ISO/IEC 42001 GuideGlobalISO/IEC 42001

ISO/IEC 42001 AIMS Scope Decision

Define which part of the organisation and which AI-related activities the artificial intelligence management system (AIMS) governs, based on organisational context and relevant interested-party requirements.

ISO/IEC 42001 requires the scope to be documented. The standard does not prescribe one organisation-wide boundary, but the chosen boundary must make the AIMS requirements, controls, roles, and interfaces clear.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

Start with the part of the organisation that will be governed, then identify its roles in developing, providing, or using AI systems. Clause 4 requires the organisation to consider relevant internal and external issues and interested-party requirements, determine the boundaries and applicability, and keep the scope as documented information. The scope must also determine which organisational activities are subject to the standard's management-system requirements, controls, and objectives.

Section 1

What must the AIMS scope decision establish?

Approve a boundary that identifies the organisational unit or combination of units covered by the and the activities that fall inside it. The decision should be specific enough for teams to know which AI-related business processes, products, services, systems, and lifecycle responsibilities must follow the AIMS.

A scope may cover an entire legal entity or only a defined part of a larger organisation. ISO/IEC 42001 defines an organisation to include a part or combination of a larger entity, and its definition of top management follows the part inside the management-system scope. A limited scope is therefore possible, but it must still account for the context and interested-party requirements relevant to that boundary.

Do not confuse the scope with an AI-system inventory or a legal classification. The inventory identifies individual systems; the AIMS scope identifies the organisational boundary and activities governed by the management system. Separate legal analysis determines whether a law applies to a system, role, or use case.

Name the covered organisational units, business functions, and locations, including remote or shared operations where relevant.
Describe the covered products, services, and AI lifecycle activities, such as development, procurement, integration, deployment, operation, monitoring, support, and retirement.
Identify the organisation's roles for the covered AI systems, including whether it provides, develops, integrates, procures, or uses them.
Record interfaces with functions and parties outside the boundary, including shared services, suppliers, partners, and customers.
State any boundary limitation or exclusion and explain why the remaining scope still addresses the relevant context and interested-party requirements.

Sources for this answer

ISO/IEC 42001:2023 - AI management systems

Official ISO listing for edition 1, published in December 2023. Clauses 3 and 4 of the licensed standard define the organisational context, interested parties, management-system scope, and documented scope requirement.

Section 2

Which inputs control the boundary?

Clause 4.1 requires the organisation to determine the internal and external issues relevant to its purpose and ability to achieve the intended results. It must consider the intended purpose of the AI systems it develops, provides, or uses and determine its roles in relation to those systems. Applicable laws, regulator positions, contractual obligations, governance arrangements, organisational objectives, and intended uses can all affect that analysis.

Clause 4.2 then requires the organisation to identify relevant interested parties, their relevant requirements, and which requirements the will address. Depending on the context, interested parties can include personnel, users, customers, suppliers, partners, affected individuals or groups, regulators, and governing bodies.

Keep the context and interested-party analysis alongside the scope decision. A scope statement without these inputs does not show how the organisation applied the Clause 4 tests.

Context record: business purpose, AI activities, intended uses, organisational roles, internal issues, external issues, and applicable jurisdictions.
Interested-party record: party or category, relevant requirement, source of that requirement, and whether the addresses it.
AI-system inventory: covered systems or system groups, owners, intended purposes, lifecycle status, suppliers, users, and links to risk and impact records.
Interface map: services, processes, data, models, infrastructure, or decisions supplied across the boundary.
Approval record: scope owner, approving top management, rationale, approval date, version, and review trigger.

Sources for this answer

ISO/IEC 42001:2023 - AI management systems

Clauses 4.1 to 4.3 of the licensed standard establish the context, interested-party, role, and scope inputs summarised here.

Section 3

How should the scope decision be made?

Make the decision in a fixed sequence so the written boundary follows the evidence. Begin with the organisational purpose and candidate boundary, map the AI-related roles and activities inside it, then test that proposal against context, interested-party requirements, and external interfaces.

