ISO 42001 Foundation common mistakes
ISO 42001 Foundation · Understand the traps and how to avoid them.
On scenario questions, the candidate recites general AI ethics principles instead of naming the ISO/IEC 42001 clause and management-system process that addresses the situation.
Foundation exams use short scenarios, and candidates over-rely on familiar AI ethics language rather than connecting requirements to the Plan-Do-Check-Act cycle and clauses 4–10.
What to do instead
Build a one-page clause map covering context, leadership, planning, support, operation, performance evaluation, and improvement. For each scenario, practise stating the applicable clause, the process required, and the evidence that would demonstrate conformity.
The candidate treats an ISO/IEC 42001 certificate as proof that a specific AI model is accurate, fair, or safe.
Management-system certification is easily confused with product certification, and vendor marketing around 'AI certification' reinforces the misunderstanding.
What to do instead
State clearly that certification covers the organization's AIMS within a defined scope, not conformity of an AI system's outputs. Separate AIMS conformity from model testing, technical validation, and product assurance.
The candidate uses 'AI risk assessment' and 'AI system impact assessment' interchangeably and describes only risks to the organization in both.
Both processes use risk language and sit in the planning clause, but ISO/IEC 42001 separates risks to the organization from impacts on individuals, groups, and society.
What to do instead
Define each separately: AI risk assessment identifies risks to organizational objectives; AI system impact assessment evaluates effects on individuals, groups, and society. Learn typical inputs, outputs, triggers, and update conditions for each.
The candidate selects every Annex A control as applicable without justification and calls the resulting list the Statement of Applicability.
Annex A is often mistaken for a mandatory checklist, and the risk-based nature of control applicability is not well understood.
What to do instead
Determine applicability from AI risk assessment, AI system impact assessment, legal and regulatory obligations, and organizational context. Document the inclusion or exclusion rationale for each control in the Statement of Applicability and retain it as documented information.
The candidate writes the AIMS scope as 'all AI used, developed, or procured by the organization' without naming boundaries, AI systems, locations, or interfaces.
A broad scope sounds more mature, so candidates confuse an ambitious statement with a defensible scope definition.
What to do instead
Define scope using clause 4 context inputs: internal and external issues, interested parties, AI systems and processes, organizational units, locations, interfaces, and dependencies. Ensure the scope is documented and can be explained to an auditor.
The candidate assigns AI policy drafting to the IT or data-science team and describes top management's role only as signing the finished policy.
Leadership is reduced to endorsement, and clause 5 responsibilities are underestimated in favour of technical authorship.
What to do instead
Show top management establishing and integrating the AI policy, ensuring resources, assigning roles and responsibilities, and reviewing AIMS performance. Treat the policy as a leadership output rather than a technical appendix.
The candidate writes an AI policy containing only aspirational ethics language such as 'responsible, trustworthy AI' with no required management-system commitments.
An ethics statement is confused with a management-system policy, and aspirational language feels safer than specific commitments.
What to do instead
Include the standard's required policy elements, including commitment to satisfy applicable requirements and commitment to continual improvement. Keep the policy appropriate to the organization's purpose and control it as documented information.
When asked about documented information, the candidate names only manuals and procedures and omits records such as risk assessment results, impact assessment results, and audit evidence.
Colloquial use of 'document' and 'record' differs from ISO terminology, so evidence-producing outputs are overlooked.
What to do instead
Treat documented information as including both documents and records. Know which outputs must be retained as evidence and how creation, updating, control, availability, and retention apply.
The candidate describes AI system development as starting at model training and ending at deployment, omitting problem definition, data sourcing, verification, operation, monitoring, and decommissioning.
AI systems are equated with machine-learning models, which hides lifecycle stages and the controls needed at each stage.
What to do instead
Map the AI system lifecycle across conception, data acquisition and preparation, development, verification and validation, deployment, operation and monitoring, and retirement. Assign responsibilities and controls to each stage.
The candidate describes internal audit and management review as activities performed only by the certification body and skips them when explaining how the AIMS is evaluated.
Audit is associated with external certification, and clause 9 requirements are less familiar than planning and operation clauses.
What to do instead
Explain that internal audit and management review are required AIMS processes. Describe how audit scope, criteria, frequency, results, management review inputs, and resulting actions provide evidence of performance evaluation and improvement.