ISO 42001

ISO 42001 in Spain: AI Governance, the EU AI Act, and Building Compliant AI Management Systems

ISO 42001 gives Spanish organisations the operational governance framework to satisfy the EU AI Act, AESIA oversight, and GDPR obligations — covering risk management, human oversight, and AI lifecycle controls in one auditable system

Shenoy Sandeep

Shenoy Sandeep

— 18 min read
Share
ISO 42001 AI governance in Spain — EU AI Act, AESIA, and PECB certification
Spain's AI governance stack: EU AI Act, AESIA enforcement, GDPR overlap, and ISO 42001 as the operational compliance framework for organisations deploying AI systems in Spain.

ISO 42001 is the international AI management system standard that gives Spanish organisations a structured, auditable framework for governing artificial intelligence — and in Spain, that framework now sits inside one of the most active AI regulatory environments in the European Union.

Spain operates under the EU AI Act as its primary legal instrument, supplemented by a national AI supervisory agency, a draft domestic AI law, and sector-specific regulators covering everything from financial services to public administration. For any organisation deploying AI in Spain — whether a multinational with Madrid operations or a Spanish tech company scaling across the EU — compliance is not a single-step exercise. It requires governance that spans law, policy, and operational controls.

ISO 42001 addresses that operational layer directly. It does not replace the EU AI Act or Spain's national frameworks. What it does is give organisations the internal governance machinery — risk assessment, documented controls, human oversight procedures, lifecycle management — to demonstrate compliance in a way regulators can inspect and auditors can verify.

This article maps Spain's AI regulatory environment in full, explains where ISO 42001 fits within it, and covers what organisations operating in Spain should be doing now to build governance that holds up to scrutiny.

Spain's AI compliance is multi-layered
Organisations must satisfy the EU AI Act, Spain's emerging national AI law, GDPR, and sector-specific regulators — ISO 42001 ties these together through a single governance system.

The Spanish AI Supervisory Agency holds enforcement authority
AESIA coordinates AI governance across Spain and will serve as the national market surveillance authority under the EU AI Act, making documented compliance evidence essential.

ISO 42001 provides the operational governance layer
The standard covers risk management, AI lifecycle controls, human oversight, supplier due diligence, and incident management — the exact controls regulators expect to see documented.

High-risk AI classification triggers significant obligations
Spanish businesses deploying AI in recruitment, credit, healthcare, or public services must treat EU AI Act high-risk requirements as the starting point for their compliance architecture.

PECB ISO 42001 certification is in active demand across Spain
Spanish practitioners and organisations are seeking Lead Implementer and Lead Auditor credentials to meet rising governance expectations from regulators, clients, and insurers.

reconn delivers PECB ISO 42001 training and implementation support in Spanish and English
Self-study courses are available in both Spanish and English; eLearning is available in English; and remote implementation guidance for Spanish businesses is available directly through reconn.

Spain's AI governance model

Spain does not govern AI through a single statute. It operates a layered model where EU-level regulation, national legislation, sector supervision, and fundamental rights frameworks apply simultaneously — making compliance a multi-track exercise rather than a checklist against one law.

At the top sits the EU AI Act, which applies directly in Spain without requiring national transposition for its core obligations. Below that, Spain has established its own institutional infrastructure — most notably the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA), which was created in advance of the EU AI Act's full application. A draft national AI law is working its way through the legislative process, intended to translate EU-level obligations into domestic enforcement powers.

Alongside these AI-specific instruments, Spain's data protection framework under GDPR and the Ley Orgánica de Protección de Datos y Garantía de los Derechos Digitales (LOPDGDD) applies directly to AI systems that process personal data. Equality legislation and rules on public administration AI add further obligations for specific sectors.

What this means in practice is that an organisation deploying AI in Spain needs to understand which combination of instruments applies to its specific use case, then build governance capable of satisfying all of them at once. ISO 42001 provides the internal framework through which that governance can be structured and documented.

Build the expertise to lead AI governance in Spain

The PECB ISO 42001 Lead Implementer course gives you the framework and practical tools to design and manage an AI management system — available in Spanish and English.

View ISO 42001 Lead Implementer Course

The EU AI Act in Spain

The EU AI Act applies directly in Spain and is the primary legal instrument governing the development, deployment, and use of AI systems across all sectors.

