ISO 42001 Risk Treatment and the Statement of Applicability

What clause 6.1.3 requires in practice

Clause 6.1.3 requires a defined AI risk treatment process that takes assessment results into account. The process selects suitable treatment options and determines every control needed to carry them out. Those controls are compared with Annex A to verify that no necessary control has been left out, and the organisation also considers whether additional controls beyond Annex A are needed. It considers the Annex B guidance for implementing controls it has chosen.

The process produces a statement of applicability, which lists the necessary controls and justifies inclusion and exclusion, and a risk treatment plan. Designated management approves the plan and accepts residual AI risks. The necessary controls must align with the objectives under clause 6.2, be available as documented information, be communicated internally and be available to interested parties as appropriate. Documented information about the process is retained. Annex A is a reference set, not an exhaustive list, and excluded controls need a reasoned justification.

Select a response that addresses the assessed risk

Begin with the scenario and its consequences. A treatment may change the proposed use, introduce appropriate controls or take another suitable form. The decision should respond to the actual assessment, including relevant requirements. Selecting a fashionable technical feature first and inventing a risk to justify it reverses the reasoning.

Consider an illustrative BPO service using AI to translate incoming complaints before employees respond. Assessment identifies that important qualifications can be lost in translation. A treatment labelled “staff review” is incomplete if staff cannot read the original language or recognise the omitted qualification. The organisation needs an arrangement capable of addressing the identified consequence.

Possible responses might restrict the use to suitable categories, provide competent language review or change the process for uncertain cases. These are options for examination, not recommendations that any one option will be sufficient. The actual choice depends on evidence, competence, responsibilities and the intended use.

Determine necessary controls and use the annexes correctly

The organisation determines all controls necessary for chosen treatment options, compares them with Annex A to check for omissions, considers relevant Annex A controls and identifies whether additional controls are needed. It considers Annex B guidance for implementation. The reference set is not exhaustive, and controls can be designed or obtained from other appropriate sources where necessary.

Annex B is normative and its guidance must be considered under 6.1.3(e). B.1 permits adapting or extending that guidance or designing a suitable implementation. It does not require a SoA justification for accepting or declining each guidance example. Annex A control applicability still needs a reasoned explanation tied to risks and relevant requirements; neither annex means every control must operate identically for every AI system.

Why treatment and the statement of applicability matter

This clause is where assessed risk becomes action. A well-reasoned treatment decision tells customers and auditors what the organisation will do about the exposure it has identified, and why some controls are not needed. The statement of applicability, if written with real reasons, saves time in every later review because the logic is already visible. Approval by designated management means residual risk is knowingly accepted by someone with authority, not left implicit in a project plan. Without this discipline, organisations either add expensive controls that address nothing in particular or exclude controls with a single word that collapses under questioning. Clear treatment decisions also make later effectiveness checks possible.

How to implement clause 6.1.3

Start from the assessed scenario, not from a list of fashionable controls, and keep the reasoning traceable.

1. For each prioritised risk, choose a treatment option and describe the consequence it is meant to change.
2. Identify the controls the option needs, then compare them against Annex A to catch omissions and note any additional controls required.
3. Consult the Annex B guidance for the chosen controls and record where your implementation differs and why.
4. Check that each proposed control can actually work in the real workflow, for example that a reviewer can recognise the error they are expected to catch.
5. Write the statement of applicability with a specific reason for every inclusion and exclusion, linked to risks and external requirements.
6. Prepare the treatment plan with owners, resources and timing, and align it with the AI objectives.
7. Obtain approval and acceptance of residual risk from the designated manager, supplying the evidence they need, and communicate the controls to those who must apply them.

Example: construction design suggestions

Make the SoA explain inclusion and exclusion

The Statement of Applicability contains necessary controls and justification for inclusion and exclusion. Its purpose is to make the applicability decision understandable. A copied explanation that says “not relevant” provides little assurance when the organisation's actual use suggests otherwise.

Distinguish the SoA from the treatment plan. The SoA explains which controls are necessary and why; the plan directs treatment work. Detailed procedures and operating records then show how arrangements are implemented. The organisation can link these in a suitable system while preserving their different purposes.

The necessary controls align with AI objectives, are available as documented information, are communicated internally and are available to interested parties as appropriate. Sharing should be deliberate and suitable to the information and audience, not assumed to mean publishing every sensitive assessment or control detail.

Obtain informed management approval

Designated management approves the AI risk treatment plan and accepts residual AI risks. This differs from assuming that a technical team's task completion automatically constitutes acceptance. Decision-makers need to understand remaining exposure, uncertainty, dependencies and any relevant limitations.

Retain documented information about the treatment process. Clause 8.3 then connects the plan with implementation and verification of effectiveness. A treatment that does not work needs reconsideration rather than a favourable status label. See the effectiveness guide for that operational stage.

Evidence and common mistakes