Search every question across sub-FAQs

Control owners design, implement, operate, and monitor controls within their authority. Risk owners evaluate the remaining exposure. The designated management authority approves the risk-treatment plan and accepts residual AI risk. AIMS governance can check coverage and consistency, while top management addresses resources or risk decisions outside delegated authority.

Security, privacy, safety, supplier, legal, product, and business owners should approve matters within their authority. Acceptance of residual AI risk under the AIMS cannot waive a binding legal, contractual, or sector requirement.

Review controls through planned monitoring and whenever risks, impacts, intended purpose, users, affected populations, data, model or system design, suppliers, deployment context, incidents, performance, or applicable requirements change. Review before a significant planned change and after an unintended change or control failure.

When a treatment option is ineffective, ISO/IEC 42001 requires review and revalidation through the treatment process and an updated plan. Determine whether to redesign, add, replace, or withdraw controls; reassess the risk and impact; update the statement of applicability; obtain approval; and verify the revised treatment.

After a nonconformity, control and correct it, deal with consequences, examine causes and similar potential failures where applicable, implement corrective action, and review effectiveness. Keep the remaining risk open until the relevant approval authority accepts it against current criteria.