ISO 42001 Clause 6.1.1: Establish Useful AI Risk Criteria

What clause 6.1.1 requires in practice

Clause 6.1.1 sets the basis for planning. When planning the management system, the organisation considers the issues from clause 4.1 and the requirements from clause 4.2, and determines the risks and opportunities that must be addressed to give assurance that the system can reach its intended results, to prevent or reduce undesired effects and to achieve improvement. It determines these in light of the domain and application context of each AI system, its intended use and the wider internal and external context.

The organisation must also establish and maintain AI risk criteria. These support four tasks: separating acceptable from non-acceptable risk, carrying out assessments, carrying out treatment and assessing the impact of risks. It plans actions, how to integrate them into management-system processes and how to evaluate whether they work, and retains documented information on the actions taken. Where several AI systems are in scope, the determination can be made for each system or for sensible groupings.

Define the meaning before the scale

A score is useful only when the team understands what it represents. As an original method, describe consequential outcomes and the conditions under which a decision needs escalation. Consider the organisation, affected people and the relevant domain. A financial threshold alone may not represent an important effect on individuals.

The standard does not prescribe a five-by-five matrix or universal acceptance number. Criteria should support consistent decisions in the actual application context. Explain uncertainty and limitations rather than assigning a favourable score because evidence is missing.

Why risk criteria matter to the business

Criteria decide what acceptable means before anyone knows whether a particular project will pass. Without them, thresholds tend to move to suit the case in front of the committee, and repeated assessments cannot be compared. Good criteria help leaders approve beneficial uses with conditions and stop unsuitable ones, and they make the reasoning visible to customers and auditors. The planning basis also keeps opportunities in view, so improvement is planned rather than assumed. For an organisation with several AI uses, sensible grouping saves effort while still respecting differences in consequence. The result is quicker, fairer and more defensible decisions with less argument after the event.

How to implement clause 6.1.1

Define meaning before scale. A numeric matrix can come later, once the people using it understand what each level represents.

1. Review the context and interested-party conclusions from clauses 4.1 and 4.2 and list the AI uses in scope, grouping only where consequences are genuinely similar.
2. Describe the kinds of outcome that would make a use unacceptable, covering the organisation, affected people and the relevant domain.
3. Turn those descriptions into criteria that support assessment, treatment and impact evaluation, and state who may change them.
4. Identify opportunities and write what benefit is sought, which actions make it achievable and how success will be judged.
5. Decide how planned actions enter existing processes such as procurement, development and operations.
6. Test the criteria on two contrasting uses, and revise if they cannot explain why the outcomes differ.
7. Retain the planning record and review the criteria whenever context changes materially, explaining any revision so people comparing results over time understand what has changed.

Illustrative BPO example: different consequences behind one error rate

Illustrative construction example: forecasting with incomplete inputs

A construction planner proposes AI forecasts to improve coordination between subcontractors. The opportunity is earlier identification of delays. However, missing updates can make a forecast appear more certain than the evidence supports.

The organisation considers intended use and domain before deciding how the forecast may influence site commitments. Suggested criteria might distinguish an advisory planning discussion from an authorised commitment to a customer. The proposal can remain useful while its conditions are made explicit. Criteria should not be designed merely to make the project pass.

Plan opportunities as well as adverse scenarios

The clause addresses risks and opportunities needed for intended AIMS results, fewer undesirable effects and continual improvement. A useful opportunity description explains the intended benefit and what action makes it achievable. “Adopt more AI” is an activity preference, not a complete account of value or conditions.

For the construction example, the action could involve improving input completeness before expanding reliance on forecasts. Effectiveness might be examined through better-informed coordination decisions, with suitable evidence. The suggestion is not a prescribed indicator; it illustrates the connection from opportunity to action and result.

Integrate and retain meaningful evidence

Common weaknesses to challenge