Fundamental principles and concepts of an AI management system
What an AIMS is, and is not
ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS). It is a management system standard in the harmonized-structure family: clauses 4–10 follow the same skeleton as ISO/IEC 27001 or ISO 9001 (context, leadership, planning, support, operation, performance evaluation, improvement), so experienced auditors recognise the architecture immediately.
The AI-specific content sits in three places:
- Clauses 6 and 8 require two distinct, repeating processes: an AI risk assessment (risks to the organization and its objectives) and an AI system impact assessment (potential consequences for individuals, groups and society, including harms the organization may not feel directly). Novices merge these; exam questions probe the difference.
- Annex A provides control objectives A.2–A.10: policies for AI, internal organization, resources for AI systems, assessing impacts, AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships.
- Annexes B, C and D give implementation guidance, potential objectives and risk sources, and cross-sector guidance. They are informative, not auditable requirements.
Related standards are separate: ISO/IEC 22989 (concepts and terminology), ISO/IEC 23894 (AI risk management guidance), ISO/IEC 38507 (governance implications). None is certifiable in place of 42001.
Trap: questions implying that 42001 certification proves a model is accurate, fair or safe. It proves a functioning management system for AI - governance, risk and impact processes, lifecycle controls - not a property of any model or dataset. Equally wrong: "Annex A must be implemented in full." Controls that are not applicable must be justified and recorded in the statement of applicability.
Rule of thumb: if the question is about the behaviour of an algorithm, it is a technical-standard question; if it is about how the organization decides, records, reviews and controls, it is 42001.