How Cielo became the first RPO to achieve ISO 42001 compliance in just 3.5 months

Cielo, the world’s leading talent acquisition partner, uses over 50 different AI systems across its entire organization. These AI systems are integral to sourcing, screening, and matching talent, as well as driving general internal productivity.

Learn more about how Gevangee Desai, VP of Information Security Compliance at Cielo, leveraged AuditBoard’s AI Governance solution to align with ISO’s AI Governance standard and ensure compliance with evolving AI regulations.

The challenge: Achieving and navigating new AI governance standards

The growth of AI has led to the necessity of mounting regulations. To stay ahead of the curve, Cielo sought ISO 42001 certification. However, as the first international standard for AI governance, ISO 42001 naturally presented challenges for Cielo.

• Application-level governance: Unlike traditional GRC frameworks, ISO 42001 requires governance for each individual AI system.
• Scope and inventory: Scoping for ISO 42001 required a vendor-by-vendor review to determine where and how AI was being used.
• High- vs. low-risk models: The process required Cielo to separate high-risk models from low-risk tools.
• Stakeholder alignment: The team had to align all stakeholders, including vendor management, product, and leadership, to define roles and create buy-in.

Gevangee Desai, VP of Information Security Compliance at Cielo, says:

The answer: AuditBoard’s AI governance solution

With those challenges in mind, Cielo wanted to work with a company that was equipped to handle the complexities associated with AI, risk, and compliance. Using AuditBoard’s AI governance solution, the Cielo team established an effective AI management system that includes:

• Centralized inventory of AI applications
• Risk triaging and impact assessment
• Governance processes and workflows
• Multi-framework mapping

Results: ISO 42001 certification in less than 4 months

With AuditBoard’s controls and automation tools, the Cielo team:

• Built a centralized inventory of over 50 AI systems for easy analysis and review
• Linked evidence to AuditBoard’s pre-populated ISO42001 controls at company and application levels
• Prioritized higher-impact systems, allowing for a stronger focus on the greatest-risk AI
• Used governance workflows to support streamlined review and approval

With the implementation, Cielo achieved ISO 42001 certification in just 3.5 months – less than half of the expected time. The organization also passed its third-party audit with zero nonconformities.

Along with certification, the company saw a reduction in manual effort and provided leadership with a wider, holistic view of AI risk and compliance. For its clients, Cielo now had readily available documentation that reduced any friction or complications in initial sales conversations. Gevangee Desai, VP of Information Security Compliance at Cielo, says:

Raise the ceiling for global AI governance with AuditBoard

AuditBoard's platform enables Cielo post-certification with governance processes for new and existing AI systems. The platform's regulatory tracker helps Cielo stay aligned with evolving AI laws globally, while ongoing testing and documentation are now built into product and vendor workflows.

As AI and its implementation continue to evolve, organizations can expect regulations on AI to follow suit. Cielo is one of the first companies to obtain ISO 42001 certification, but it’s certainly not the last.

Achieve AI governance certification and meet new standards with AuditBoard. Book a demo or explore AuditBoard AI governance to learn more.

About the authors

Guru Sethupathy is the VP of AI Governance at AuditBoard. Previously, he was the founder and CEO of FairNow (now part of AuditBoard), a governance platform that simplifies AI governance through automation and intelligent and precise compliance guidance, helping customers manage risks and build trust and adoption in their AI investments. Prior to founding FairNow, Guru served as an SVP at Capital One, where he led teams in building AI technologies and solutions while managing risk and governance.