ISO/IEC 42001 Controls and Governance Model

Start with the AIMS scope, context, interested parties, AI policy, objectives, and assigned roles. For each in-scope AI system, connect risks and impacts to treatment decisions, controls, accountable owners, operating evidence, monitoring criteria, escalation authority, and review forums.

Separate authority clearly. A governing body, where one exists, is accountable for organisational performance and conformance; top management leads the AIMS under Clause 5; named AIMS roles report performance; system and control owners operate processes; internal audit evaluates the AIMS objectively; authorised roles decide risk acceptance and corrective action.

Annex A is the reference control set. Its groups cover policy, internal organisation, resources, impact assessment, lifecycle processes, data, information for interested parties, responsible use, and third-party and customer relationships. Annex B is normative implementation guidance, but it is not always suitable or sufficient and can be extended or modified for organisation-specific risk treatment.

Annex A.8 supports information and communication decisions, but it does not create one universal public-disclosure rule. Record which information must be provided, to whom, when, in what form, and from which organisational, legal, regulatory, or contractual source.

Clause 6.1.3 requires an AI risk treatment process. The organisation chooses treatment options, determines necessary controls, compares them with Annex A so no necessary control is omitted, and produces a statement of applicability that documents necessary controls and justifies inclusion or exclusion. The organisation can add controls beyond Annex A.

A selected control needs more than a policy reference. Record the risk or requirement it addresses, control objective, owner, procedure, affected systems and lifecycle stages, dependencies, evidence, effectiveness criterion, monitoring frequency, exception authority, and change trigger.

Route new systems and significant changes through inventory, scope, risk, impact, treatment, control implementation, release, and monitoring decisions. Route incidents, adverse trends, audit findings, complaints, supplier changes, and nonconformities back to the affected assessment or control owner.

Management review uses performance, monitoring, audit, interested-party, risk, opportunity, and resource information to decide changes and improvement. Corrective action remains open until the organisation has addressed the cause and reviewed effectiveness.

A copied Annex A checklist is not a completed governance model. Without organisation-specific risk treatment, a statement of applicability, owners, operating evidence, and effectiveness criteria, it cannot show why a control is needed or whether it works.

Keep standards, law, regulation, contracts, and policy distinct in the control record. ISO/IEC 42001 can organise the process, while another source may create a binding disclosure, retention, testing, approval, or notification duty.

Review a control when the system, intended use, risk, impact, data, technology, supplier, customer allocation, performance, incident pattern, applicable requirement, or organisational context changes. Review it when evidence shows that the control did not achieve its intended result.

Management review should produce decisions and actions, not only minutes. Record changes to the AIMS, resources, objectives, controls, risk acceptance, scope, and improvement priorities, with owners and follow-up dates.