Clay's Path to ISO 42001 Certification

Clay helps businesses shape go-to-market strategies with unique data and the tools to act on it. More than 500,000 teams use Clay worldwide and it's scaled through a mix of product-led growth and enterprise sales.

When you're selling to enterprise buyers, security becomes a core part of the sales process. And because Clay is an AI-native product, the topic of AI and how it's governed kept surfacing both in internal conversations and buyer procurement processes.

Clay's answer was to become an early adopter of ISO 42001, the first international standard for AI management systems. The team certified on an ambitious timeline, with Workstreet supporting them along the way.

Why Clay Bet Early on ISO 42001

ISO 42001 is the first international, certifiable standard for AI management systems (AIMS), covering how a company builds with and governs AI responsibly.

Clay decided to pursue the framework as AI was coming up in more customer procurement conversations and it also aligned with its mission as an AI-native company.

“Clay is an AI-first company, and this framework is very specific to AI,” explains Dongting Yu, a security engineer at Clay. “We’re one of the earlier adopters of ISO 42001 and part of that was to set up a framework for AI governance early on and also to bet that this framework will grow and become more recognized and more in demand. So us getting started early puts us ahead of the curve.”

The ISO brand also made the choice easy. ISO, the International Organization for Standardization, is the body behind globally recognized standards like ISO 27001, which Clay already has, and a brand enterprise buyers already know and trust.

“ISO was an easy choice to get into and also to market to our customers," Dongting says.

Clay also wanted clear AI governance because its product interacts with AI in a number of ways: from the agents its team runs internally and the AI features in its product, to the agents customers may run and the model-hosting companies underneath.

“We help customers enable AI, and at the same time we’re responsibly providing it and being clear on where our responsibilities fall and where our customers’ responsibilities fall, including our use of the models on the back end,” Dongting says.

How Workstreet Supported the Implementation

“Even the discussion of whether we should do 42001 was together with Workstreet,” Dongting says. “They helped us do an initial assessment of what it would take to get the certification, and put together a potential timeline.”

Once Clay decided to move ahead, Workstreet began work on the policies and documentation side required for ISO 42001. “A lot of the mapping, reusing what we already have or merging existing documents, that documentation wrangling was on them,” Dongting says. “Workstreet helped on both fronts, at an advisory, intellectual level and at a very operational level.”

Clay stayed firmly accountable for much of the implementation. “We are ultimately responsible for what we need to implement and for being honest about what we have and what we don’t have,” Dongting says.

“Part of that journey made me realize we already had many of the required technical capabilities,” he says. “So it was more about mapping into the framework than implementing new things on the engineering side.”

“Workstreet prepared us mentally for the amount of work,” Dongting says. “Combined with the technical capabilities we already had, the net-new work was very manageable, and overall within our expectations.”

Working on an Ambitious Timeline

Once the decision to pursue ISO 42001 was made, Clay wanted to achieve it as quickly as possible as a sales win. The first roadblock was finding an auditor who could move at that same speed.

“Initially we had trouble finding an auditor that could allocate the time that early,” Dongting recalls. “Workstreet pulled their partner network and actually helped us make it happen. We were aiming to achieve ISO 42001 on an ambitious timeline, and they helped us meet it.”

Workstreet also ran an independent internal audit to prepare Clay. The real ISO 42001 audit then wrapped up in just two weeks. “It went very smoothly,” Dongting notes. “Maybe the biggest surprise was just how smooth the whole process was.”

The Business Case for ISO 42001

Because Clay had already built a mature security compliance program, the internal business case came together fast. Clay is an AI business, so a framework to demonstrate strong AI governance makes sense. “We moved pretty quickly,” says Dongting. “Workstreet was already helping us with a lot of the governance, risk, and compliance (GRC) work, so this was an incremental add-on. The business side and the security side were very quickly aligned. We just decided to execute.”

Alongside the external validation around how Clay builds and governs AI, the certification gave the team confidence in its own systems and processes. Clay still fields a lot of AI-related questions, and having ISO 42001 to point to gives a buyer's security team independent evidence that its AI governance holds up under scrutiny.

ISO 27001 is still the baseline many international buyers expect. As Dongting puts it, demand for ISO 42001 “depends on how AI-curious the customer is.” His advice to peers weighing the same move is to treat it as a continuation of their security work.

“It’s a natural part of the maturity journey,” he says. “If you’re developing an AI-first product or are in an AI-first company, you’re probably already thinking through your AI risks. This becomes a more specific governance angle, complementary to the technical work you’ve already done.”

A Partner that Scales with You

Security and compliance is becoming increasingly important for startups, especially those scaling as rapidly as Clay.

Clay and Workstreet now partner across multiple workstreams. To ensure steady communication, our teams run weekly syncs, have dedicated, shared Slack channels, and have built fast escalation paths on both sides.

“We see Workstreet as an extension of the team,” Dongting says. “Without them, we would not be able to scale as quickly as we are today on the security and compliance side.”

If you’re a fast-growing, AI-native team weighing ISO 42001 and want to see what the path looks like for your business, talk to our team.