Built In,
Not Bolted On
Govern AI on the management systems you already trust. The executive guide to integrating the ISO 27 and 42 series into one coherent, auditable, board-ready program.
Most AI governance is bolted on. The durable kind is built in.
Most of the market treats AI governance as a brand new apparatus, standing up a parallel bureaucracy alongside the systems a business already runs. That path is slow, expensive, and hard to audit. There is a better one. When AI management is integrated into the information security spine you already trust, ISO/IEC 27001, and the ISO 42 series is layered onto it rather than beside it, governance becomes faster to implement, cheaper to maintain, and defensible under scrutiny. That is the argument of this book, and it is the argument a board wants to hear.
From clauses to a running program.
A board-level duty made concrete.
Directors are answerable for how AI is overseen. The book gives them the structure to discharge that duty.
One program, not two.
Build the AI management system on the ISMS you already run, so you avoid duplication instead of funding it twice.
An honest map.
How governance connects to the EU AI Act, NIS 2, and DORA, without pretending a voluntary standard is a shortcut through the law.
A method, not a summary.
The Governance Kernel, the Three Cycles, and the FARM change model turn requirements into a program you can actually operate.
Written for the people accountable for the answer.
Built In, Not Bolted On is written first for the C-suite and the board, the executives and directors now accountable for AI oversight and the risk that comes with it. It is written second for the practitioners who carry that accountability out day to day, the ISMS and AIMS managers, auditors, and governance leads who need the integrated program to actually work. Both audiences get the same through-line: govern AI on the systems you already trust.
The Board Briefing Kit
A short executive briefing drawn from the book, plus a ten-minute self-assessment anchored to ISO/IEC 42001, ISO/IEC 27001 and the EU AI Act. Score your own program, see the gaps, and get the board-level questions worth asking before your next AI decision.
Take the assessment now and score your own programme in ten minutes, or email me and I will send the full Kit as a PDF you can hand to your board.
Request the Kit Take the assessmentWhat readers are saying.
Most books on ISO management systems are written for the people who already get it. This one is written for the leaders who need to. Patrick frames security, privacy, and AI governance (ISO 27001, 27701, 42001) as one integrated problem rather than three separate compliance projects. The business fable format makes the case in a way that a standard or a consultant presentation never could. If you’re trying to explain to a board or exec team why this work matters before someone forces the question, hand them this book.
This book is a must read for all C-suite, it’s beautifully written, incredibly digestible and gives you enough knowledge and practical tools to ask tough questions before your customers do, without being drowned in technical jargon. How often do we say, ‘you don’t know what you don’t know’ and seem to just accept when it comes to AI that someone else is the expert? Given the risks associated with AI, this is no longer enough. We all need to have at least a level of understanding to ask the right questions and ensure our organizations are structured to be genuinely robust, efficient, accountable and compliant today whilst being confident we are set up for whatever tomorrow may bring. Using a relatable case study to bring it to life, this book perfectly combines an overview of security, privacy and AI standards and regulations with practical tools and advice on how to combine your initiatives, maximizing efficiency, accountability and creating an offering that will withstand any amount of external scrutiny.
About Patrick Sullivan
Patrick Sullivan is VP of Strategy and Innovation at A-LIGN. He holds a seat on ISO/IEC JTC1/SC42 through INCITS, is a member of the Forbes Technology Council, and has spoken at TEDx and Meta. He publishes The Business of Compliance for a C-suite and compliance audience, and his work sits at the intersection of AI governance, ISO management systems, and conformity assessment.
Read The Business of ComplianceFor boards, teams, and training programs.
Equip a board, a governance team, or a client roster with the same reference. Volume pricing is available, and the book can be licensed as a teaching asset for training providers and associations.
Request bulk and licensing