AI management system requirements
Navigating clauses 4–10
An auditor must be able to walk the requirements without a copy in hand.
- 4 Context: external and internal issues, interested parties and their relevant requirements, a documented AIMS scope, and the management system itself.
- 5 Leadership: top-management commitment, an AI policy, and assigned roles, responsibilities and authorities.
- 6 Planning: 6.1.2 AI risk assessment (criteria, methodology, identification, analysis, evaluation); 6.1.3 risk treatment and the statement of applicability; 6.1.4 AI system impact assessment; 6.2 measurable AI objectives with plans, resources, owners, timing and evaluation.
- 7 Support: resources, competence, awareness, communication, and documented information (creation, control, retention).
- 8 Operation: 8.1 operational planning and control; 8.2 and 8.3 repeat risk assessment and treatment at planned intervals or on significant change; 8.4 repeats the impact assessment. Clause 6 defines how you will do it; clause 8 is the doing, with records.
- 9 Performance evaluation: monitoring and measurement, internal audit, and management review with specified inputs and outputs, including decisions on improvement and changes to the AIMS.
- 10 Improvement: nonconformity, correction, corrective action addressing root cause, and continual improvement.
Annex A controls are audited through clauses 6, 8 and 9: the organization selects them, justifies exclusions, implements them in operations and evaluates their effectiveness.
Traps: assuming a documented AI policy alone satisfies clause 5 (it must be communicated, available and drive objectives); accepting "risk assessment done once at design" when 8.2 requires repetition; confusing management review with a project or deployment board; forgetting that 6.2 objectives must be measurable and monitored.
Rule of thumb: 6 plans, 8 performs, 9 proves, 10 improves. When asked where evidence of a requirement lives, find the clause and then find its record.