ISO 42001 Clause 2: Use the Correct Normative Reference

What clause 2 requires in practice

Clause 2 lists the documents that its text relies on. Only one appears: ISO/IEC 22989:2022, which covers artificial intelligence concepts and terminology. The clause explains how such references work. Where the reference is dated, only the edition named applies. Where a reference is undated, the latest edition, including amendments, would apply. Material that is cited in a way that makes some or all of it part of the requirements is called normative.

For an organisation this has two practical effects. First, the AI vocabulary used inside the standard, such as the roles people and organisations can play, is anchored to a defined terminology source, so internal discussions can use the same meanings. Second, the clause does not oblige you to certify against that terminology standard, or to treat other documents mentioned in notes or the bibliography as equally binding. Reading the status of each reference correctly keeps the assessment criteria clear.

Use references according to their role

A normative reference is incorporated in a way that makes relevant content part of the standard's requirements. That does not mean every document mentioned anywhere in ISO 42001 has the same status, or that an organisation must obtain separate certification to each publication. Bibliography entries and informative material can help understanding without becoming identical obligations.

The dated reference should not silently change when a library acquires a later edition. Other publications may provide useful current guidance, but their use needs an explanation that preserves the meaning of the applicable ISO 42001 requirements. Keep the standards used for an assessment clear to everyone involved.

Why the right reference matters to the business

Disputes about AI governance often start with words. A customer says provider, a supplier says deployer, and nobody agrees who is accountable for what. Because the terminology source is fixed, your contracts, risk workshops and audit conversations can rest on shared meanings instead of personal habit. Using the correct edition also protects you from criteria drift: a team that quietly adopts a newer document can end up measuring against something the assessment does not use. Finally, understanding which references are binding avoids wasted effort, since treating every cited publication as a checklist inflates cost and distracts from the requirements that actually decide the audit outcome.

How to use clause 2 sensibly

There is nothing to build for this clause, but a little discipline avoids confusion later. A workable approach is to treat references as a controlled input to your assessment method.

1. Identify the edition of the terminology standard that the clause names and confirm which copy your team consults.
2. Give process owners, risk assessors and internal auditors access to an authorised copy rather than relying on summaries.
3. Note, for each other document mentioned in the standard, whether it is normative, informative or only a bibliography entry.
4. When building audit criteria or training material, state which source each criterion comes from.
5. Use the terminology source to settle role labels before contracts and scoping workshops.
6. Review the position when the standards family changes, deciding consciously whether a newer document is useful guidance.
7. Record who owns this reference list, so that a change of staff does not leave audit criteria pointing at an outdated source.

Evidence an auditor expects for clause 2

Auditors seldom ask for evidence of this clause directly. They notice whether the organisation's vocabulary and criteria are consistent with the standard.

• Staff and contractors who describe AI roles and systems in the same way the terminology source does.
• Assessment or audit criteria that identify the editions relied upon.
• Access arrangements showing that specialists can consult authorised copies.
• Contracts or scoping notes where role labels are used consistently.
• Observation of a workshop or review where participants settle a disputed term by consulting the source rather than by opinion.

A formal reference library is optional; clarity of use matters more.

Common nonconformities linked to clause 2

These are weaknesses that tend to appear when references are mishandled, usually recorded against clauses 3, 4 or 9.

• Internal audit criteria cite a document edition that differs from the one the standard names, with no explanation.
• Teams define central terms from casual industry usage, so the same word has different meanings across departments.
• A compliance checklist treats every bibliography entry as a requirement to be implemented in full.
• Nobody can say where the organisation obtains its authorised copy of the referenced terminology.

Illustrative software example: agreeing who does what

A software company integrates a purchased model into a service. Procurement calls the model company the provider, while customers call the software company the provider. Consulting the AI terminology helps the team describe its actual roles at different points in the service. It prevents a discussion about labels from obscuring who specifies the use, configures the service and supplies information to customers.

Illustrative construction example: understanding the system

A construction planning team describes an entire scheduling process as its AI system, while the technology team means only a forecasting component. Shared terminology helps them distinguish the technical system from the wider business process. The AIMS can then consider the interfaces, including how a planner converts a recommendation into a site decision.

Practical reference control

As an implementation suggestion, identify the edition and purpose of each source used to develop assessment methods or audit criteria. Give relevant specialists access to authorised copies. A reference list can help, but clause 2 itself does not prescribe a library spreadsheet, a purchase quantity or a particular software platform.

A common mistake is placing every cited publication in a compliance checklist as though all its guidance must be implemented word for word. Another is interpreting an important term from casual industry usage when the standard gives it a specific meaning. The terms guide explains the management concepts most likely to affect practical decisions.