ISO/IEC 42001
ISO/IEC 42001:2023 guide to scope, Clauses 4-10, , impact assessment, controls, evidence, audit, and certification.
ISO/IEC 42001:2023 is the current published first edition of the AI management-system standard. It applies to organisations of any size or sector that provide or use products or services using AI systems and sets requirements for establishing, implementing, maintaining, and continually improving an artificial intelligence management system ().
Clauses 4-10 contain the management-system requirements. Normative is a reference control set used during ; normative Annex B gives adaptable implementation guidance; informative Annexes C and D provide possible objectives, risk sources, and cross-domain context. Certification is voluntary and concerns the defined scope, not an individual model or automatic legal compliance.
Define the covered units and activities, then map AI systems, roles, intended uses, , external dependencies, and responsibilities across the boundary.
Connect AI risk criteria, risk and impact results, treatment decisions, selected and additional controls, residual-risk approval, monitoring, and corrective action.
Keep standards conformance separate from legal compliance: map each applicable law, role, risk category, duty, deadline, and evidence requirement on its own terms.
Define the organisational boundary and activities governed by the , identify relevant and requirements, map AI-system roles, and document interfaces with suppliers and shared services.
Establish risk criteria and repeatable risk and impact methods, choose and justify necessary controls in the , operate them, and retain evidence of results.
Use the to organise governance work while separately mapping binding laws, contracts, customer duties, and sector requirements. Certification does not replace those assessments.
Use these guides to define the Artificial Intelligence Management System () required by ISO/IEC 42001, choose controls, assess impacts, and design . Certification covers the defined management-system scope; it does not certify an individual model or automatically prove legal compliance.
ISO/IEC 42001 controls can assign trained people to review AI outputs, monitor performance and accuracy, report concerns, and override decisions under defined authority. For example, a credit reviewer can check the recommendation and its inputs, record a concern, and use the organization's documented override route.
The scope states which business units, locations, AI activities, systems, suppliers, and interfaces the management system covers. are people or organizations that affect, use, regulate, or are affected by that scope, such as workers, customers, regulators, and model suppliers.
An records how a specific use could affect people, groups, or society. For a hiring tool, examine exclusion, accessibility, biased ranking, privacy, explanation, appeal, and human intervention in the actual legal and workplace setting. Reassess on schedule and before a significant change.
selects controls for assessed AI risks. Compare the controls needed with , add any necessary controls outside it, and record inclusion and exclusion reasons in the . The treatment plan also needs management approval and acceptance of residual risk.
Define the boundary and AI-system inventory first. Then map Clauses 4-10, run and impact assessment, operate necessary controls, and evaluate the system. These pages explain the decision path but do not replace the licensed standard.
Determine the organisational boundary, AI activities and roles, relevant and requirements, external interfaces, and system inventory that later risk and control decisions depend on.
Understand Clauses 4-10, the distinct roles of Annexes A-D, leadership and policy, risk planning, support, operation, performance evaluation, and improvement.
Turn risk and impact methods, the , residual-risk approval, selected controls, supplier responsibilities, monitoring, audit, and corrective action into traceable records.
See how ISO/IEC 42001 differs from risk guidance and law, and where ISO/IEC 23894, the NIST AI RMF, or the EU AI Act still require separate interpretation and mapping.
Next steps
Assign tasks, risk and impact decisions, evidence requests, and review checkpoints to the responsible people.
Answer ISO/IEC 42001 scope and interpretation questions with cited outputs.
Keep ISO/IEC 42001 evidence, decisions, and control records in one governed system.
Review scope, evidence gaps, and next implementation steps.