Size doesn't excuse you

Thesis

ISO 42001 scales to the AI system’s risk and reach, not to headcount. A five-person startup building a hiring or credit-scoring tool used by millions carries the same impact assessment obligation as a bank, with less room to be thin about it.

Reader

Government buyers vetting small AI suppliers, and the startups they are vetting.

Opening failure

A supplier answers a buyer’s governance question with “we’re a small team, so we keep it light”. The system it is selling decides eligibility for a public service.

Beats

1. Where size legitimately matters: role separation (5.3 lets one person hold several roles) and proportionate documentation (7.1). Not the seriousness of the assessment.
2. Interested parties differ by context, not maturity. A bank’s regulators are real requirements under 4.2; a startup’s shorter list is legitimate only if that is genuinely its context.
3. How the audit differs. For a mature organisation the auditor checks integration and integrity. For a startup the auditor checks existence, and asks founders what informed a conclusion.
4. Proportionality has to be argued from context and risk, never asserted from size.

Market angle

This is the piece to hand a government buyer. It is also the reassurance a startup needs: proportionate is allowed, thin is not.

What you can do on Monday

For your highest-reach AI system, write down how many people it touches and what happens to them if it is wrong. That number sets your proportionality, not your headcount.