ISO/IEC 42001 by industry
ISO 42001 for BPO and shared services: governing AI agents, copilots and speech analytics your clients can check
Clause by clause: ISO/IEC 42001:2023 requirements: every clause explained →
What changes when AI runs on the delivery floor: why outsourcing clients ask, which bots, copilots and analytics belong in scope, where auditors test consent, human oversight and vendor data use, and how it sits beside ISO/IEC 27001, ISO/IEC 27701 and SOC 2.
Key points
- In outsourcing, ISO/IEC 42001 is asked for when a client learns that AI agents, copilots or speech analytics now touch its customers, and wants proof the provider governs them.
- The scope follows the AI in the delivery chain: agent-assist copilots, bots on client queues, speech and text analytics, automated quality scoring and workforce forecasting, with your role for each.
- Auditors test three things hardest here: client consent to each AI use, human oversight of what the AI decides or drafts, and what the vendors behind your tools may do with client data.
- Most of the AI arrives inside contact-centre and CX platforms, so supplier and customer responsibilities carry more weight than model development.
Why BPO clients ask for ISO 42001
The trigger is rarely a tender line on its own. It is a client's vendor risk team learning, often at renewal, that its queues now run a copilot, machine-scored calls or a bot. The questions follow: who approved it, what data does it see, does the vendor train on it, and who checks its output?
Three groups push hardest. Banks, insurers and healthcare payers must show supervisors how they oversee outsourced work, including the AI in it. Technology and consumer brands that outsource support worry about what a bot or copilot says to their customers in their name. Captives and shared services centres need one framework covering AI across finance, HR and customer operations.
A certificate gives one answer to many questionnaires: an AI management system, audited by an accredited certification body. If you are still weighing it, start with Do you need ISO/IEC 42001? A decision guide for AI providers and users.
What sits inside the AIMS scope for a BPO or shared services centre
Start with an inventory, campaign by campaign. A typical operation uses agent-assist copilots, chat and voice bots, speech and text analytics, automated QA scoring, workforce forecasting, and document extraction in claims, invoice or KYC work. For each, record your role: you may be the user of a vendor's tool, the provider of an AI-enabled service to the client, or both on the same queue.
AI on the client's own platform is usually the client's system, but your agents' use of it and the oversight you promised sit with you. The general rules are in ISO/IEC 42001 scope: which AI systems and roles are in, and the mistakes that cost you.
Three scope mistakes recur in this sector: listing only the tools IT bought while team leaders run unapproved generative tools on the floor; scoping one delivery site when the same analytics run across every city and country; and leaving out internal uses, such as AI in recruitment screening or attrition prediction, that affect your own people as much as client AI affects customers.
Where the requirements bite for BPO and shared services
| Requirement area | What it means on a delivery floor | Evidence the auditor samples |
|---|---|---|
| Context and interested parties | Each client's contractual position on AI is known before a tool goes live on its queue | A register of client AI clauses and consents per programme, statement of work terms, records of client approval before go-live |
| AI system impact assessment | What a bot, scoring model or copilot could do to callers, claimants or agents, including foreseeable misuse | An impact assessment per system, re-run after a model or prompt change, covering customers and the agents who are scored |
| Use of AI systems and human oversight | Agents and quality analysts know when AI output may be used as is, must be checked, or must be overridden | Intended-use statements, work instructions for reviewing copilot drafts, escalation from bot to human, samples of QA scores reviewed by a person |
| Data for AI systems | Call recordings, transcripts and tickets used for analytics or tuning have known sources, quality and permission | Data provenance records, redaction checks on transcripts, retention settings, evidence that client data stays within the agreed use |
| Third-party and customer relationships | Who is responsible for what between the CX platform vendor, you and the client | Vendor terms on training with client data, responsibility matrices per client, supplier reviews, notices of AI use given to clients |
The full structure is in ISO/IEC 42001 Annex A: the 38 controls explained.
Working alongside ISO/IEC 27001, ISO/IEC 27701, SOC 2 and privacy law
Most providers that ask about ISO/IEC 42001 already hold ISO/IEC 27001. The AIMS should extend that system, adding AI risk and impact assessment to the same audit, review and supplier processes. See ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS.
Transcripts, recordings and ticket text are personal data, so the privacy system matters as much as the AI one. ISO/IEC 27701 covers the processing, and local law still applies, such as the Data Privacy Act of 2012 in the Philippines or the GDPR for European callers. US clients may ask for a SOC 2 report as well; one control set can feed both.
For European clients, the EU AI Act sets obligations by role and risk class, and the certificate does not give presumption of conformity. See ISO/IEC 42001 and the EU AI Act: what the certificate does not give.
What a BPO engagement looks like
Duration depends on how many AI systems run across how many programmes, whether client consents are recorded and whether an ISO/IEC 27001 system already runs. Operations, quality, IT, the data protection officer and client contract owners must be involved. With Design™, Sterling guides your teams to own the assessments and controls; with Drive™, Sterling carries more of the inventory, assessments and evidence so floors keep hitting their service levels.
How Sterling works with BPO and shared services providers
AI governance your clients can check, queue by queue.
Our expert and experienced consultants build the AI inventory with your operations and quality teams, run the impact assessments for bots, copilots and scoring, map client consents and vendor terms, and keep the evidence in Effivity, included with the engagement, at no additional cost. Sterling does not certify; an accredited certification body audits and decides. We ensure successful certification for our clients.
Book a free discovery callISO 42001 for BPO: questions buyers ask
Do we need client consent before using AI on a client's queue?
Usually, yes, and the AIMS should prove it. Many contracts restrict new tools or data uses, so record each client's position and approval before an AI system goes live on its programme.
Is automated QA scoring of agents in scope for ISO 42001?
Yes, if it informs coaching, pay or dismissal decisions. Agents are individuals affected by the system, so the impact assessment must cover them and a person should review the scores that drive decisions.
Our speech analytics vendor is certified to ISO 42001. Does that cover us?
No. It covers the vendor's own management system. Your use of the tool, the client data you feed it and the oversight you give its output remain yours to evidence.
Can one ISO 42001 certificate cover several delivery centres?
Yes, where the sites run under one management system with shared controls. The certification body samples sites, so each centre must operate the same inventory, assessments and oversight.
ISO/IEC 42001 by industry
Every guide in the ISO/IEC 42001 series is written for one question and links back to the hub for the whole picture.
- ISO 42001 certification in Australia
- ISO/IEC 42001 for banking and financial services
- ISO 42001 benefits
- ISO/IEC 42001 for BPO and shared services
- ISO 42001 certification process
- ISO 42001 checklist
- ISO 42001 certification body
- ISO/IEC 42001 for healthcare
- ISO/IEC 42001 for HR and staffing
- ISO/IEC 42001 for professional services
- ISO/IEC 42001 for retail and e-commerce
- ISO/IEC 42001 for technology and software
Keep exploring
Explore more about ISO/IEC 42001
Watch a video on how to implement ISO 42001 here.
Watch a video on ISO 42001 requirements here.
ISO/IEC 42001 resources
Services for ISO/IEC 42001
Talk to a consultant
Plan an AI management system that covers every queue and delivery centre.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice