Artificial Intelligence Management System Requirements
Domain 2 tests the auditable requirement text of Clauses 4–10 and the documented information each clause demands. Typical items ask which clause requires a given artefact, or what a compliant scope statement or policy must contain.
The clause skeleton
- 4 Context: internal and external issues, interested parties and their requirements, AIMS scope, the AIMS itself.
- 5 Leadership: top management commitment, an AI policy committing to satisfy applicable requirements and to continual improvement, and assigned roles and authorities.
- 6 Planning: actions for risks and opportunities, AI risk assessment, AI risk treatment, AI system impact assessment, AI objectives and plans, planning of changes.
- 7 Support: resources, competence, awareness, communication, documented information.
- 8 Operation: operational planning and control, plus re-running the risk assessment, risk treatment and impact assessment.
- 9 Performance evaluation: monitoring and measurement, internal audit, management review.
- 10 Improvement: continual improvement, nonconformity and corrective action.
Annex A and documented information
Annex A holds reference control objectives A.2–A.10 - policies, internal organization, resources for AI systems, impact assessment, AI system life cycle, data, information for interested parties, use of AI systems, third-party relationships - with guidance in Annex B. Controls are selected and justified through risk treatment, not ticked wholesale. Mandatory documented information includes scope, AI policy, risk assessment results, risk treatment plan, impact assessment results, objectives, competence evidence, and audit and management review results.
Worked example
An insurer writes: "Scope: the AIMS covers our AI-enabled claims triage system, operated by a third-party vendor." An auditor accepts this only if the statement also defines boundaries and applicability. Outsourcing does not remove the system from scope - A.10 (third-party relationships) and Clause 8.1 (control of outsourced processes) still apply. A robust statement names the systems, organizational units, life-cycle stages covered, and interfaces with providers and customers.
Traps that cost marks
- An "AI policy" that is a values statement, missing the commitments Clause 5.2 requires.
- Objectives with no measurable criteria, owner, resource or timeframe.
- Treating documented information as "a document exists" rather than created, updated, controlled and retained.
- Writing a scope to match the org chart instead of the AI systems under the organization's control.