The Regulation establishes a risk-based classification system with four tiers:

  • Prohibited AI practices — systems that pose unacceptable risks, including social scoring by public authorities, real-time remote biometric identification in public spaces (with limited exceptions), and manipulation of human behaviour. These are banned outright.
  • High-risk AI systems — systems used in areas such as recruitment, credit assessment, critical infrastructure, healthcare, law enforcement, migration, education, and the administration of justice. These face the most demanding obligations: conformity assessments, technical documentation, human oversight requirements, transparency to affected individuals, and post-market monitoring.
  • Limited-risk systems — AI that interacts with humans, generates synthetic content, or influences decisions must meet transparency obligations. Chatbots must identify themselves as AI; deepfakes must be labelled.
  • Minimal-risk systems — the majority of AI applications. No mandatory obligations apply, though the Act encourages voluntary codes of conduct.

For Spanish organisations, the critical first step is classification. An AI system used in recruitment screening is high-risk regardless of how sophisticated or well-intentioned the system is. The obligations that attach to that classification — conformity assessments, a risk management system, data governance, technical documentation, logging, human oversight, and notification requirements — are substantial and take time to implement properly.

ℹ Important: The EU AI Act phased in over 2024–2026. Prohibited practices obligations applied from February 2025; high-risk AI system requirements from August 2026. Spanish organisations deploying high-risk systems should not wait until the application date to begin compliance work — the documentation and system-building required cannot be completed quickly.

Spain's national AI law and supervisory agency

Spain has established the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA), headquartered in A Coruña, as the national authority responsible for AI governance — making it one of the first EU member states to create a dedicated AI supervisory body.

AESIA's mandate covers coordination across Spanish regulators, guidance for businesses and the public, and enforcement of AI rules within Spain's jurisdiction. Under the EU AI Act, AESIA is designated as Spain's national market surveillance authority, which means it holds investigative and sanctioning powers over non-compliant AI providers and deployers operating in Spain.

In parallel, Spain has been developing a national AI law intended to adapt EU-level obligations to the domestic context. The draft legislation is expected to address:

  • Governance and supervisory structures beyond AESIA's founding decree
  • National enforcement powers and sanctioning procedures
  • Rules on the use of AI in public administration
  • Domestic implementation of EU AI Act prohibitions and high-risk obligations
  • Requirements for transparency and accountability in state use of AI

Spain also established a regulatory sandbox for AI under Royal Decree 817/2023, allowing selected organisations to test AI systems under AESIA's supervision. This controlled testing environment is particularly relevant for organisations developing high-risk systems, as it provides a structured route to regulatory engagement before full commercial deployment.

The practical implication for businesses is that AESIA is already operational, already issuing guidance, and will exercise enforcement authority as the EU AI Act reaches full application. Internal governance documentation — the kind ISO 42001 produces — is the evidence AESIA will expect to see.

ℹ Primary sources

Key regulators and enforcement bodies

AI governance in Spain involves multiple authorities depending on the sector and the nature of the AI system — there is no single regulator for all AI, and different enforcement bodies hold jurisdiction over different use cases.

AESIA — Spanish AI Supervisory Agency

AESIA is Spain's primary AI authority. It coordinates AI policy across government, develops guidance for businesses, and acts as the national market surveillance authority under the EU AI Act. Any organisation deploying AI in Spain that falls under EU AI Act obligations should treat AESIA as the primary regulatory contact and monitor its published guidance closely.

AEPD — Spanish Data Protection Authority

The Agencia Española de Protección de Datos (AEPD) is Spain's GDPR supervisory authority. It holds enforcement jurisdiction over AI uses that involve personal data — which includes most practical AI deployments. AEPD has published specific guidance on AI and data protection, covering automated decision-making, profiling, the lawful basis requirements for training data, and individuals' rights in relation to AI-generated decisions. Organisations deploying AI in Spain effectively operate under AEPD and AESIA oversight simultaneously when personal data is involved.

Sector regulators — financial services, healthcare, and others

Spain's sectoral regulators maintain supervision over AI used within their domains. The Banco de España and the Comisión Nacional del Mercado de Valores (CNMV) oversee AI used in banking and capital markets; the Dirección General de Seguros y Fondos de Pensiones (DGSFP) covers insurance. Healthcare AI falls under the health ministry and regional authorities. These sectoral bodies apply their own frameworks, which layer on top of the EU AI Act rather than replacing it.

Public administration and judicial oversight

Spain has been active in addressing AI use within public bodies and the justice system. AI used in public administration must meet transparency and fairness standards; algorithmic decisions affecting citizens require documented justification and review processes. The Consejo General del Poder Judicial has engaged with the implications of AI in courts, where fairness, explainability, and human oversight are treated as non-negotiable requirements.

