Overview
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS). It applies to any organization that develops, provides or uses AI-based products or services, and follows the harmonized structure shared with ISO/IEC 27001. Distinctive elements include the AI system impact assessment, AI-specific risk criteria and 38 reference controls in Annex A.
How the standard is structured
- 4Context of the organization
- 5Leadership
- 6Planning
- 7Support
- 8Operation
- 9Performance evaluation
- 10Improvement
- Annex AReference control objectives and controls
- Annex BImplementation guidance for AI controls
- Annex CPotential AI-related organizational objectives and risk sources
- Annex DUse of the AI management system across domains or sectors
AI system lifecycle field guide
Turn responsible AI intent into a management process that can be operated, measured and improved.
- 1
Map systems and roles
Inventory AI systems and determine how the organization develops, provides, integrates or uses each system, including outsourced components and informal use.
- 2
Define purpose and context
Record intended users, affected people, business purpose, boundaries, dependencies and interested-party needs before selecting safeguards.
- 3
Assess impacts and risks
Set repeatable criteria for AI-related risks and impacts, including individual and societal effects, and identify triggers for reassessment.
- 4
Assign lifecycle controls
Connect treatment decisions to owners, suppliers, data, development, verification, release, human oversight, monitoring and change management.
- 5
Monitor and improve
Review signals from users, incidents, complaints, changes and performance; record corrective actions and verify their effect.
Evidence checklist
- AI inventory and role decisions
- Impact and risk assessments with review triggers
- Supplier responsibilities and change notices
- Release and human-oversight records
- Monitoring measures, incidents and corrective-action closure
Common failure modes
- Treating a supplier model as outside organizational scope
- Measuring only technical accuracy or availability
- Using generic policy text without lifecycle controls
- Leaving AI-related changes out of impact reassessment
Key concepts examiners test
AI system impact assessment
Evaluation of potential consequences of an AI system for individuals, groups and societies.
AI roles
Whether the organization acts as an AI provider, producer, customer, partner or subject — determined under context (4.1).
Statement of Applicability
Documented list of necessary controls with justification for inclusion or exclusion.
Human oversight
Arrangements allowing people to monitor, intervene in or override AI system behaviour.
Data provenance
Recording the origin and processing history of data used by AI systems (A.7).
Preparing for the Lead Auditor exam
- Trace one AI system end-to-end: risk assessment → impact assessment → SoA → operational controls → monitoring.
- Check that impact assessments are refreshed when models are retrained or their intended use changes.
- Sample third-party AI components and verify responsibilities are allocated per A.10.
- Confirm top management can explain how AI objectives align with the AI policy.
Preparing for the Lead Implementer exam
- Start by inventorying AI systems and determining your AI role for each.
- Integrate the AIMS with an existing ISMS to reuse document control, audit and management review.
- Define AI risk criteria that include societal and individual impacts, not just business risk.
- Use Annex B guidance to build life cycle procedures that engineering teams can actually follow.