ISO 42001 nonconformities: major and minor findings in an AIMS audit, and how to close them

Major and minor: how an AIMS finding is graded

A nonconformity is a requirement not met, whether it comes from ISO/IEC 42001, a control declared in your Statement of Applicability or your own procedure. Certification bodies that audit an AIMS are accredited to ISO/IEC 17021-1, with ISO/IEC 42006 adding requirements specific to AI management systems, and ISO/IEC 17021-1 defines the two grades.

A major nonconformity is one that affects whether the management system can achieve its intended results. Two situations can push a finding into that grade: serious doubt that a process is under effective control, or several minors against the same requirement that together show the system failing rather than one lapse. A minor is a real gap that leaves the system able to work. An opportunity for improvement is neither, and needs no formal response.

Where ISO/IEC 42001 findings usually arise

The standard links its core records tightly, so findings cluster. Clause 6.1.3 expects the controls you selected to be compared with the 38 in Annex A, recorded in a Statement of Applicability with a justification for each inclusion and exclusion, and a treatment plan approved by designated management with the residual risk it accepts. Clauses 8.2 and 8.4 expect both assessments repeated at planned intervals and on significant change.

• Records that disagree: a registered risk with no matching control, or a control marked implemented that no record reflects.
• Assessments frozen at launch: a model retrained, a new data source added or a use extended, with no reassessment on file.
• Supplier blind spots: a third-party model used with no allocation of responsibilities.

The audit questions guide lists what auditors ask in each area, and the Stage 1 and Stage 2 guide explains when.

How an auditor writes a nonconformity

Accredited certification rules require every nonconformity to name the specific requirement, give a clear statement of what is wrong, and identify in detail the objective evidence behind it. An AIMS example:

• Requirement: clause 8.4, AI system impact assessment: assessments are repeated at planned intervals or when significant changes are proposed or occur.
• Evidence: the customer-support chatbot moved to a new underlying model and began answering billing queries; its latest impact assessment predates both changes.
• Statement: the organisation could not show that the impact of significant changes to an in-scope AI system had been reassessed.

The auditor must discuss each finding with you so the evidence is right: the moment to produce a reassessment that exists but was not shown. The auditor may not suggest the cause or the fix.

Correction, root cause and corrective action under clause 10.2

ISO/IEC 42001 follows the harmonised structure, so clause 10.2, Nonconformity and corrective action, carries the same logic as other management system standards. It applies however the nonconformity surfaced: audit, complaint, incident or internal audit. Taking the chatbot finding above:

Correction: deal with this case

Assess the chatbot's impact as it now runs. Feed its results into the risk assessment, as clause 6.1.4 requires, and update the treatment plan and Statement of Applicability if new controls are needed. Deal with consequences already visible, such as billing answers given without the checks now required.

Root cause: why did it happen?

Here, the engineering change process approved model and knowledge-base changes on technical grounds and had no step that told the AIMS lead. Then check whether other systems changed the same way.

Corrective action: remove the cause

Add a reassessment trigger to the change process, with criteria for what counts as significant, and a check at each release that the impact assessment is current. Review whether it worked at the next change, and keep the record.

The deadline and the evidence that closes it

The certification body, not the standard, sets the time you have. At the closing meeting it tells you the timeframe for presenting your plan for correction and corrective action. It then reviews your causes and actions and verifies them by an additional full or limited audit, or by documented evidence confirmed later. A major is verified before the certification decision; for a minor, an accepted plan is normally enough then.

Evidence that closes an AIMS finding shows what has changed, not what is planned:

• the missing assessment or approval, dated after the audit and signed by someone with authority;
• the changed procedure or template, under a new revision;
• the first records produced under it, such as a change ticket that triggered a reassessment;
• for effectiveness, a sample from the other systems showing the gap was not repeated elsewhere.

Six typical ISO/IEC 42001 nonconformities and their fixes

These are composites, not extracts from any report. Grades assume an isolated case and rise when the pattern repeats.

What happens if a major stays open

At initial certification

No certificate is granted while a major is open. If the certification body cannot verify the correction and corrective action within six months after the last day of Stage 2, it has to carry out another Stage 2 before it can recommend certification.

During the certificate's life

An organisation that fails to meet certification requirements, for instance by leaving a major open past its deadline, can be suspended. A suspended certificate is temporarily invalid; unresolved, suspension leads to withdrawal or a reduced scope.

At recertification

Majors raised at recertification must be corrected and verified before the certificate expires, or it is not renewed. It can be restored within six months of expiry once the outstanding work is done; after that, at least a Stage 2 is needed. The surveillance and recertification guide covers the whole three-year cycle.

How to keep AIMS findings few, and minor

Most AIMS majors are predictable: a stale inventory, frozen assessments, or an internal audit that skipped the controls. Walk one system from inventory to impact assessment before the auditor does, and close actions with records rather than dates. The internal audit guide explains how to audit an AIMS yourself, and the common mistakes guide covers the ten that most often fail audits.

ISO/IEC 42001 nonconformities: questions buyers ask