Implementation of an AIMS Based on ISO/IEC 42001
Domain 4 tests Clauses 7 and 8 in practice, plus the Annex A controls: what "implemented" looks like as evidence. Scenario items ask what a control requires or which artefact proves it operates.
Support (Clause 7)
- Competence: determine what AI roles require, provide training or hiring, retain evidence.
- Awareness: staff know the AI policy, their contribution, and the implications of non-conformance.
- Communication: what, when, with whom and how - including external reporting of AI incidents.
- Documented information: available where needed, protected, version-controlled.
Operation (Clause 8) and Annex A in practice
- 8.1 requires process criteria, control in line with those criteria, control of outsourced processes, and documented evidence.
- The three assessments must be re-run on change, not only at start-up.
- Know the Annex A families: A.4 resources (data, tooling, compute, people); A.6 life cycle (design, verification and validation, deployment, operation and monitoring, decommissioning); A.7 data (acquisition, quality, provenance, preparation); A.8 information for interested parties; A.9 responsible use; A.10 third parties.
Worked example
For a credit-scoring model, evidence for A.7 data quality is not the data-quality policy. It is: defined acceptance criteria (completeness, accuracy, representativeness for the applicant population); a scripted check executed at every retrain with recorded pass or fail; a named owner who reviews failures; and retained records from the last three retrains, including one documented exception and its resolution. The reasoning matters: the auditor tests operation over time, so a single clean report proves little, while a series of records with a handled exception proves the process works.
Traps that cost marks
- Declaring Annex A controls implemented because a procedure exists.
- Omitting decommissioning and incident response from life-cycle controls.
- Treating the impact assessment as a one-off launch gate.
- Overlooking supplier and foundation-model dependencies - A.10 applies to them.