ISO 42001 Controls and Governance Model

The standard expects the organization to determine its role with respect to each AI system and then allocate responsibilities and authorities accordingly. Governance depth should change depending on whether the organization develops, provides, integrates, procures, or uses the system.

Annex B emphasizes that accountability should cover impact assessment, supplier relationships, data quality management, and human oversight where relevant.

Annex A is not a marketing checklist. It includes concrete control areas for AI policy, roles, resources, impact assessment, AI system life cycle, data, information for interested parties, use of AI systems, and third-party relationships.

Risk treatment under clause 6 must compare selected controls with Annex A to confirm that no necessary controls were omitted. Additional controls can be required beyond Annex A, and exclusions should be justified.

Annex B gives the practical detail most teams miss. Operation and monitoring should cover system and performance monitoring, repairs, updates, support, drift signals, incident handling, and communication to users when changes affect system behavior or intended use.

The governance model should therefore be expressed as recurring routines, not static documents.