Need remote ISO 42001 implementation support for your Spanish business?

reconn provides remote implementation assistance and guidance to Spanish organisations navigating EU AI Act compliance and ISO 42001 certification. Contact us to discuss your requirements.

Explore ISO 42001 Implementation Services

Transparency, fundamental rights, and data protection

Spain's AI governance environment places explicit weight on human rights, non-discrimination, privacy, and explainability — and these obligations apply to private organisations and public bodies alike, not just in theory but through enforceable legal requirements.

Data protection and GDPR

Spain's GDPR implementation through the LOPDGDD adds domestic context to EU privacy obligations. AI systems that process personal data — and most commercially deployed AI systems do — must satisfy GDPR requirements around lawful basis, purpose limitation, data minimisation, and transparency. Automated individual decisions that produce legal or similarly significant effects require specific justification, and individuals have the right to human review. AEPD actively investigates AI systems where personal data handling appears unlawful.

Non-discrimination and equality

Spain has equality legislation that applies directly to AI outputs. Where AI systems are used in employment, lending, housing, or services, outputs that produce discriminatory effects on protected groups — regardless of whether discrimination was intended — can trigger regulatory action. AEPD has specifically flagged algorithmic bias as an area of active concern, and the EU AI Act reinforces this through its high-risk classification of AI in recruitment and credit assessment.

Public-sector accountability

Spanish public bodies using AI to make or assist decisions affecting citizens face heightened transparency obligations. Algorithmic tools used in public administration should be documented, explainable, and subject to human oversight. The principle that consequential decisions about citizens cannot be delegated entirely to automated systems has legal weight in Spain's administrative law framework.

⚠ Common compliance failure: Many organisations treat data protection and AI governance as separate programmes. In Spain, they are not. An AI system that processes personal data without a valid lawful basis, produces discriminatory outputs, or makes opaque automated decisions faces exposure under both GDPR (via AEPD) and the EU AI Act (via AESIA) — often simultaneously.

Where ISO 42001 fits in Spain's regulatory landscape

ISO/IEC 42001:2023 gives organisations the internal governance framework to operationalise AI compliance — it is the management system standard that translates legal obligations into documented, auditable controls.

The EU AI Act and Spain's national frameworks set out what organisations must achieve: risk management, transparency, human oversight, technical documentation, conformity assessment. ISO 42001 provides the how: a structured AI management system (AIMS) that creates, maintains, and continuously improves the governance infrastructure through which those outcomes can be demonstrated.

The alignment between ISO 42001 and the EU AI Act is substantial. Both require risk assessment before deployment, documented lifecycle controls, human oversight mechanisms, incident management procedures, and continual monitoring. An organisation that implements ISO 42001 correctly builds the governance architecture that EU AI Act compliance requires — and produces the documented evidence that regulators like AESIA will expect to inspect.

EU AI Act requirement Spain-specific context ISO 42001 support
Risk management system AESIA will expect documented risk processes Clause 6 — risk identification, treatment, review
Technical documentation Mandatory for high-risk AI systems Clause 7.5 — documented information requirements
Human oversight Required for public admin AI and high-risk use cases Annex A — human oversight controls and escalation
Transparency obligations AEPD enforces for data-processing AI Annex A — transparency and explainability controls
Supplier and third-party AI Deployers remain responsible in Spain Clause 8.4 — supplier and third-party controls
Incident reporting and monitoring Post-market surveillance requirements Clause 10 — nonconformity, corrective action, improvement

ISO 42001 controls relevant to Spanish organisations

ISO 42001's Annex A contains 38 controls organised across 9 domains — the controls most directly relevant to Spain's regulatory requirements cover governance structure, risk management, lifecycle oversight, transparency, human oversight, supplier management, and incident response.

Leadership, governance policy, and accountability

ISO 42001 requires top management commitment to the AI management system, an AI governance policy that defines scope and principles, and clear assignment of roles and responsibilities. In Spain, where AESIA and AEPD may both request evidence of governance accountability, having named AI governance owners and a documented policy is the baseline expectation — not an optional extra.

Risk identification, impact assessment, and treatment

ISO 42001 requires organisations to identify AI-specific risks, assess their likelihood and impact, and implement treatment plans with review cycles. This maps directly to the EU AI Act's requirement for a risk management system in high-risk AI deployments. For Spanish businesses, the risk assessment should specifically address AEPD concerns (data processing risks), AESIA obligations (AI-specific risks), and sector regulator requirements as applicable.

