A QMS is fundamentally a set of documented procedures, not a software platform. ISO 42001 certification can be achieved with paper-based or spreadsheet-based documentation for organisations with a small number of AI systems.

The minimal QMS comprises a QMS manual describing policies, procedures, roles, and responsibilities; a document control register tracking every controlled document with its version, owner, review date, and retention period; a non-conformity register tracking every identified gap; internal audit schedules and records; and quarterly management review meeting minutes.

Workflow automation, dashboard views, and integrated reporting are lost. Manual QMS management works for organisations with one to three AI systems; for larger portfolios, a platform becomes justified. The trade-off is explicit: lower licensing cost in exchange for higher manual effort and greater risk of process breakdown as complexity increases.

Key outputs

• Spreadsheet and document-based QMS for small portfolios
• Minimal artefact set (manual, registers, audit records, meeting minutes)
• Viable for one to three systems
• Explicit trade-off documentation (cost vs. scalability)