ISO 42001 Clause 6.2: Set AI Objectives and Plan How to Achieve Them

What clause 6.2 requires in practice

Clause 6.2 requires the organisation to set AI objectives for the functions and levels where they matter. The objectives must be consistent with the AI policy, measurable where practicable, mindful of applicable requirements, monitored, communicated, updated as appropriate and available as documented information.

It also requires planning for how objectives will be achieved. The organisation determines what will be done, what resources are needed, who is responsible, when the work will be completed and how results will be evaluated. A note says Annex C gives a non-exclusive list of AI objectives tied to risk management, and that Annex A holds controls for identifying objectives that support responsible development and use, with guidance in Annex B. The standard does not demand numeric targets for every objective; it demands that the intended result is clear and that progress can be judged credibly. Objectives can concern the management system itself as well as AI system behaviour.

Describe a result worth achieving

An objective should help someone decide whether the AIMS is moving in the intended direction. “Train fifty people” describes an activity; the intended result may be that responsible staff can recognise and escalate uses outside approved conditions. Training can contribute, but attendance alone cannot establish that capability.

The standard does not require every objective to be numerical. Measurability is qualified by practicability. Where a numerical measure is used, explain the population, source and limitations. Where a qualitative evaluation is more suitable, establish a credible basis for judging progress rather than leaving success undefined.

Why AI objectives matter to the business

Objectives let leadership steer. Without them, governance activity is measured by effort, such as courses delivered or documents approved, rather than by whether AI is becoming safer, more reliable or more useful. Clear objectives also surface conflicts early: a local speed target that undermines a group goal for careful review becomes visible and can be decided. They help justify resources, give teams something concrete to work towards and provide material for management review. For customers, a few well-chosen objectives with accurate results show maturity far better than a long list of aspirations that nobody monitors or updates.

How to implement clause 6.2

Start from the result you want and work backwards to a measure and a plan. A good objective helps someone judge whether things are improving.

1. Review the AI policy and the risk and impact findings to identify results worth pursuing, such as more reliable review of a defined class of outputs.
2. State each objective as a result, not an activity, and say which function or level owns it.
3. Choose how progress will be judged, using numeric measures where they genuinely fit and a credible qualitative basis where they do not.
4. Plan the work: actions, resources, responsible people, completion point and evaluation method.
5. Check for conflicts with existing targets, and obtain a decision where objectives pull in different directions.
6. Communicate the objectives to those who contribute and keep them as controlled documented information.
7. Monitor progress, record reasons when an objective changes, and report results to management review, including the cases that do not support a favourable conclusion.

Illustrative IT example: improving change assessment

Illustrative manufacturing example: review quality across shifts

A manufacturer wants more reliable human review of uncertain AI inspection results. It links the objective to its AI policy and relevant product requirements, then examines differences in information and staffing across shifts.

The plan can include suitable instruction, supervised practice and revised access to inspection evidence. Evaluation considers whether reviewers identify the cases they are expected to detect under representative conditions. A target based only on review speed could undermine the objective by encouraging superficial checks.

Make resources and ownership explicit

Planning should explain what will be done and who is responsible, rather than assign a broad aspiration to “the business”. Identify needed expertise, time and information as well as expenditure. A realistic completion point helps management distinguish a delayed action from a result that has been achieved but not yet evaluated.

Objectives at different levels should remain coherent. A local target for rapid throughput can conflict with a group objective for careful assessment. Make such conflicts visible and obtain a decision rather than expect employees to reconcile incompatible demands privately.

Monitor, communicate and update

Keep the objective available as documented information and communicate it to relevant people. Monitoring should support action when progress is insufficient. Updating may be appropriate when context, evidence or priorities change; retain enough reasoning to avoid the appearance of lowering a target simply because performance is poor.

Performance evaluation helps determine suitable methods and timing. The responsible-development objectives control and responsible-use objectives control provide related control perspectives. They do not replace the organisation's clause 6.2 planning.

Evidence and common mistakes