ISO 42001 Clause 6.1: Connect AI Risk, Impact and Treatment Decisions
ISO 42001 clause 6.1 connects the planning basis, AI risk assessment, risk treatment and AI system impact assessment. The four parts work together: criteria make evaluation meaningful, assessment identifies priorities, impact findings inform consequences, and treatment translates the decision into necessary controls. Treating them as separate paperwork exercises can lose the reasoning between them.
What clause 6.1 requires in practice
Clause 6.1 groups four linked requirements under the heading of actions to address risks and opportunities. Clause 6.1.1 is the general basis: consider the context and interested-party requirements, determine risks and opportunities, maintain AI risk criteria, and plan actions and how to judge their effectiveness. Clause 6.1.2 defines the AI risk assessment process. Clause 6.1.3 defines risk treatment, including controls, the statement of applicability and approval of the treatment plan and residual risk. Clause 6.1.4 defines the AI system impact assessment process.
The connections matter as much as the parts. Impact assessment results are documented and considered in risk assessment. Risk criteria support assessment, treatment and impact evaluation. Treatment responds to assessment results, and approval depends on informed management. Clauses 8.2 to 8.4 later require these processes to be applied at planned intervals and when significant change happens, with results retained. Documented information is expected at each stage, though no particular format is prescribed.
Begin with purpose and criteria
Clause 6.1.1 establishes the planning basis, including context, intended use, risks and opportunities and maintained risk criteria. The criteria support assessment, treatment and impact evaluation, including distinguishing acceptable from unacceptable risks. Actions need to enter AIMS processes and have their effectiveness evaluated.
As a practical approach, describe the decision the assessment will support before selecting a score. Approval of an internal trial and approval of a customer-facing service involve different conditions. A shared method should make those conditions clear rather than force unlike decisions into an unexplained average.
Why connected risk and impact decisions matter
When risk, impact and treatment are handled as separate paperwork, the reasoning between them is lost. A register may list a control that nobody can link to a consequence, or an impact finding may never change a decision. Connecting them lets leadership see why a restriction exists, what it protects and what remains uncertain. It also helps in negotiations with customers, who often ask not only whether controls exist but what they are for. A coherent chain reduces duplication, because evidence from one step supports the next, and makes reassessment faster when a use changes. It improves the quality of management's acceptance of residual risk, which is otherwise a signature without understanding.
How to implement clause 6.1
Treat the four parts as one decision pathway. A practical way to build it is to trace a single proposed AI use from first description to approved treatment and record what each step passes to the next.
- Describe the decision the assessment will support, for example approval of an internal trial or of a customer-facing service.
- Agree risk criteria before scoring, so that unlike consequences are not hidden in an average.
- Run the impact assessment alongside the risk assessment, using shared workshops where useful but keeping the distinct questions visible.
- Feed impact findings into the risk analysis and note any change they cause to priorities.
- Select treatment options and controls from the results, comparing against Annex A and recording additional controls the use needs.
- Prepare the statement of applicability and treatment plan as linked but separate records, with reasons for exclusions.
- Obtain approval from designated management with the evidence needed to understand remaining exposure, then hand the plan to operating teams.
Illustrative software example: expanding a search feature
A software company uses AI to search internal technical notes. It proposes making the answers available directly to customers. The original objective concerned staff efficiency; the expanded use introduces customer reliance on generated explanations. Impact work examines who could be affected by misleading answers and how those answers influence decisions.
The risk assessment uses those findings and the established criteria to prioritise scenarios. Treatment might restrict the answer scope, strengthen evaluation or require appropriate review. These are options to examine, not a universal recommendation. Designated management needs enough evidence to approve the treatment plan and accept remaining risks.
Translate reasoning into controlled action
Clause 6.1.3 selects treatment, determines necessary controls, compares them with Annex A and requires consideration of Annex B implementation guidance. Annex B is normative, but permits tailored implementation; its examples are not an identical compulsory operating method for every organisation.
The Statement of Applicability explains necessary controls and inclusion or exclusion decisions. The treatment plan directs the work, and designated management approves that plan and accepts residual risks. These purposes can be linked in one information environment without merging them into an unexplained status field.
Evidence and common breaks in the chain
The clauses require documented processes, specified assessment results, actions and controls. Optional aids include a decision map or linked risk-and-impact record. Their value is traceability: can a reviewer understand why an important control exists, what consequence it addresses and what remains uncertain?
Common failures include impacts that never reach the risk assessment, controls chosen before the use is understood, and acceptance recorded without clear authority. Operational clauses 8.2–8.4 then apply the planning processes and retain their results; planning alone does not demonstrate effective operation.
Connect the planning decisions for one real use
Discuss an AI use whose assessments and controls do not yet connect with Sterling. Scoped support can include facilitation, documentation and Effivity ISO & GRC automation software. AI Risk & Impact Assessment develops the underlying understanding. See clause 6 and the library hub.
Explore each numbered part
6.1.1 · Establish Useful AI Risk Criteria
Establish the criteria and context that make AI assessments useful. BPO and construction examples show why acceptance cannot be reduced to a generic colour scale and how opportunities need conditions for delivery. Learn to connect domain, intended use and stakeholder requirements with documented actions and evaluation of their effectiveness.
6.1.2 · Make Consequences Visible
Create an AI risk assessment method that produces meaningful, comparable decisions. Manufacturing forecasts and software support-ranking examples connect objectives, evidence, consequences and criteria without assuming a universal scoring matrix. Explore how impacts on individuals and society inform prioritisation, and how assumptions and uncertainty should remain visible when treatment is selected.
6.1.3 · ISO 42001 Risk Treatment and the Statement of Applicability
Translate assessment results into treatment options, necessary controls and informed management acceptance. BPO translation and construction design examples test whether controls address the actual consequence. Understand Annex A comparison, the required consideration of Annex B guidance, and the different roles of the Statement of Applicability, treatment plan and operating evidence.
6.1.4 · Examine Who May Be Affected
Examine who could be affected by an AI use and how consequences can arise from deployment, intended use or foreseeable misuse. Workforce scheduling and construction image-analysis examples connect affected-party perspectives with risk assessment. Learn what the process must consider, how results inform decisions and where specialist assessment may also be needed.
Common nonconformities with clause 6.1
Findings tend to be about breaks in the chain between the four parts, rather than about any single part.
- Impact assessment results exist but never appear in the risk assessment, so priorities are unchanged.
- Controls are chosen before the use is understood and then justified afterwards.
- Residual risk is accepted by someone whose authority is not defined, or on evidence they never saw.
- The same assessment is reused for unlike AI uses without examining differences in purpose, affected people or the decisions that rely on the output.
Frequently asked questions
Can one workshop cover risk and impact assessment?
It can contribute to both if the distinct required questions, evidence and decisions remain identifiable. One meeting title does not establish complete coverage.
Must every opportunity lead to deployment?
No. Evaluation can lead to restrictions, further evidence or a decision not to proceed. The opportunity should be considered with its conditions and consequences.
Is the SoA the treatment plan?
No. Applicability reasoning and planned treatment actions have different purposes, even when linked in the same system.
Illustrative manufacturing example: a beneficial opportunity with conditions
A manufacturer wants AI forecasting to reduce unnecessary production. The opportunity is valuable, but a poorly supported recommendation could create shortages for customers. The team considers the use, customer commitments and evidence limitations before treating waste reduction as an automatically acceptable outcome.
It identifies planning decisions that need review, examines unusual demand conditions and determines what evidence would show that the response works. The opportunity and the adverse scenarios remain visible together. A favourable business case does not remove the need to consider consequences and treatment.