ISO 42001 implementation plan: the phases, owners, deliverables and decision points of an ISO/IEC 42001 project

What an ISO/IEC 42001 implementation plan covers

ISO/IEC 42001 does not require a project plan; it requires an AI management system that operates. The plan is how you get there without losing months: a one-page schedule naming, for each block of work, its owner, its output, its weeks and the decision it waits for.

Three things set an AIMS project apart. The unit of work is the AI system: each one in scope needs an owner, a risk assessment, an impact assessment and life-cycle records, so the inventory sets the size of the plan. The Planning clause gives management a formal decision, approving the AI risk treatment plan and accepting the residual risks, which belongs in the schedule as a dated gate. And AI systems change while you implement, so the plan needs a trigger for reassessment after significant change.

The phases: weeks, deliverables, owners and decision points

Ranges assume a manageable number of AI systems in scope; your plan puts a date on each row.

Phases 3 and 4 overlap on purpose. Once one system's treatment is agreed, its controls start producing records while the next is still being assessed. The detailed calendar and the certification body's lead times sit in ISO/IEC 42001 timeline: how long certification takes, stage by stage; what the phase 2 report contains is covered in ISO/IEC 42001 gap analysis: what it covers and what you get.

Who does the work: the roles in an AIMS project

The Leadership clause makes top management responsible for the AIMS and requires roles, responsibilities and authorities to be assigned; Annex A adds a control on AI roles and responsibilities. In project terms that gives five roles.

• Sponsor. A member of top management who owns the target date, releases people's time and takes the decisions in the table. Accepting residual AI risk is a management judgement, not a technical sign-off, so this is where the sponsor's attention matters most.
• AIMS lead. Runs the weekly session, keeps the inventory and documented information in order and prepares the audits.
• AI system owners. One accountable person per system in scope, who takes part in its assessments, keeps its life-cycle and data records current and explains it at Stage 2.
• Contributors. Data scientists and engineers for design, verification and data provenance; legal and privacy for obligations; procurement for suppliers of models and data. Budget their hours, because they are rarely free.
• Internal auditors. At least two trained people who can audit areas other than their own and understand AI life-cycle practice well enough to test the records. ISO/IEC 42001 internal audit: auditing an AI management system covers the method.

Design™ or Drive™: choosing the route

In Sterling OS™, the method behind every Sterling engagement, Design™ and Drive™ are alternative routes through phases 1 to 6; you take one or the other. Under Design™ your team implements while Sterling coaches and runs workshops; under Drive™ Sterling's consultants carry the agreed share of the work with your system owners. Automate™, the AIMS in Effivity, spans every phase, and Sustain™ is phase 7.

Design™ suits an AIMS lead with time and owners used to documenting their work, often where an ISMS already runs. Drive™ suits a fixed customer or tender deadline, many AI systems or technical teams with no drafting time. Neither route shortens how long the controls must operate before Stage 2.

Five mistakes that stall ISO/IEC 42001 projects

• Starting without an inventory. Teams write the AI policy first, then find systems nobody listed, including AI features inside tools already bought.
• Treating the impact assessment as a report. Written once, filed and forgotten, it never feeds the risk assessment as the standard requires. Schedule it inside phase 3 for each system and link its results to the risk register.
• Leaving third-party models out of the plan. A supplier's model brings responsibilities, documentation requests and checks that need owners and dates.
• Building a second system beside the ISMS. Separate document control, audits and reviews double the effort. Extend what exists; ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS shows how.
• Contracting the certification body late. Accredited ISO/IEC 42001 certification is newer than for established standards, and auditor availability can set your Stage 1 date. Choose the body in phase 4, not after the management review.

Keeping the plan and the evidence in one place

A plan in a spreadsheet and evidence in shared drives drift apart. In a Sterling engagement both sit in Effivity, the Sterling group's ISO and GRC platform, used in 50+ countries and included with the engagement at no additional cost: actions and milestones with owners and due dates, the AI system inventory as a register configured for you, the risk register and treatment plan, and the audit, corrective action and review records. More detail is in Effivity for ISO/IEC 42001: the guide.

ISO/IEC 42001 implementation plan: questions buyers ask