Planning of an AIMS Implementation Based on ISO/IEC 42001
Domain 3 is the programme layer: how an organization sequences the build so the AIMS is coherent and auditable. Items give a scenario - organization size, sector, an existing ISO/IEC 27001 certificate, an immature AI inventory - and ask what to do first or what belongs in the implementation plan.
A sequence that survives audit
- Context and gap analysis against ISO/IEC 42001, including overlap with existing management systems.
- Scope definition and an AI system inventory. You cannot risk-assess what you have not listed.
- Leadership: an executive sponsor, the AI policy, and named roles - AI governance lead, AI system owner, risk owner.
- Method design: risk criteria and scales, the impact assessment method, control selection from Annex A.
- Execution: risk assessment, then treatment plan, then an impact assessment per system.
- Operationalize: procedures, competence, communication, documentation.
- Prove it: monitoring, internal audit, management review, corrective action.
The shared structure lets you reuse an existing risk methodology, document control and audit programme, while keeping AI-specific processes - impact assessment, data governance, life-cycle control - explicit and separate.
Worked example
A 400-person SaaS company holding ISO/IEC 27001 wants certification in nine months. Weak planning starts by drafting procedures. Strong planning: months 1–2 context, scope and inventory, which finds 11 AI features across four products and two vendors; month 3 policy, roles and criteria; months 4–5 assessments on the three highest-impact systems; months 6–7 procedures and training; month 8 internal audit; month 9 management review, then stage 1. It is defensible because each phase produces the input the next consumes, and one full PDCA cycle completes before the certification audit.
Traps that cost marks
- A method invented per system, so results cannot be compared or aggregated.
- Booking stage 2 before internal audit and management review have been performed.
- Planning for a certificate rather than for a working cycle; auditors sample effectiveness, not folders.
- Treating the AI inventory as an IT asset list that omits vendor-supplied and embedded models.