ISO/IEC 42001 Compliance

ISO/IEC 42001 defines conformity as fulfilment of a requirement. A conformance assessment therefore asks whether the scoped AIMS fulfils the standard's requirements and whether its processes are effectively implemented and maintained. It does not ask whether one model passed a product test.

Decide which assurance outcome is needed. An organisation can assess itself, ask a customer or other second party to assess it, or seek voluntary certification from an independent certification body. ISO does not certify organisations. Accreditation is separate recognition of a certification body's competence and is not compulsory.

State every claim precisely. Name the edition, the organisational and activity scope, the type of assessment, the assessor or certification body where applicable, and the current status. Do not describe readiness work or an internal assessment as certification.

Build an evidence map from each requirement to its owner, process, controlled document, operating record, and review method. Evidence must match the defined AIMS scope and the organisation's actual roles in developing, providing, or using AI systems.

Some requirements call for documented information explicitly, while others can be demonstrated through records of an operating process. Clause 7.5 also requires the organisation to control required AIMS information for availability, protection, access, storage, change, retention, and disposition. Keep the amount of documentation needed for the standard and effective operation, but make it traceable and current.

Assess the Clause 6.1.3 decision process, not only the final control list. The organisation must use its risk-assessment results to select treatment options, determine all necessary controls, compare them with Annex A so necessary controls are not omitted, consider relevant Annex A controls and Annex B guidance, and identify additional controls where needed.

The statement of applicability must list the necessary controls and justify inclusion and exclusion. Annex A is normative, but it is a reference set rather than a universal checklist: the standard allows controls to be excluded when they are not necessary and additional controls to be designed or taken from other sources. Annex B is also normative, but its implementation guidance does not have to be included or excluded in the statement of applicability and may be adapted when it is not suitable or sufficient.

Check that designated management approved the treatment plan and accepted residual AI risks, and that the selected controls are implemented, monitored, and reviewed for effectiveness.

Internal audits must occur at planned intervals and determine whether the AIMS conforms both to the organisation's own requirements and to ISO/IEC 42001, and whether it is effectively implemented and maintained. The audit programme must define frequency, methods, responsibilities, planning, reporting, and the objectives, criteria, and scope of each audit. Auditors must be selected and audits conducted to preserve objectivity and impartiality.

Top management must review the AIMS at planned intervals. Inputs include earlier actions, changes in context and interested-party needs, trends in nonconformities, corrective actions, monitoring, measurement, and audit results, plus opportunities for improvement. The review must produce decisions on improvement opportunities and needed AIMS changes.

Use representative operating samples across the scope. A policy's existence does not show that risk assessments, impact assessments, supplier controls, monitoring, incident handling, or corrective actions work.

Confirm the intended certificate scope with candidate certification bodies before the audit and ask what accreditation covers their AIMS certification service. Verify the body's identity and accreditation status through the relevant accreditation body or recognised database where applicable. ISO recommends evaluating more than one certification body and checking the relevant conformity-assessment standard and accreditation.

Before the external audit, complete the organisation's internal audit and management review, close or control known nonconformities, and confirm that records represent normal operation. Do not create a separate audit-only process. After certification, continue planned monitoring, internal audits, management reviews, corrective action, and change control.

Describe the certificate as assurance about the named management system and scope. Do not claim that ISO certified the organisation, that the certificate covers systems outside its stated scope, or that it proves every AI system is safe, accurate, unbiased, or legally compliant.