ISO 42001 Foundation key terms

A field of engineering and science focused on building systems that perform tasks commonly associated with human intelligence, such as reasoning, learning, perception, language use and decision making.

An engineered system that produces outputs such as predictions, content, recommendations or decisions from a given set of human-defined objectives, and that operates with some degree of autonomy.

The degree to which an AI system can operate and make decisions without human intervention, ranging from fully human-controlled behaviour to fully self-directed behaviour.

A type of AI in which models learn patterns from data rather than being explicitly programmed with rules, then generalise those patterns to new inputs.

Data used to fit or adjust the parameters of an AI model during development, whose quality, representativeness and provenance strongly shape how the system later behaves.

A systematic and unfair deviation in AI outputs that disadvantages particular groups or produces results inconsistent with intended objectives, often arising from data, design or deployment choices.

AI that meets accepted expectations across dimensions such as fairness, reliability, safety, privacy, security, transparency and accountability throughout its life cycle.

The property of making information about an AI system's purpose, data, limitations and behaviour available to relevant interested parties in an understandable way.

The extent to which the reasons for an AI system's output can be understood and communicated to the people affected by that output.

Measures that let people monitor, intervene in or override an AI system's operation, keeping meaningful human control over consequential decisions.

The state in which a named person or body is answerable for AI-related decisions, actions and their outcomes, and can be held to account for them.

The effect that an AI system has on individuals, groups, society or the environment, whether intended or unintended, positive or negative.

The stages an AI system passes through, from conception and development through deployment and operation to retirement and disposal.

A person or organisation that can affect, be affected by, or perceive itself to be affected by AI-related decisions, activities or their consequences.

A framework of interrelated elements that an organisation uses to set policy, objectives and processes in a particular area and to achieve those objectives.

A set of interrelated or interacting activities that transforms inputs into outputs, and that is planned, resourced and controlled within the management system.

A need or expectation that is stated, generally implied or obligatory, and that must be satisfied for the management system to meet its intended purpose.

The state of fulfilling a specified requirement, such as a clause of the standard or a control the organisation has declared applicable to its AI management system.

The extent to which planned activities are realised and planned results, such as AI objectives and control outcomes, are actually achieved.

The effect of uncertainty on AI-related objectives, including potential harms to individuals, groups or society arising from the development, provision or use of AI systems.

Confirmation that a system was built correctly against its specification and that it meets the needs of its intended use, users and affected parties.

A set of interrelated or interacting elements of an organisation, including policies, processes, responsibilities and resources, used to govern AI and achieve AI-related objectives.

The person or group that directs and controls an organisation at its highest level, with authority to approve AI policy and provide resources for the management system.

Top management's documented overall intentions and direction for AI in the organisation, including commitments to responsible AI, legal compliance and continual improvement.

A measurable result to be achieved that is consistent with the AI policy, set for relevant functions and levels, and tracked for progress.

The overall process of identifying, analysing and evaluating AI-related risk, used to decide whether and how treatment is required.

The process of selecting and applying measures to modify AI risk, then evaluating whether the remaining residual risk is acceptable.

A documented record of the controls chosen to address AI risks, including their rationale, owners, timelines and how results will be evaluated.

A documented statement describing which Annex A controls apply to the organisation's AI management system and justifying any that are excluded.

A structured evaluation of how an AI system may affect individuals and society across its life cycle, used to identify harms and define mitigation and monitoring measures.

Information an organisation must control and maintain, including the AI policy, procedures, records and evidence needed to show the management system works.

The ability of a person to apply knowledge and skills to achieve intended results, determined through education, training or experience relevant to AI work.

A failure to meet a requirement, such as a management system requirement or an internal AI rule, which must be recorded, contained and analysed for cause.

Action taken to eliminate the cause of a nonconformity so that it does not recur, as distinct from merely fixing the immediate problem.

The recurring activity of enhancing the management system's performance, including its AI controls and outcomes, rather than reaching a one-time level of compliance.

An independent, planned examination of the AI management system against defined criteria, carried out by the organisation itself to check conformity and effectiveness.

A periodic review by top management of the management system's performance, risks and opportunities, resulting in decisions about resources and improvement.

The ongoing activity of tracking management system performance and AI system behaviour against defined criteria, to detect problems and inform improvement.

A link with an external organisation that supplies AI systems, data or services, whose AI-related risks the organisation must manage through due diligence and contractual controls.