AI lifecycle controls — design, development, deployment, monitoring

ISO 42001 addresses the full AI lifecycle from initial design decisions through to post-deployment monitoring. Controls cover development governance, validation and testing requirements, deployment approval gates, and ongoing performance monitoring. For Spanish organisations deploying high-risk AI systems, these lifecycle controls generate the technical documentation the EU AI Act requires and the audit trail AESIA will expect.

Human oversight and decision review

ISO 42001 Annex A includes controls for human oversight of AI-generated outputs, escalation procedures when AI decisions require human review, and override mechanisms. In Spain, human oversight is legally required for automated decisions in public administration and strongly expected for high-risk AI use cases under the EU AI Act. ISO 42001's oversight controls give organisations a documented framework rather than an ad hoc review process.

Supplier and third-party AI governance

Many Spanish businesses use third-party AI tools, APIs, or foundation models. ISO 42001 requires due diligence for AI suppliers, contractual safeguards that address AI-specific risks, and ongoing monitoring of outsourced AI performance. This matters in Spain because deployers of third-party AI remain responsible under the EU AI Act for the compliance of high-risk systems — buying an AI tool from a vendor does not transfer liability.

Incident management and corrective action

ISO 42001 requires processes to detect AI failures or harmful outputs, report them through appropriate channels, implement remediation, and document lessons learned. Post-market surveillance is a specific EU AI Act obligation for high-risk systems, and Spain's national enforcement infrastructure through AESIA means incident response procedures need to be functional, not just documented. A governance programme that cannot demonstrate active incident monitoring will not withstand scrutiny.

Practical implications for organisations operating in Spain

Spanish and multinational organisations deploying AI in Spain should treat governance implementation as an active programme rather than a compliance exercise — the regulatory environment is operational, enforcement infrastructure is in place, and documentation gaps carry real risk.

Classify your AI use cases first

Before building any governance programme, map every AI system in use against the EU AI Act risk categories. Systems used in recruitment, credit, access to essential services, or public administration are high-risk and trigger the most demanding obligations. This classification exercise determines everything else in the compliance programme.

Address data protection and AI governance together

In Spain, AEPD and AESIA enforcement can overlap. An AI system that produces discriminatory outputs and processes personal data may be investigated by both authorities. Build compliance programmes that integrate GDPR requirements and EU AI Act obligations rather than treating them as separate workstreams.

Document governance decisions, not just outcomes

AESIA will want to understand not just what an AI system does, but how it was approved, what risks were assessed, and what oversight mechanisms were in place. ISO 42001 creates the documentation infrastructure — risk registers, policy documents, governance records, audit trails — that satisfies this kind of regulatory inspection.

Include legal, privacy, technical, and risk teams

AI governance in Spain touches employment law, data protection law, sector regulation, technical architecture, and risk management. Compliance programmes that are run by a single team without cross-functional input tend to miss obligations in adjacent areas. AI governance in Spain needs legal, privacy, technical, and business risk representation from the start.

Engage suppliers on AI governance contractually

Third-party AI vendors need to provide documentation sufficient to meet high-risk AI Act obligations. If a vendor cannot provide evidence that their system was developed with appropriate risk management and testing, deploying it in a high-risk context is a compliance liability. Build supplier governance into procurement processes, not as an afterthought after deployment.

Demand for ISO 42001 professionals in Spain

Demand for PECB ISO 42001 Lead Implementer and Lead Auditor credentials in Spain is growing alongside the EU AI Act's implementation timeline — organisations need people who can build and audit AI management systems, not just read the regulation.

Spain is an active AI adopter. The country has positioned itself within the EU as a digital economy leader, with significant AI investment in sectors including financial services, healthcare, retail, telecommunications, and public administration. Each of these sectors is navigating the EU AI Act with varying degrees of urgency, and all of them need qualified practitioners to design governance frameworks and conduct internal or third-party audits.

Two roles are in particular demand:

ISO 42001 Lead Implementer

Lead Implementers design, implement, and manage AI management systems. In Spain, this role sits at the intersection of EU AI Act compliance, ISO 42001 technical knowledge, and practical governance design. Organisations need Lead Implementers to lead their AIMS programmes, train internal teams, and prepare for external certification audits. The credential demonstrates that a practitioner can translate the standard's requirements into an operational governance system — which is exactly what Spanish businesses currently need from their compliance and risk professionals.

ISO 42001 Lead Auditor

Lead Auditors assess AI management systems for conformance — both as internal auditors within organisations and as external auditors for certification bodies. As ISO 42001 certification becomes a contract requirement and a regulatory signal in Spain, the supply of qualified auditors needs to expand. Spanish professionals with Lead Auditor credentials are positioned to work within certification bodies, as independent consultants, or in internal audit functions across sectors with significant AI exposure.

Both credentials are internationally recognised through PECB, which means Spanish practitioners holding ISO 42001 Lead Implementer or Lead Auditor certifications can operate across EU markets — a meaningful advantage in an increasingly interconnected European compliance environment.

Working on AI governance for a Spanish organisation?

reconn provides remote ISO 42001 implementation guidance and EU AI Act compliance support to businesses in Spain and across the EU. Our team has hands-on experience designing AI management systems that work in practice, not just on paper.

PECB ISO 42001 training available in Spanish and English

reconn is a PECB Authorised Training Partner offering ISO 42001 Lead Implementer and Lead Auditor courses in both Spanish and English — with self-study available in both languages, eLearning available in English, and private 1-on-1 live mentoring available in English.

For Spanish professionals and organisations looking to build ISO 42001 expertise, reconn offers three study formats designed for working professionals:

Self-study — available in Spanish and English

Self-study gives you the complete PECB ISO 42001 curriculum on your own schedule, with no fixed class times. This format is available in both Spanish and English, making it the most accessible option for Spanish-speaking professionals who prefer to study in their native language. Self-study from $799.

eLearning — available in English

The eLearning format delivers the ISO 42001 curriculum through structured online modules with video content and knowledge checks. This format is currently available in English. eLearning from $899.

Private 1-on-1 live online mentoring — English

reconn's founder and PECB Certified Trainer, Shenoy Sandeep, delivers private live mentoring sessions directly to individual candidates. Sessions run evenings 18:00–20:00 CET to accommodate working professionals. This format provides direct engagement with an experienced practitioner who holds 20+ years in offensive security, enterprise risk, and AI governance — and is one of the world's early PECB-certified AI professionals.

✓ Included with every reconn course purchase:

  • 1-hour direct access to Shenoy Sandeep — use this session to clarify ISO 42001 standard requirements, work through implementation questions, or get career guidance on your certification path
  • Unlimited email and WhatsApp support until you clear the exam — no time limit, no cap on questions, direct access throughout your entire exam preparation journey

ISO 42001 Lead Implementer

The PECB ISO 42001 Lead Implementer course covers the knowledge and skills needed to design, implement, manage, and improve an AI management system based on ISO/IEC 42001:2023. Candidates who pass the exam earn the PECB Certified ISO/IEC 42001 Lead Implementer credential.

View ISO 42001 Lead Implementer Course →

ISO 42001 Lead Auditor

The PECB ISO 42001 Lead Auditor course prepares candidates to audit AI management systems for conformance, conduct internal audits, and manage third-party certification audits. Candidates who pass earn the PECB Certified ISO/IEC 42001 Lead Auditor credential.

View ISO 42001 Lead Auditor Course →

ISO 27001, ISO 27701, and GDPR courses — also available in Spanish and English

For Spanish professionals and organisations working across information security, privacy governance, and data protection, reconn also offers PECB certification courses in ISO 27001 (information security management), ISO 27701 (privacy information management), and GDPR practitioner credentials. These courses are available in Spanish and English — contact reconn directly for language options and availability.

Bundle discounts available

reconn offers bundle pricing for ISO 42001, ISO 27001, ISO 27701, and GDPR package combinations. Contact us directly for bundle options and pricing.

Frequently asked questions

Is ISO 42001 mandatory for businesses operating AI systems in Spain?

ISO 42001 is not legally mandatory in Spain. The EU AI Act and Spain's national regulatory framework set the legal obligations — ISO 42001 is a voluntary management system standard that helps organisations build the governance infrastructure to satisfy those obligations. In practice, ISO 42001 certification is increasingly expected by regulators as evidence of governance maturity, by clients as a vendor qualification requirement, and by insurers as part of AI risk underwriting. Organisations deploying high-risk AI systems in Spain should treat ISO 42001 as the most credible way to demonstrate compliance readiness to AESIA and other competent authorities.

How does the EU AI Act apply to companies operating in Spain?

