ISO 42001 Foundation cheat sheet

ISO/IEC 42001:2023 specifies requirements for an artificial intelligence management system (AIMS) and is certifiable; it addresses organizational governance and processes rather than prescribing specific AI technology or product safety thresholds.

The AIMS follows the Plan–Do–Check–Act cycle: Clauses 4–6 establish context, leadership, and planning; Clauses 7–8 provide support and operation; Clause 9 evaluates performance; Clause 10 drives improvement.

AI system: an engineered or machine-based system that infers, for explicit or implicit objectives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.

Two distinct assessments are required: AI risk assessment addresses uncertainty and consequences for organizational objectives; AI system impact assessment addresses effects on individuals, groups, and society.

AI risk assessment output includes identified risk sources, potential consequences, likelihood, level of risk, and treatment options; impact assessment output includes affected parties and the significance of impacts.

Interested parties can include customers, users, affected communities, regulators, suppliers, and employees; their relevant needs and expectations inform AIMS scope and control selection.

Annex A controls are selected based on AI risk assessment, AI system impact assessment, and organizational context; the statement of applicability records included controls, justified exclusions, and implementation status.

Documented information must be controlled for availability, protection, and retention; the extent of documentation depends on organizational size, context, AI systems, and process complexity.

Continual improvement is a required outcome: nonconformities trigger correction, analysis of causes, corrective action, and review of the effectiveness of actions taken.

Clause 4 requires determining external and internal issues, interested-party requirements, and the AIMS scope; the scope must be documented and available as documented information.

Clause 5 requires top management leadership, a documented AI policy, and assigned roles, responsibilities, and authorities; the policy must be communicated and available to relevant parties.

Clause 6.1.2 requires AI risk assessment to identify risk sources, potential consequences, likelihood, and level of risk; Clause 6.1.3 requires treatment options and residual risk determination.

Clause 6.1.4 requires AI system impact assessment to consider impacts on individuals or groups and societal impacts; Clause 8.4 requires performing it at planned intervals or after significant change.

Clause 7 requirements cover resources, competence, awareness, communication, and documented information; competence is determined for persons whose work affects AI performance or the AIMS.

Clause 8 requires operational planning and control, execution of AI risk assessment and impact assessment at planned intervals or on significant change, and implementation of risk treatment.

Clause 9 requires monitoring, measurement, analysis, evaluation, internal audits at planned intervals, and management review covering suitability, adequacy, effectiveness, and improvement opportunities.

Clause 10 requires correcting nonconformities, evaluating the need to eliminate causes, reviewing corrective action effectiveness, and continually improving the AIMS.

Annex A control families: A.2 policies; A.3 internal organization; A.4 resources; A.5 impacts; A.6 life cycle; A.7 data; A.8 information for interested parties; A.9 use; A.10 third-party and customer relationships.