ISO 42001 Clause 10: Learn from Findings and Improve
ISO 42001 clause 10 addresses continual improvement and the response to nonconformity. It helps an organisation move beyond fixing one AI-related problem to improving the arrangements that allowed it. That can mean revisiting approval, operating conditions, competence or evaluation when evidence shows that the management system is not achieving its intended result.
What clause 10 requires in practice
Clause 10 covers how the organisation learns and improves. Clause 10.1 requires the AI management system to be kept improving, so that it stays suitable, adequate and effective. It applies whether or not anything has gone wrong, so improvement can respond to an opportunity as well as to a weakness. Clause 10.2 deals with nonconformity, meaning a requirement that has not been fulfilled. When one occurs, the organisation reacts: it controls and corrects it and deals with the consequences. It then evaluates whether action is needed to remove the causes, by reviewing the nonconformity, determining its causes and checking whether similar ones exist or could occur. It implements needed action, reviews its effectiveness and changes the system if necessary. Documented information is kept on the nonconformities, actions taken and results of corrective action.
10.1: improve suitability, adequacy and effectiveness
The organisation continually improves the AIMS. Improvement can be prompted by operating experience, assessment, audit, management review or an opportunity identified before a failure. It should relate to how well the system fits the organisation, provides what is needed and achieves its intended results.
Imagine a software company whose AI-use approval process works but is slow because teams submit incomplete descriptions. The company improves the initial discussion so product owners explain intended users, decisions and supplier dependencies earlier. This may reduce rework and improve assessment quality without waiting for a formal finding. The example is a possible improvement, not a prescribed intake form.
Do not measure improvement solely by the number of documents revised or actions closed. A shorter process can improve effectiveness if it preserves necessary decisions and evidence. An added approval can make the process worse if nobody understands its purpose or has authority to resolve concerns.
10.2: respond to the problem and consider its causes
When a nonconformity occurs, the organisation reacts as appropriate to control and correct it and deal with its consequences. It evaluates the need for action to remove causes, including reviewing the problem, determining causes and considering whether similar issues exist or could arise. Necessary action is implemented, its effectiveness reviewed, and the AIMS changed if needed. Actions should be appropriate to the effects.
In a hypothetical BPO service, the approved process requires an employee to review an AI-generated response before release. A configuration change bypasses that step for a category of cases. The immediate response may involve restoring the intended route and examining affected work. The cause review should investigate how the change was introduced and why verification did not detect its effect.
If the investigation identifies an unclear division between platform administration and service ownership, repeating awareness training for front-line staff would not address the cause. A suitable action could clarify change responsibility and require relevant verification. The actual response must follow evidence rather than default to a familiar corrective-action label.
Why clause 10 matters to the business
Clause 10 is where a management system proves it is more than a snapshot. AI uses, suppliers and expectations keep changing, so an organisation that only fixes the immediate symptom will meet the same problem again in another team or service. A disciplined response to findings saves cost over time, because root causes are removed rather than patched repeatedly. It also builds trust: clients value a supplier that can explain what went wrong, what was done about the cause and how it knows the fix worked. Continual improvement also lets the business simplify, removing steps that add delay without adding judgement, which helps staff comply willingly.
How to implement clause 10
Join improvement and corrective action to the sources of evidence the system already produces. One workable path, used by Sterling teams, follows. Whatever tools you use to track this, the standard cares about the quality of the response and its evidence, not the product.
- Gather improvement ideas and findings from audits, monitoring, reviews, assessments and employee feedback into one place with owners.
- For every nonconformity, state the requirement not met and the evidence in words an outsider could follow.
- Take immediate action to contain the problem and deal with its consequences, using authorised responses.
- Investigate causes proportionately, looking at tools, workload, information and authority before assuming carelessness.
- Check whether the same cause could affect other teams, services or sites, and extend action accordingly.
- Define how you will know an action worked, and review that evidence before closing it.
- Update the AIMS where results show a change is needed, and record the nonconformity, actions and results.
Example: a manufacturer's ineffective review action
A manufacturer finds that an AI inspection process misses defects under a particular lighting condition. An action adds a human check, but later examination shows that inspectors see the same inadequate image and face the same limitation. Closing the finding because the check was introduced would confuse implementation with effectiveness.
The organisation needs to reconsider the action in light of its intended result. That could involve the image capture conditions, inspection method or limits on use, supported by appropriate specialist judgement. This example illustrates investigation and verification; it does not prescribe a technical solution or suggest that AIMS certification replaces product-quality or safety obligations.
Distinguish a nonconformity from every unwanted result
A nonconformity concerns failure to fulfil a requirement. An AI output may be imperfect within an explicitly understood and managed limitation, while a process can fail to meet its requirements even before harm is detected. Establish the relevant criterion and evidence before deciding how to classify a concern.
Incident handling, risk reassessment and corrective action can interact without becoming the same process. An incident may reveal a nonconformity, new risk or impact information. Route that information to the appropriate processes, and keep responsibility clear so it is not lost between separate logs.
Evidence of action and effectiveness
The standard requires documented information about the nature of nonconformities, subsequent actions and corrective-action results. Useful evidence makes the original problem and intended result understandable. For a changed approval process, later sampled decisions may help show whether the cause has been addressed. For a technical control, different evidence may be necessary.
An auditor may compare closure claims with actual operating results and examine whether similar exposure elsewhere was considered. Common mistakes include describing “human error” without investigating conditions, closing actions before enough evidence exists and repeatedly changing deadlines without management attention.
Explore each numbered part
10.1 · Improve the AIMS Before and After Problems
Improve how the AIMS fits the organisation, provides what is needed and achieves results. Software and BPO examples show improvements that reduce rework and strengthen useful reporting without waiting for a formal finding. Learn to distinguish improvement from activity, evaluate changes and preserve the controls that still matter.
10.2 · Correct AIMS Nonconformities and Address Their Causes
Respond when an AIMS requirement is not fulfilled and investigate whether action is needed to prevent recurrence elsewhere. IT and construction examples distinguish immediate correction from cause-based action and evidence of effectiveness. Learn to document the problem and results, avoid unsupported blame, and change the system when the evidence warrants it.
Frequently asked questions
Must every finding use the same root-cause technique?
No single technique is prescribed. Choose a method proportionate to the problem that supports a credible cause assessment and suitable action.
Can retraining resolve a nonconformity?
It can contribute where competence or awareness is a cause. It will not necessarily fix unsuitable tools, conflicting targets or unclear decision authority.
What if an action does not work?
Review the evidence and reconsider the response. Administrative closure should not conceal that the intended result has not been achieved.
Resolve AIMS findings with useful evidence
Discuss AIMS corrective-action and improvement support, including scoped investigation assistance and agreed Effivity ISO & GRC automation software arrangements. Explore Root Cause Analysis & CAPA for relevant learning. Independent bodies determine certification; it does not certify each AI product.
Previous: clause 9. Return to the requirements hub and, as a next step, revisit clause 6 planning when findings change the risk picture.