A generic monitoring package for machine learning models developed for Rijkswaterstaat
Rijkswaterstaat
ISO 42001 AI management system
We set it up around the AI you actually use: inventory, risks, roles and monitoring. For Rijkswaterstaat, we developed a monitoring package for AI models.
We gave Rijkswaterstaat a single, general-purpose monitoring package for all its AI models in production
Rijkswaterstaat had several AI models in production and wanted to actively monitor them for data and prediction drift. Monitoring them manually did not scale. “DSL came up with an inventive solution that we can put to good use.” Nanine Overgaauw, Rijkswaterstaat - SRE Data Science
How do we show that we really have our AI under control?
An AI management system based on ISO/IEC 42001 records which AI you develop, deliver or use, the associated risks, who is responsible and how you continue to monitor it. We help you set it up alongside your existing management systems.
The management system is grounded in what happens with your AI in practice
An AI inventory
The AI you develop, procure or use, with its purpose, owner, data and supplier. This includes tools that departments have bought themselves.
Risk and impact assessment
For each system: what could go wrong, who could be affected and what measure is appropriate. A consistent method lets you repeat the assessment.
Roles and documentation
Who decides whether to use a system, who approves a new model and who steps in when needed. Set out in policies and procedures that people actually use.
Model monitoring
For Rijkswaterstaat, we developed a generic package to detect drift and outliers in AI models in production.
Start with the AI already in use, not a blank policy document
-
Inventory and scope
We map out which AI applications are in use and decide together which parts of the organisation the system covers.
-
Risks and roles
For each application, we assess risk and impact, and record who is responsible and who provides oversight.
-
Measure and improve
Monitoring, evaluation and areas for improvement become part of a regular cycle, following plan-do-check-act.
Do we need to start working on ISO 42001 already?
A good fit if
You develop or use multiple AI applications, clients ask how you manage AI, or you already have a management system such as ISO/IEC 27001 that AI needs to align with.
Not a good fit if
You use one AI tool and have no plans to expand. In that case, clear guidelines for its use and someone responsible for it are often enough. If your use grows, you can build on that.
What determines the scope
The number of AI systems and suppliers, whether you develop AI or only use it, whether you already have an ISO management system, and how much documentation and monitoring is already in place.
Can we get a certificate from you?
No. Data Science Lab is not a certification body. Certification is voluntary and is carried out by an independent certification body. We help set up the system; whether to seek certification is up to you.
AI policy, an AI management system or the AI Act first: where do you start?
Start with an AI policy
Choose this if your use of AI is still limited and you mainly buy AI solutions. Define how they may be used, who is responsible and which applications are prohibited; you can incorporate this into a management system later.
An AI management system
Choose this if you have several AI systems and want to demonstrate that you manage them effectively. Our advice: build on existing ISO processes rather than creating a separate set of processes.
The AI Act
Choose this if you supply or deploy high-risk AI systems. Start by taking stock of your systems and classifying their risks; see the AI Act.
We build and monitor models ourselves, so we know what managing them takes
Data Science Lab has worked with data and AI since 2016 as a Databricks and Microsoft partner. We build models and set up MLOps and monitoring, as we have done for Rijkswaterstaat. We don’t certify; we do set things up.
We’ll discuss the AI you’re already using in our first conversation
Stef Stoelwinder
Business DevelopmentStef is your point of contact. In our first conversation, we’ll discuss what AI you already have running, what you want to demonstrate and what’s already in place.
E-mail info@datasciencelab.nl
Phone +31 (0)20 3636 724
Which AI systems do you want to bring under a single management system?
Describe the AI you develop or use and why you’re considering ISO/IEC 42001. We’ll reply by email or arrange an initial conversation.
Message sent
Thanks for your message. We’ll be in touch as soon as possible.
Frequently asked questions
ISO/IEC 42001:2023 is the international standard for AI management systems, published in December 2023 by ISO and IEC (committee JTC 1/SC 42). According to ISO, it is the first standard of its kind. It sets requirements for establishing, implementing, maintaining and continually improving an AI management system.
The standard applies to organisations of any size that develop, provide or use AI, including those in the public sector. It relates to our work on data governance and AI management.
ISO summarises the requirements as leadership and organisational context, AI policies and objectives, risk management for AI systems, data governance and lifecycle controls, transparency and information provision, performance evaluation and monitoring, and continual improvement.
Like other management system standards, ISO/IEC 42001 follows the plan-do-check-act cycle. ISO also specifies controls and calls for regular risk assessments and measures to address risks.
The AI Act is European law; ISO/IEC 42001 is a voluntary standard. According to ISO, the standard does not replace laws or regulations, but helps organisations meet their obligations. The requirements for high-risk systems listed in Annex III apply from 2 December 2027.
On 19 October 2026, the European Commission published the first harmonised standard under the Act: EN 18286, a quality management system for providers of high-risk AI. It is intended to complement existing standards such as ISO/IEC 42001. Your legal adviser can assess which requirements apply to you; see also AI Act.
Not ISO itself, and not Data Science Lab. Certification is voluntary and carried out by independent certification bodies, which may be accredited by a national accreditation body. You decide whether and when to seek certification.
We help you set up the management system and make it work in practice. If you first want to compare governance consultancies, our overview of data governance consultancies can help.
Both are management system standards. ISO lists ISO/IEC 42001 alongside ISO 9001 for quality, ISO 14001 for the environment and ISO/IEC 27001 for information security, and also offers 42001 and 27001 together.
Our advice: if you already have an information security management system, you can often share policies, the risk process, document control and the evaluation cycle. AI-specific elements include the inventory of AI systems, assessments of their impact on people and model monitoring.
ISO identifies monitoring AI systems throughout their lifecycle and evaluating performance as parts of an AI management system. For models, that means measuring whether inputs and predictions shift, and documenting what you do when they do.
For Rijkswaterstaat, we developed a generic package for drift and outlier detection using tools including Python and Alibi Detect. Read how we monitor models in production under MLOps.
According to ISO, this covers organisations that develop AI systems, incorporate AI into products or services, use AI for decisions or automation, or manage third-party AI. In practice, that also includes purchased software with AI features and tools employees use on their own initiative.
For each system, record its purpose, owner, data, supplier and who uses its output. Read how we define AI roles and responsibilities under AI governance.
If you use one or two AI tools, no one is asking about your AI controls and you have no models of your own, a short AI policy with an owner for each tool is often enough. Read about applying AI responsibly under Responsible AI.
If the number of applications grows, or clients start asking about your controls, that policy is a good starting point for a management system.
Looking for governance, roles or model management?
- Data governanceOwnership, definitions, access and data quality agreements, the foundation of every AI management system.
- AI governanceWho decides, who oversees and who remains accountable for AI, translated into practical roles and processes.
- MLOpsModels that run reproducibly, are monitored for drift and are retrained when the data changes.