Building and Running the AIMS: Core Requirements of ISO/IEC 42001
The requirement clauses
Clause 4 requires the organization to determine internal and external issues, identify interested parties and their relevant requirements, define and document the AIMS scope, and establish its processes. Trap: the scope may cover part of an organization, but it must not exclude requirements that undermine the AIMS's intended outcomes.
Clause 5 requires top management commitment and a documented AI policy that is communicated, available to interested parties and provides a framework for objectives. Clause 6 covers planning: actions for risks and opportunities, AI risk assessment and treatment, the AI system impact assessment, a Statement of Applicability, and measurable AI objectives.
Clause 7 covers support - resources, competence, awareness, communication and control of documented information. Clause 8 covers operation: operational planning and control, with risk and impact assessments repeated at planned intervals and on significant change. Clause 9 covers monitoring and measurement, the internal audit programme and management review. Clause 10 covers nonconformity, corrective action and continual improvement.
Annex A organizes controls into themes: AI policy, internal organization, resources, assessing impacts, AI system life cycle, data, information for interested parties, use of AI systems, and third-party relationships.
Traps and rule of thumb
Candidates wrongly assume every Annex A control must be applied; the Statement of Applicability must justify each exclusion. Internal audits must be objective and impartial, so the owner of an activity should not audit it. Certification involves a Stage 1 readiness review and a Stage 2 effectiveness audit, then surveillance audits across a three-year cycle.
Rule of thumb: map Plan-Do-Check-Act onto clauses 6-8-9-10. If a question describes a detected defect being fixed, the answer sits in clause 10, not clause 8.
Worked example: a retailer certifies an AIMS for its recommendation engine; the impact assessment flags targeting of minors, the risk assessment flags regulatory exposure, and the treatment - age gating plus human review - is recorded in the Statement of Applicability.