU AI Act, which has been entering into force in phases since August 2024. One of the first obligations (effective February 2, 2025) is the AI ​​literacy of employees working in organizations that deploy or develop AI. Two other important milestones are August 2026 and August 2027; enforcement powers enter into force this year, and next year all applications – including LLMs, which are designated as general-purpose AI models (GPAI) – must be compliant. High-risk AI applications must also comply with the law this year: these are applications that make selective decisions about people's future (education, jobs, benefits, etc.).

Positive effect

Does Stuiver expect that, in addition to technology partners, TP’s own clients will also start working with this ISO standard? You would expect that collaborating with partners would become easier as a result. Stuiver responds: “Most of the technology suppliers we work with have obtained the certificate by now. However, when we implement AI solutions for clients, we remain the party responsible for that service. Consequently, achieving the standard is less urgent for the client themselves.”

“But I do expect another major effect,” concludes Stuiver. “With this certificate, we eliminate the risks and the last vestiges of cold feet among our customers, so that together we can accelerate innovation safely and responsibly. If I were on the client side, I would include ISO 42001 as a standard strict requirement in every RFP from now on. AI is no longer a pipe dream; we are right in the middle of it. ISO 42001 must – just like ISO 27001 – become the new, undisputed hygiene factor.”

(Ziptone/Erik Bouwer)

Featured, Knowledge partners, Technology