ISO 42001 Lead Implementer key terms

The set of interrelated policies, processes, roles, and controls an organization uses to govern and manage its development and use of AI systems, established and maintained as a formal management system.

An engineered system that generates outputs such as predictions, content, recommendations, or decisions for a given set of objectives, operating with varying degrees of autonomy and adaptivity.

The full span of phases an AI system passes through, from conception and data acquisition through design, development, verification, deployment, operation, and eventual retirement or decommissioning.

The effect an AI system has on individuals, groups, society, or the environment, including potential harms, benefits, and effects on rights or fairness, assessed beyond purely technical performance.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity, such as users, regulators, employees, customers, or affected communities.

The internal and external factors, issues, and interested parties relevant to the organization's purpose and to its AI activities that influence how the management system is designed.

The documented boundaries of the management system, defining which organizational units, locations, AI systems, and activities are covered by the AIMS and which are excluded.

Top management's active involvement in the AIMS, demonstrated by establishing policy, ensuring resources, integrating AI governance into business processes, and being accountable for system effectiveness.

Top management's documented statement of overall intentions and direction for AI, including commitments to responsible AI principles, legal compliance, and continual improvement of the management system.

The documented assignment of authority and accountability for AI-related activities, ensuring that responsibilities for the AIMS and for individual AI systems are defined and communicated.

The effect of uncertainty on objectives, expressed as a combination of the likelihood of an event and its consequences, where effects can be negative or positive in AI contexts.

The overall process of identifying, analyzing, and evaluating risk, applied to AI systems and the AIMS to determine which risks require treatment and at what priority.

The documented reference levels and thresholds used to evaluate the significance of risk, reflecting the organization's risk appetite, legal obligations, and ethical expectations for AI.

The process of selecting and implementing measures to modify risk, such as avoiding, mitigating, transferring, or accepting it, and documenting the resulting controls in the AIMS.

A documented plan recording the selected risk treatments, the controls to be implemented, the responsible owners, and the resources and timelines for completing them.

Measurable, consistent goals that the organization sets for its AIMS in line with its AI policy, including what will be done, by whom, with what resources, and by when.

A documented statement listing the applicable controls from the AI control set, justifying inclusion or exclusion of each, and referencing the AIMS's implementation status for those controls.

A measure that maintains or modifies risk, including policies, procedures, technical safeguards, and organizational practices selected from the AI control set or added by the organization.

A statement describing what a group of related controls is intended to achieve, used to structure the AI control set and to guide selection and evaluation of controls.

A structured evaluation of how an AI system may affect individuals, groups, or society, used to identify harms, assess severity and likelihood, and determine mitigations before and during deployment.

The investigation and evaluation an organization performs before committing to a relationship, such as assessing a third-party AI provider's practices, risks, and compliance posture.

The processes used to select, contract, monitor, and review external providers of AI components, data, or services so that their contributions remain consistent with the AIMS.

The fitness of data for its intended AI purpose, covering attributes such as accuracy, completeness, relevance, timeliness, representativeness, and freedom from harmful bias.

The policies and controls governing how data is acquired, labeled, stored, accessed, retained, and disposed of throughout the AI life cycle, including provenance and consent considerations.

A systematic and unfair deviation in AI outputs or in the data and design choices behind them, which can disadvantage particular groups and must be identified and mitigated.

The degree to which appropriate information about an AI system's purpose, behavior, limitations, and decision rationale is communicated so that stakeholders can understand and challenge outcomes.

The arrangement of human review, intervention, and control over an AI system's operation, ensuring that people can monitor, override, or stop the system where appropriate.

The ability to apply knowledge and skills to achieve intended results, ensured through determining necessary AI-related competence, providing training, and evaluating the effectiveness of actions taken.

The state in which personnel understand the AI policy, their contribution to AIMS effectiveness, and the implications of not conforming with management system requirements.

The planned process of determining what, when, with whom, and how information relevant to the AIMS is shared internally and externally, including incident and impact disclosures.

Information required to be controlled and maintained by the organization, including procedures, records, and evidence of results, in whatever medium and format it exists.

An event or situation related to an AI system that causes or could cause harm, disruption, or nonconformity, requiring logging, response, and corrective action.

The systematic determination of the status and performance of the AIMS and its AI systems against defined criteria, using methods that produce reliable, comparable, and analyzable results.

An independent, planned examination of the AIMS against its own requirements and the standard, conducted at defined intervals to determine whether the system conforms and is effectively implemented.

A periodic review by top management of the AIMS's suitability, adequacy, and effectiveness, using defined inputs and producing decisions on improvement, resources, and changes.

A failure to meet a requirement, whether of the standard, the organization's own AIMS processes, or contractual obligations, which must be recorded, evaluated, and addressed.

Action taken to eliminate the cause of a nonconformity so that it does not recur, including analysis of root causes and review of the effectiveness of the action taken.

The recurring activity of enhancing the AIMS's performance and the safety of AI systems, using audit findings, monitoring data, and review outcomes to drive sustained change.

The deliberate, controlled approach to modifying the AIMS or an AI system, considering purpose, consequences, resources, and allocation of responsibilities before changes are made.

An independent third-party assessment that evaluates whether the AIMS conforms to the standard and is effectively implemented, leading to the grant, maintenance, or withdrawal of certification.

The ethical values an organization adopts for AI, such as fairness, accountability, safety, privacy, and sustainability, which inform its policy, objectives, and control selection.