ISO 42001 Clause 1: Who the AI Management Standard Applies To

What clause 1 says in practice

Clause 1 states what the standard is for. It provides requirements, plus supporting guidance, for setting up, running, maintaining and continually improving an artificial intelligence management system inside a specific organisation. It addresses organisations that provide, or use, products or services that rely on AI systems. Its declared aim is to help those organisations develop, provide or use AI responsibly while pursuing their own objectives, satisfying the requirements that apply to them and respecting obligations towards, and expectations from, interested parties.

The clause also confirms how wide the door is open. Any organisation can use the standard, whatever its size, type or nature, as long as it provides or uses AI-enabled offerings. Clause 1 does not list activities an auditor would test. Its job is to frame the rest of the document: the organisation's role, as provider, user or both, influences how far later requirements and controls apply, but it does not decide whether the standard is available.

Note that the scope of the standard and the scope of your own management system are separate ideas; the second is determined later, under clause 4.3.

Distinguish two meanings of scope

Clause 1 describes the scope of the standard. Your organisation determines the boundary of its own management system under clause 4.3. These are related questions, but answering the first does not settle the second. A multinational group still needs to identify which entities, activities and AI roles its programme covers.

The purpose is responsible development, provision or use in pursuit of objectives and relevant requirements and stakeholder obligations. It does not make every possible AI application appropriate. Decisions about a particular deployment still depend on its context, assessments and applicable obligations.

Why the applicability question matters to the business

Many organisations delay AI governance because they assume the standard is only for people who train models. Clause 1 removes that excuse. If your teams use AI inside customer service, analytics, hiring or product features, you already make decisions that affect customers, employees and regulators. Recognising that the standard speaks to users as well as providers lets you start the right conversation early, before a client questionnaire or tender forces it. It also protects credibility: a clear view of where the standard applies avoids both over-claiming, which invites hard questions, and under-claiming, which leaves real AI use ungoverned. Procurement teams increasingly ask suppliers how they control AI, and a grounded answer begins with understanding this clause.

How to apply clause 1 when starting out

The clause requires no deliverable, so the practical task is a sound starting decision. One way Sterling teams approach it is a short, structured discussion held with the people who actually run or procure AI-enabled services.

1. List the products, services and internal tools that use AI, including features bought from suppliers.
2. For each, note whether the organisation develops it, provides it to others, uses it, or does more than one of these.
3. Identify who relies on the output and who could be affected by it, inside and outside the organisation.
4. Write down the business reason for wanting a management system, such as customer assurance, tender requirements or internal risk control.
5. Ask top management to confirm that this reason fits the strategic direction and to name a sponsor.
6. Record the outcome in plain language so it can feed the boundary decision under clause 4.3.
7. Revisit the discussion whenever a new AI-enabled service is proposed.

Evidence an auditor expects for clause 1

Because clause 1 is a statement of purpose, an auditor will rarely test it in isolation. Instead they look for signs that the organisation understands why the management system exists and where it fits.

• An interview with top management on the reason for adopting the standard and the AI-enabled products or services involved.
• Descriptions of services, contracts or marketing statements that show how the organisation provides or uses AI.
• Consistency between those descriptions and the way the organisation later defines its role and boundary.
• Awareness among staff that the management system covers use of AI, not only its development.

No particular document title is expected for this clause.

Common nonconformities linked to clause 1

Clause 1 sets no stand-alone obligation, so findings usually surface through clauses 4 and 5, but the misunderstanding starts here.

• Management believes the standard is irrelevant because the organisation only uses purchased AI services, yet staff make consequential decisions with the outputs.
• The stated purpose of the management system is generic and cannot be tied to any real product, service or customer commitment.
• Public statements imply the whole organisation is covered when only one service has been considered.
• Interviewees describe AI governance as a technology team's concern, with no link to business objectives.

Illustrative IT example: buying an AI service

An IT support provider purchases an AI tool to summarise incident histories. Although it does not train the model, it decides what information enters the tool and how engineers rely on its summaries. Those decisions create a useful basis for an AIMS. The provider should examine its own responsibilities and the supplier interface rather than assume that governance belongs entirely to the vendor.

Illustrative manufacturing example: one use, several boundaries

A manufacturer uses AI for demand forecasting at two plants. It may begin an AIMS programme around that activity, provided the boundary is clearly determined and explained. This does not establish governance for a separate corporate recruitment tool or certify the quality of manufactured products. Expanding the programme requires examining the additional activities and dependencies.

Make the initial decision useful

A practical starting discussion identifies the use, the people affected, the organisation's role and the business reason for an AIMS. A short use description is an optional aid; clause 1 does not demand a new register or application form. Avoid choosing a standard solely because a supplier uses its name or assuming that every employee needs specialist model-development skills.