The management system clauses of ISO 42001 that every certified organization must meet: context and scope, AI policy and roles, AI risk and impact assessment, objectives, competence, documented information, internal audit and management review.
An overview of the mandatory ISO 42001 requirements: what each of clauses 4 to 10 covers, the AI-specific additions such as impact assessment and planning of changes, how they relate to the 38 Annex A controls and the normative Annex B guidance, and what auditors test.
How to set the scope of an ISO 42001 AI management system: deciding your role for each AI system, clause 4.3 scope, scoping part of a larger company, interested parties defined through ISO/IEC 22989, and how the EU AI Act's provider and deployer roles compare.
How to build the ISO 42001 statement of applicability: the 38 Annex A controls in nine areas, justifying inclusion and exclusion of each, the normative Annex B guidance, adding controls from other sources, and keeping it in line with AI risk treatment.
How AI risk assessment and treatment work under ISO 42001: the planning and operation clauses, risk sources in Annex C, ISO/IEC 23894 guidance, how AI risk differs from AI system impact assessment, and how the NIST AI RMF maps to these clauses.
How to set AI objectives under ISO 42001 clause 6.2: the potential organizational objectives and risk sources in Annex C, objectives for responsible development and responsible use in Annex A, and how objectives are monitored and reviewed.
How to evidence competence under ISO 42001 clause 7.2 and document human resources under A.4.6, and how this supports the EU AI Act's AI literacy duty for providers and deployers and its human oversight competence rule.
Which documents and records ISO 42001 requires and how to control them under clause 7.5: AI policy, statement of applicability, impact assessment records, design and technical documentation, event logs, and internal audit and management review records.
How to run the ISO 42001 internal audit programme and management review before certification: clauses 9.2 and 9.3, audit guidance in ISO 19011, the AI policy review link, and how the NIST AI RMF maps executive accountability to management review.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.