ISO 42001 Lead Implementer flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

AI management system

The interrelated policies, objectives, processes and responsibilities an organization uses to direct and control its development, provision and use of AI, as specified by ISO/IEC 42001.

AI system

An engineered system that generates outputs such as predictions, content, recommendations or decisions for human-defined objectives, operating with varying degrees of autonomy and adaptivity.

AI system impact

The effect an AI system has on individuals, identifiable groups, society or the environment, assessed separately from organizational risk because it concerns harm to others, not just to the organization.

Harmonized Structure

The common clause framework (scope, context, leadership, planning, support, operation, performance evaluation, improvement) that lets ISO/IEC 42001 be integrated with ISO 9001 and ISO/IEC 27001.

AI system owner

The named person accountable for a specific AI system across its lifecycle, with defined authority for its risk decisions, performance and conformity with the organization's AI policy.

AIMS scope statement

Documented information defining the boundaries of the management system - organizational units, products, services and locations covered - and the applicability of requirements within those boundaries.

AI policy

Top management's documented direction for AI: appropriate to purpose, committing to applicable requirements and continual improvement, providing a framework for objectives, and communicated and available.

AI risk assessment

A Clause 6 process that identifies, analyzes and evaluates risk to the organization's AI objectives against defined criteria, producing documented information that is retained and updated.

AI system impact assessment

A required evaluation of how an AI system affects individuals, groups, society and the environment, used to decide whether the system may proceed and what safeguards are needed.

Annex A controls

The reference control set in ISO/IEC 42001 organized by theme, covering policies, organization, resources, impact assessment, lifecycle, data, transparency, use and third parties.

Statement of Applicability

Documented justification listing each Annex A control, declaring it applicable or not, and recording the reason for inclusion or exclusion; a primary entry point for auditors.

Gap analysis

A structured comparison of current practice against Clauses 4-10 and applicable Annex A controls, producing a register of missing controls and documentation with owners and target dates.

Risk criteria definition

Pre-agreed thresholds for acceptable AI risk, impact levels, assessment frequency and escalation to top management, established before assessment so results are comparable and defensible.

Risk-based control selection

The planning decision that determines which Annex A controls apply, based on assessed risk and impact, with exclusions justified and retained as documented information.

Boundary risk

The exposure created when an AI system is excluded from the AIMS scope but still used or provided by the organization, undermining the credibility of the scope statement.

Implementation roadmap

The sequenced plan from gap analysis through risk and impact assessment, control implementation, internal audit, management review and certification, with owners and milestones.

AI system inventory

A controlled record of every AI system with its purpose, owner, lifecycle stage, data sources, model type, users, and risk and impact rating; the backbone of implementation.

AI lifecycle controls

Controls applied from requirements and design through data preparation, model building and validation, deployment, operation and monitoring, to decommissioning of the AI system.

Data provenance record

Documented lineage of training and operational data: source, collection method, lawful basis, transformations, quality checks and retention or disposal rules applied.

Human oversight design

The specified arrangement of which AI-influenced decisions require human review, what information reviewers receive, and how override and escalation operate in practice.

Model change control

Version control and approval over models, datasets and prompts, with environment separation, testing before release and traceability of what changed, who approved it and when.

AI incident handling

The process for detecting and responding to AI-specific events such as harmful or biased output, model drift, data leakage, prompt injection and misuse, including corrective action.

Monitoring plan elements

The defined answer to what is measured, by which method, when, by whom results are analyzed, and when they are evaluated against criteria for the AIMS.

Model drift trigger

A pre-agreed threshold comparing production behavior to a baseline that, when crossed, mandates investigation and possible retraining, rollback or decommissioning of the model.

Internal audit programme

The planned schedule of objective, impartial audits covering all clauses and applicable controls, weighted by process importance and prior results, with auditors independent of the work audited.

Management review inputs

Required review content: audit results, nonconformities and corrective actions, monitoring results, risk and impact status, and interested-party feedback, leading to documented decisions.

Auditable AI objective

An objective stated with a measurable indicator, a target value, a deadline and an accountable owner, so that progress can be evidenced to an auditor.

Major nonconformity

A certification audit finding of a systemic failure or an unaddressed requirement affecting the management system's ability to achieve intended results; usually requires follow-up verification.

Corrective action

Action taken to eliminate the root cause of a detected nonconformity so it does not recur, evidenced by the analysis method, the action and verification of effectiveness.

Stage 1 certification audit

The readiness review that examines documentation, scope, and AIMS structure to confirm the organization is prepared for the Stage 2 evaluation of implementation and effectiveness.

Stage 2 certification audit

The on-site evaluation of whether the AIMS is implemented and effective, sampling evidence for conformity with Clauses 4-10 and the controls declared applicable.

Surveillance audit

A periodic audit after initial certification, at least annually within the three-year cycle, checking continued conformity and specified areas rather than repeating the full assessment.

Recertification audit

The full audit conducted before the three-year certificate expires to confirm the AIMS remains suitable, adequate and effective, renewing certification for a further cycle.