Fundamental Principles and Concepts of an AI Management System
What a management system is
An AIMS is the set of interrelated policies, objectives, processes, roles and documented information an organization uses to govern its AI. ISO/IEC 42001:2023 uses the Harmonized Structure shared with ISO 9001 and ISO/IEC 27001, so clauses 4-10 cover context, leadership, planning, support, operation, performance evaluation and improvement. Knowing that skeleton lets you place almost any question.
AI-specific concepts
An AI system is engineered to operate at varying levels of autonomy and produces outputs - predictions, recommendations, content or decisions - that affect people and environments. Data dependence, opacity, adaptivity and emergent behaviour at scale explain why generic IT governance is not enough.
The central principle is risk-based thinking with two separate assessments. The AI risk assessment examines uncertainty affecting organizational objectives. The AI system impact assessment examines consequences for individuals, groups and society - fairness, safety, privacy, autonomy, rights. Confusing the two is the most common exam trap.
Other concepts a candidate must name: accountability, transparency and explainability proportionate to context, human oversight, fairness, reliability, security and privacy, data quality and provenance, life-cycle thinking from conception to decommissioning, and continual improvement through Plan-Do-Check-Act.
Traps and rule of thumb
ISO/IEC 42001 certifies a management system, not a model: it proves no accuracy level and no ethical outcome, and prescribes no algorithm, threshold or technology. Annex A controls are selected and justified, not universally mandated.
Rule of thumb - "management system, not model": a question about governance, roles, records or review is in scope; a question about a specific model's benchmark score is not.