ISO 42001 Clause 3: Understand the Terms Behind AI Governance

What clause 3 requires in practice

Clause 3 does not impose actions. It fixes meanings. It says that the terms in the terminology standard referred to in clause 2 apply, together with a set of definitions given in the clause itself. Those definitions cover familiar management-system vocabulary such as organisation, top management, policy, objective, risk, process, competence, documented information, nonconformity, corrective action and audit. They also include AI-specific items: the AI system impact assessment, data quality and the statement of applicability.

Several definitions carry decisions. Risk is described as the effect of uncertainty, which may be positive or negative. A requirement can be stated, generally implied or obligatory. Documented information covers both operating documentation and records. Performance relates to results from using AI systems as well as results of the management system itself. Where a definition explains who or what counts, as with the organisation, interested party or governing body, it affects how scope and responsibilities are read in every later clause.

Who governs the system: terms 3.1–3.4 and 3.22

The organisation in 3.1 is the entity, or defined part of an entity, whose functions and responsibilities pursue objectives. An interested party in 3.2 can influence an activity, be affected by it or perceive that it affects them. That extends the discussion beyond paying customers.

Top management, 3.3, directs and controls the relevant organisation at its highest level. For a scoped business unit, that means the leadership of that unit. A management system, 3.4, connects policies, objectives, processes and organisational arrangements; it is more than a document repository.

The governing body in 3.22 is accountable for organisational performance and conformance. It can be distinct from executive management, but the term does not require a small firm to invent a separate board. Understand the actual governance structure before assigning responsibilities.

Direction and delivery: terms 3.5–3.10

Policy, 3.5, conveys formal management direction. An objective, 3.6, identifies a result to achieve. A statement about responsible AI provides direction; a defined improvement to a consequential review process may express an objective. Neither should be confused with an activity count that says nothing about the intended result.

Risk, 3.7, concerns uncertainty and its effects, which can be positive or negative. A process, 3.8, connects activities and inputs to a result. Describing the decision process helps reveal where uncertainty matters and where a response can affect it.

Competence, 3.9, is the capability to apply knowledge and skills successfully. It differs from attending a course. Documented information, 3.10, includes controlled information in different media, both operating documentation and records of achieved results. Electronic decisions can matter as much as a signed paper form.

Results and fulfilment: terms 3.11–3.17

Performance, 3.11, concerns measurable results and can include quantitative or qualitative findings. Context determines whether it concerns an AI system or its management arrangements. Continual improvement, 3.12, means recurring enhancement of performance, while effectiveness, 3.13, asks how far planned activities and intended results are realised.

A requirement, 3.14, may be stated, obligatory or generally implied. Conformity, 3.15, and nonconformity, 3.16, concern whether a requirement is fulfilled. An unwanted result therefore needs a relevant criterion before it is automatically called a nonconformity.

Corrective action, 3.17, addresses causes to prevent recurrence. Correcting one faulty record can be necessary, but it does not by itself resolve the process weakness that produced it. These distinctions become operational in the nonconformity and corrective-action guide.

Evaluation and response: terms 3.18–3.21

An audit, 3.18, systematically and independently examines evidence against criteria. It can be internal or external; employing an outside specialist does not automatically turn an internal audit into certification. Measurement, 3.19, determines a value. Monitoring, 3.20, examines status through activities such as observation or checking.

A control, 3.21, maintains or changes risk. Controls can involve people, process or technology, and may fail to have their intended effect. This explains why introducing a review step is different from demonstrating that it detects the error of concern.

AI-specific connections: terms 3.23–3.26

Information security, 3.23, concerns protecting information's confidentiality, integrity and availability, with other properties potentially relevant. It overlaps with AI governance but does not answer every question about an AI system's consequences.

AI system impact assessment, 3.24, is a formal documented process addressing effects on individuals, groups and society. Data quality, 3.25, is contextual: data needs to meet the organisation's requirements for its specific use. A dataset suitable for one purpose can be unsuitable for another.

The Statement of Applicability, 3.26, explains necessary controls and inclusion or exclusion decisions. Identified risks and their controls must be reflected in it. This can be supported by meaningful links rather than a detached table of unexplained tick marks. The definition does not mean every Annex A control is automatically necessary; additional controls can also be needed.

Why shared terms matter to the business

Definitions look academic until a dispute begins. If one department treats a completed review checkbox as proof of effectiveness while another expects evidence that the review catches errors, management receives reassuring reports that mean different things. Clear terms also shorten audits and client reviews, because both sides use the same words for risk, control, performance and nonconformity. For AI work, the definition of impact assessment and of data quality keeps attention on people affected and on whether data suits its specific use, rather than on a generic claim that data is clean. A modest investment in agreed vocabulary reduces rework, misunderstandings with suppliers and weak management decisions.

How to put the terms to work

Definitions are not procedures, so the aim is consistent use rather than new paperwork. A practical route is to embed the vocabulary where decisions are actually taken.

1. Select the dozen or so terms that most influence your work, such as risk, control, performance, effectiveness and interested party.
2. Add short plain-language explanations to the training and templates already used by assessors and process owners.
3. Check that existing documents do not use a defined word in a contradictory way, for example calling every issue a nonconformity.
4. Ask internal auditors to confirm that their reports use the terms with their defined meanings.
5. Run one workshop on a real AI use, asking participants to apply the terms to it, and capture where opinions differ.
6. Resolve differences through an agreed glossary entry owned by a nominated role, and refresh it when the standard or the business changes, so that the language stays current for new joiners and for external reviewers alike.

Evidence an auditor expects for clause 3

No record is demanded for clause 3 as such. Auditors infer understanding from how language is used in everyday management-system work.

• Interviews in which process owners explain terms like effectiveness, control or interested party in a manner consistent with the definitions.
• Risk and impact assessments that describe consequences for people, not only for the organisation.
• Audit reports and corrective action records that separate an unwanted result from the failure to meet a requirement.
• Training material or guidance that shows the vocabulary in use.

A glossary can help, but is not mandatory.

Common nonconformities linked to clause 3

Terminology faults rarely stand alone; they show up as weaknesses in other clauses.

• Effectiveness is reported as task completion, for example that every case has a reviewer, with no evidence that the review achieves its intended result.
• Risk is treated as purely negative, so opportunities to improve are never planned.
• Impact assessment is replaced by a security assessment that never considers effects on individuals or society.
• Documented information is understood only as policies, so records of decisions and results are not controlled.

Illustrative BPO example: a fast but ineffective review

A BPO team checks AI summaries and reports that every case has a recorded reviewer. That measures completion. If reviewers consistently miss omitted customer commitments, the intended review result is not demonstrated. Calling completion “effectiveness” would conceal the issue. The team examines the criterion, checks competence and improves the review conditions before claiming success.

Illustrative manufacturing example: data changes purpose

A factory's image dataset supports counting packages. A team proposes using it to evaluate small label defects. The images may lack the needed detail. Contextual data quality, rather than a generic claim of clean data, drives the decision. The proposed use also prompts examination of risks, controls and evidence before managers rely on its results.