Fundamental Principles and Concepts of an AIMS
Domain 1 fixes the vocabulary the rest of the exam assumes: what a management system is, what makes AI governance distinctive, and which concepts ISO/IEC 42001 borrows from ISO/IEC 22989 (AI concepts and terminology) and ISO/IEC 23053 (ML framework). Items here are definitional and comparative - expect to separate an AIMS from an ISMS, and AI risk from AI system impact.
An AIMS governs, it does not compute
- ISO/IEC 42001:2023 is a certifiable management system standard built on the Harmonized Structure, Clauses 4–10. It specifies requirements to establish, implement, maintain and continually improve an AIMS.
- It governs how an organization develops, provides or uses AI systems. It does not prescribe algorithms, accuracy thresholds or risk levels; technical trustworthiness is informed by ISO/IEC 22989, 23053, 23894 (AI risk management) and 38507 (governance implications).
- The AIMS runs as Plan–Do–Check–Act: plan (Clause 6), do (Clauses 7–8), check (9), act (10).
Two assessment processes, deliberately separate
- AI risk assessment: uncertainty affecting the organization's own objectives.
- AI system impact assessment: consequences for individuals, groups and society, including foreseeable misuse.
- Both recur at planned intervals and on significant change, and both produce documented information.
Worked example
A retailer buys a CV-screening tool. The risk record reads: "regulatory penalty and reputational damage if screening proves biased" - an organizational consequence. The impact record reads: "candidates with non-linear career paths are systematically down-ranked, losing opportunity" - a consequence for individuals. Same system, two records, different owners, different treatments: contractual warranties for the risk, mandatory human review of rejections plus pre-deployment bias testing for the impact. Merging the two into one register loses the marks that test the distinction.
Traps that cost marks
- Assuming certification certifies the AI system's safety or accuracy. It certifies the management system.
- Reading "AI" as generative AI only; the standard covers classical ML and rule-based inference too.
- Confusing interested parties (regulators, customers, affected individuals, employees) with the AI actors defined in ISO/IEC 22989.