ISO/IEC 42001:2023 clauses and controls: practical AI management guide

Edition, scope and reading boundaries

This guide addresses ISO/IEC 42001:2023, the first edition published in December 2023 and identified as published on the current ISO issuer page. Its original clause 4 text already includes determining whether climate change is relevant and notes that interested parties may have climate-related requirements. These provisions are not presented here as a later amendment.

The explanations paraphrase requirements and distinguish them from original implementation suggestions and hypothetical examples. This practical guide is not a replacement for an authorised copy of the standard. Certification concerns the organisation's AI management system within its defined scope. It does not certify every AI output or product, establish that all uses are safe, or provide legal clearance for a deployment.

Find the requirement or control behind your decision

The library covers the scope, references and terminology in clauses 1–3, every named management requirement in clauses 4–10, and the 38 actual Annex A controls. Main-clause guides explain the connected process; focused subclause pages examine a particular decision and its evidence. Control-theme guides help readers understand interfaces before selecting individual controls.

Start with AIMS scope if the covered activities are unclear, AI risk assessment if priorities are uncertain, or treatment effectiveness if controls are installed but their results remain unproven. The directory below connects these routes with the complete clause and control library.

Start with the AI use and the organisation's role

An inventory can help a team discover its AI activities, but a list of product names is only a starting point. Understand the intended use, who relies on outputs, what decisions the output influences and which parties control relevant changes. An AI service used to draft internal notes presents a different management problem from one used to prioritise customer complaints or influence employment decisions.

Consider a hypothetical BPO organisation using AI to propose replies to customer complaints. The provider of the underlying model, the BPO firm and its client may each make different decisions. The BPO controls how staff use proposed replies; the client may determine service commitments; the model provider controls parts of the technology. An AIMS needs to identify the organisation's responsibilities and dependencies without claiming authority over everything in that chain.

In a construction group, a system may help identify potential coordination clashes in design information. The relevant scope and controls depend on how engineers use the output and how professional decisions are made. A statement that the organisation “uses AI responsibly” does not explain which activities are covered, what review is required or where accountability remains.

Connect risk and impact assessment without merging their purposes

AI risk assessment under clause 6.1.2 addresses risks associated with meeting AI objectives, including consequences for the organisation, individuals and society. System impact assessment under clause 6.1.4 examines potential consequences of deployment, intended use and foreseeable misuse for individuals, groups and societies. Its results inform risk assessment. These are related processes with distinguishable questions, rather than competing forms.

For example, a software company offering an AI-assisted screening function may face commercial risk from unreliable results. Individuals affected by those results may experience a different kind of consequence. Looking only at the company's financial exposure would miss that perspective. Suggested practice is to describe affected parties and pathways to consequences before assigning scores or selecting a control.

The standard does not make an impact assessment equivalent to legal permission. Applicable jurisdictional and sector-specific obligations need appropriate attention. A certification result cannot substitute for a legal assessment, professional judgement or other required authorisation. Equally, legal review alone does not operate the management system's ongoing assessment and control processes.

Select necessary controls and make decisions visible

Risk treatment determines options and necessary controls. The organisation compares those controls with Annex A, considers the relevant implementation guidance in Annex B, and prepares a Statement of Applicability explaining necessary controls and inclusion or exclusion decisions. Annexes C and D provide further context about objectives, risk sources and use across domains. They should not be confused with a complete ready-made system for every organisation.

A suggested implementation approach is to follow one important risk from its cause and consequences through the selected response, operating arrangements and verification. If the response is “human review,” ask who reviews, what they can detect, what information they receive and whether they can refuse or reverse the proposed action. The label by itself provides little assurance.

In a manufacturing example, AI helps identify surface defects. A human check may be useful, but its effectiveness depends on lighting, workload, sample selection and the ability to detect the missed defect. Management needs evidence appropriate to that use. A generic statement that a person remains involved cannot establish that the risk treatment works.

Annex B is normative: clause 6.1.3(e) requires consideration of its guidance. Its general provisions permit extending or modifying the guidance, or designing a suitable implementation. The organisation does not need separate SoA justifications for including or excluding each guidance example. The obligation to consider guidance and the freedom to tailor implementation should both remain clear.

Build competence around actual responsibilities

General AI awareness helps employees recognise the policy, approved routes and implications of nonconformity. More specialised responsibilities require additional competence. Someone assessing impacts needs a different capability from an employee checking a drafted reply or an auditor examining whether a process operates as planned. Training is one contribution alongside relevant education and experience; its effectiveness should be evaluated where development action is taken.

Documented information should help those people act. That may involve clear instructions, relevant decisions, assessment results and controlled external information. The standard requires particular information and information necessary for an effective AIMS, but does not prescribe one universal document library. A short usable instruction can be more effective than an extensive document that does not explain the actual decision.

Operate and evaluate across change

AI systems and their use can change after initial approval. Clause 8 connects operating criteria with controls, external dependencies, reassessment and retained results. A change in the model, input population, operating environment or use of outputs can affect the assumptions behind earlier decisions. Identify those changes through real business processes rather than relying only on an annual governance meeting.

As an illustrative IT example, a service desk initially uses AI to suggest ticket categories. Later, a team connects those categories to automatic priority changes. The technology may appear similar, but the consequence of an incorrect output has changed. The organisation should examine that change through its defined assessment and operational processes before treating the earlier approval as sufficient.

Evaluation then considers both AI-related performance and management-system effectiveness. An accurate model can still sit within weak governance if changes bypass approval or concerns do not reach decision-makers. Internal audit follows evidence against defined criteria; management review considers required inputs and decisions; improvement addresses recurring weaknesses rather than merely correcting individual outputs.

Choose useful evidence and avoid documentary overload

Required evidence includes items specified across the clauses, such as the documented scope and policy, assessment processes and results, objectives, competence evidence, evaluation results, audit information, management-review results and corrective-action records. Their exact content and application should be checked against the authorised standard. Suggested supporting aids can include an AI-use inventory, responsibility map or decision log. Those titles are not universal ISO requirements.

An auditor may follow a sampled AI use from scope and assessment through approvals, operation and later evaluation. The story should remain consistent. A policy prohibiting a use cannot be reconciled with evidence that managers routinely approve it informally. More files will not resolve the contradiction; the organisation needs to decide and implement appropriate arrangements.

Coordinate global delivery with informed local ownership

A group can share methods, learning and governance while recognising differences in use, affected populations, customer commitments and applicable obligations. Common criteria support comparison, but locally significant consequences should not disappear in an average score. Identify who contributes local knowledge and who can authorise relevant decisions.

Implementation effort depends on the scope, number and complexity of AI uses, existing governance, supplier visibility and available competence. A narrowly defined internal use and a portfolio of customer-facing services require different work. Discuss those facts before assuming that a fixed document pack or identical project timetable will suit both.

Why an AI management system matters to the business

AI is entering client work faster than most management systems can adapt, and customers have started asking how an organisation governs it. ISO/IEC 42001 gives a recognised structure for answering: scope, leadership, risk and impact assessment, operating controls, evaluation and improvement. For a business, the benefit is a single, explainable way to decide where AI may be used, who is accountable and what evidence shows it is working. That reduces surprises in procurement reviews, improves internal discipline and helps leaders balance opportunity against exposure. The standard is organisation-wide in reach but scoped to what the organisation actually does with AI, so a small team and a large enterprise can both apply it sensibly.