%20v2.png)
.png)
CASE STUDY
An ISO/IEC 42001 AI Management System for a legal technology company
.webp)
Client: Lawcadia, an Australian legal technology company with a legal operations platform for in-house legal teams operating in regulated and complex environments across Australia, the United Kingdom and the United States.
The challenge
Lawcadia holds ISO/IEC 27001 certification for a mature Information Security Management System (ISMS), and was introducing AI into its platform. Lawcadia wanted to create a strong Artificial Intelligence Management System (AIMS) to overlay its ISMS and to govern its use and deployment of AI. Certification of the AIMS under ISO/IEC 42001 was a required outcome.
Lawcadia’s AIMS needed to cover both the internal use of AI across the business and the deployment of AI in the Lawcadia platform. With a highly regulated client base that included local, state and federal government, financial services, insurance, defence, infrastructure, transport and education organisations, Lawcadia required a robust approach for AI governance that would withstand scrutiny.
It was also important to develop an AIMS that would support responsible innovation and enhance Lawcadia’s ability to roll-out AI efficiently and sustainably.
The approach
Given the maturity of the existing ISMS, established controls were retained where appropriate and additional controls were added to address AI-specific risks and impacts. Since AI is a socio-technical system, developing an AIMS required a different approach to developing an ISMS.
A discovery phase defined Lawcadia’s initial proposed AI use cases across both internal operations and the platform. Laero interviewed members of the executive team to understand how the business was using AI, the key desired outcomes for AI use and deployment and key concerns for the business and clients. For Lawcadia, those concerns centred on data flow and design dependencies.
Laero then developed a broad framework reflecting these investigations, aligned to the requirements of ISO/IEC 42001. Workshops with key internal stakeholders then helped ensure that the framework could integrate into existing work practices and facilitate enhanced use of AI.
Detailed documentation was then developed: concise, practical policies, standards and procedures governing the AI lifecycle and deployment of AI, tailored to Lawcadia’s size, organisational structure and client base.
The solution
Laero worked with Lawcadia’s leadership and AI governance team to develop a five-layer AI Management System:
Foundation – a clear scope and governance framework
Authority – AI policy and objectives, clear accountability and approval rights
Core Mechanisms – an AI system register, risk and impact assessment methodology, and policies and standards governing AI use and deployment. These included protocols for handling potentially legally privileged material, complementing existing data classification and information management controls.
Domain Controls – AI-specific controls tailored to both internal and platform use cases, with approval gates throughout the system lifecycle
Assurance – including an internal audit programme, incident management and triggers for continual improvement.
Outcomes
Lawcadia has now established a structured approach to assessing, approving, deploying and reviewing AI across internal operations and its platform. The AIMS framework has facilitated faster and clearer approval pathways, supported by AI-specific standards that build on and strengthen protections for client information.
A maintained register records all AI systems and use cases including ownership, providers, how data is routed to AI models, and data classifications. Defined reassessment triggers help ensure a timely response to changes in models, uses and system connections.
To accelerate innovation and productivity, Lawcadia can confidently experiment with and evaluate emerging AI use cases with a governed approach to assessment, approval, monitoring and reassessment.
Lawcadia has completed development of its AIMS and is progressing through the external audit stages towards ISO/IEC 42001 certification.
“Our aim was to give our team a clear, practical way to use AI responsibly and confidently, both within our business and through the Lawcadia platform. Working with Laero helped us build on our existing information security foundations to support responsible, sustainable innovation, with a clear focus on AI’s broader impacts on our people, clients and the communities they serve.”
Sacha Kirk, Chief Strategy Officer, Lawcadia
Prepare for ISO/IEC 42001 Readiness
Book a consultation to explore how Laero can help you design and implement an AI Management System aligned with ISO/IEC 42001, tailored to your organisation’s risk profile and regulatory environment.