The EU AI Act applies directly in Spain as an EU Regulation — it does not require a domestic law to take effect. Any organisation that places AI systems on the Spanish market or puts them into service in Spain must comply, regardless of where the organisation is headquartered. This includes Spanish companies, multinationals with Spanish operations, and non-EU companies whose AI systems are used in Spain. The obligations depend on the risk classification of the AI system: high-risk systems face the most demanding requirements, including conformity assessment, technical documentation, human oversight, and registration in the EU AI database. AESIA is Spain's designated national market surveillance authority under the Act.

Does reconn provide remote ISO 42001 implementation support to businesses in Spain?

Yes. reconn provides remote implementation assistance and guidance to Spanish businesses and EU-based organisations working on ISO 42001 certification and EU AI Act compliance. This includes AI management system design, gap analysis against ISO 42001 requirements, risk assessment frameworks, documentation support, and preparation for external certification audits. All implementation support is delivered remotely and can be conducted in English. Contact reconn at hello@reconn.io or via WhatsApp at +971 585 726 270 to discuss your organisation's requirements.

What PECB ISO 42001 training does reconn offer for Spanish-speaking professionals?

reconn offers PECB ISO 42001 Lead Implementer and Lead Auditor training in Spanish and English. Self-study is available in both Spanish and English. eLearning is available in English. Private 1-on-1 live online mentoring is available in English, delivered by Shenoy Sandeep, PECB Certified Trainer and Founder of reconn. Every course purchase includes a 1-hour direct session with Shenoy to address ISO 42001 standard questions or career guidance, plus unlimited email and WhatsApp support until you clear the exam.

What is the difference between ISO 42001 Lead Implementer and Lead Auditor in Spain?

The ISO 42001 Lead Implementer credential is designed for professionals who design, implement, and manage AI management systems within organisations. In Spain, Lead Implementers lead AIMS programmes, prepare organisations for certification, and translate EU AI Act and ISO 42001 requirements into operational governance. The Lead Auditor credential is for professionals who assess AI management systems for conformance — either as internal auditors or as external auditors for certification bodies. As demand for ISO 42001 certification increases in Spain, both roles are in active demand. The right credential depends on whether you are focused on building governance systems (Lead Implementer) or evaluating them (Lead Auditor).

Does reconn offer ISO 27001, ISO 27701, or GDPR training in Spanish?

Yes. reconn offers PECB certification training in ISO 27001 (information security management), ISO 27701 (privacy information management), and GDPR. These courses are available in Spanish and English — contact reconn directly at hello@reconn.io or via WhatsApp at +971 585 726 270 for language options, delivery formats, and bundle pricing that combines ISO 42001, ISO 27001, ISO 27701, and GDPR credentials. You can also visit reconn.io for the full course catalogue.

What role does AESIA play in AI governance in Spain?

AESIA — the Agencia Española de Supervisión de la Inteligencia Artificial — is Spain's dedicated AI supervisory authority. It was established ahead of the EU AI Act's full application and is designated as Spain's national market surveillance authority under the Act. AESIA's role includes issuing guidance for businesses, coordinating AI oversight across other Spanish regulators, and exercising enforcement powers against non-compliant AI providers and deployers in Spain. Organisations with significant AI deployments in Spain should monitor AESIA's published guidance and expect that AESIA will be the primary regulatory contact for EU AI Act compliance matters.

Are bundle discounts available for ISO 42001 and ISO 27001 courses?

Yes. reconn offers bundle pricing for combinations of ISO 42001, ISO 27001, ISO 27701, and GDPR courses. Bundle discounts are available for individuals and for organisations enrolling multiple participants. Contact reconn directly at hello@reconn.io or via WhatsApp at +971 585 726 270 for bundle options and pricing details. All bundle enquiries are handled personally.

Related reading

About the Author

Shenoy Sandeep

Shenoy Sandeep is the Founder of reconn, an AI-first cybersecurity firm based in Dubai, UAE — assisting startups and enterprises scale across the Middle East and African region. With 20+ years across offensive security, threat intelligence, and enterprise risk, and over 10 years in Enterprise AI, AI governance, and Business Continuity, he brings a practical, execution-driven approach to AI governance and information security.

He is a PECB-certified trainer and one of the world's early PECB-certified AI professionals, specialising in ISO/IEC 27001, ISO/IEC 42001, ISO 22301, and ISO 9001.

Shenoy is also a Data Protection and Privacy Management Specialist, holding expertise in ISO 27701, GDPR, UAE Personal Data Protection Law, and Saudi Arabia's data protection frameworks.

Read more