After approval, use the same scope in the AI policy, objectives, risk criteria, risk and impact assessment processes, statement of applicability, operational controls, monitoring, internal audit, and management review. If certification is pursued, the certification scope should accurately reflect the implemented boundary and activities.

1. Propose the organisational units, locations, products, services, and activities to be covered.
2. Map each covered unit's roles in developing, providing, procuring, integrating, operating, or using AI systems.
3. Identify relevant internal and external issues and the requirements of relevant interested parties.
4. Map dependencies and responsibilities that cross the proposed boundary.
5. Test whether exclusions or limitations leave material activities or responsibilities unexplained.
6. Approve and version the documented scope, then align downstream records and assurance statements to it.

Sources for this answer

ISO 42001 explained

ISO's public explainer describes an AIMS as policies, processes, and controls and lists inventory, roles, risk assessment, monitoring, and improvement as practical starting points.

Section 4

How should suppliers and shared services be handled?

A supplier, cloud platform, model provider, data provider, or shared corporate service can sit outside the organisational boundary, but that does not remove the organisation's responsibilities for the covered activity. Clause 8 requires externally provided processes, products, or services relevant to the to be controlled. Annex A also includes reference controls for allocating lifecycle responsibilities and managing suppliers and customers.

Document what the external party provides, which lifecycle responsibilities remain with the organisation, which controls or evidence the organisation expects, and how failures or changes are escalated. Contract terms can support that allocation, but operating evidence should also show that the organisation reviews the service and acts on material findings.

Do not treat outsourcing as an automatic scope exclusion.
Do not omit shared data, infrastructure, security, procurement, or monitoring dependencies needed to operate the .
Do not assign the same responsibility to both parties without stating who decides, performs the work, provides evidence, and handles exceptions.
Do not claim that an scope determines legal responsibility; map statutory roles and duties separately for each applicable jurisdiction.

Sources for this answer

ISO/IEC 42001:2023 - AI management systems

Clause 8.1 and the Annex A.10 reference controls in the licensed standard address external provision and allocation of responsibilities among the organisation, partners, suppliers, customers, and third parties.

Section 5

When must the scope be reviewed?

ISO/IEC 42001 does not set a universal annual scope-review date. Management review must occur at planned intervals and consider changes in relevant internal and external issues and interested-party needs and expectations. Use those inputs to decide whether the scope remains suitable.

Review earlier when the organisation acquires or disposes of a business, launches a materially different AI product or use, changes its role in an AI lifecycle, adds a location, restructures ownership, changes a critical supplier or shared service, enters a new jurisdiction, or receives a new legal, contractual, or regulator requirement. If the boundary changes, update the scope document and every process, record, audit programme, and external claim that relies on it.

Record the review date, trigger, evidence considered, decision, approver, and affected downstream records.
Open a corrective action if an audit finds that the documented boundary does not match actual operations.
Do not keep using a certification or customer-assurance description after the implemented scope has materially changed; confirm the required action with the relevant certification body or customer.

Sources for this answer

ISO/IEC 42001:2023 - AI management systems

Clauses 9.3 and 10 of the licensed standard require planned management review, decisions about needed AIMS changes, continual improvement, and corrective action.

Recommended next step

Put the approved AIMS boundary into operation

Record the boundary, context, interested parties, external interfaces, owner, approval, and review triggers, then use the same scope across the AIMS.

Assessment workflow

Open Assessment Autopilot for ISO/IEC 42001

Convert the approved AIMS boundary into accountable tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through implementation

Review your current scope, evidence gaps, and next implementation steps.

Explore next step

Primary sources

References and citations

ISO 42001 explained

iso.org

Referenced sections

ISO's public explainer describes an AIMS as policies, processes, and controls and lists inventory, roles, risk assessment, monitoring, and improvement as practical starting points.

ISO/IEC 42001:2023 - AI management systems

iso.org

Referenced sections

Clauses 9.3 and 10 of the licensed standard require planned management review, decisions about needed AIMS changes, continual improvement, and corrective action.

Related guides