ISO 42001 Clause 6: Plan AI Risks, Impacts and Objectives

What clause 6 requires in practice

Clause 6 is the planning heart of the standard. Clause 6.1.1 asks the organisation to consider its context and stakeholder requirements, determine the risks and opportunities to be addressed, set and maintain AI risk criteria, and plan actions and how their effectiveness will be judged. Clause 6.1.2 requires a defined, repeatable AI risk assessment process that looks at consequences for the organisation, individuals and societies. Clause 6.1.3 requires a risk treatment process: choosing options, determining necessary controls, comparing them with Annex A, considering Annex B guidance, producing a statement of applicability and a treatment plan, and obtaining approval from designated management, including acceptance of residual risk. Clause 6.1.4 requires a process for assessing the impact of AI systems on individuals, groups and society.

Clause 6.2 requires AI objectives with a plan to achieve them, and clause 6.3 requires planned management-system changes. Documented information is retained for most of these steps.

6.1.1: establish the planning basis and risk criteria

Planning considers context and relevant requirements, including the domain and intended use of AI. The organisation determines risks and opportunities relevant to intended AIMS outcomes, undesirable effects and improvement, and plans how actions will enter its processes and be evaluated. It establishes and maintains AI risk criteria, including acceptable and unacceptable risks and criteria for assessment, treatment and impact assessment.

Retain documented information about actions to identify and address risks and opportunities. As a practical starting point, clarify what the organisation is trying to achieve and what kinds of consequence would make the proposed use unacceptable. A numerical scale designed before those questions are discussed may create an appearance of consistency without useful decisions.

6.1.2: define a repeatable AI risk assessment process

The process aligns with AI policy and objectives and supports consistent, valid and comparable repeated assessments. It identifies risks affecting achievement of objectives, analyses consequences for the organisation, individuals and societies, considers realistic likelihood where applicable, determines risk levels and evaluates them against criteria to prioritise treatment. The process is documented.

In a hypothetical IT business, AI prioritises service tickets. A missed high-priority ticket can affect the customer's operations; inconsistent prioritisation may affect particular user groups differently. Assessing only the provider's cost saving would miss those consequences. The AI risk assessment guide explores scenario development and the link to operational reassessment.

6.1.3: choose treatment and necessary controls

The organisation selects treatment options and determines necessary controls, compares them with Annex A and considers relevant Annex B implementation guidance. It establishes a Statement of Applicability explaining necessary controls and inclusion or exclusion reasons, prepares a treatment plan, and obtains designated management's approval and acceptance of residual risks. Documented information about the treatment process is retained.

Necessary controls must align with the AI objectives and be documented, communicated and available to relevant parties as appropriate. The reference controls are not an exhaustive substitute for understanding the organisation's risks. A control from another suitable source may be necessary.

For the IT example, “human oversight” is an incomplete treatment description. A useful arrangement identifies who checks priority changes, what evidence they receive and how an incorrect priority can be reversed. Read the treatment and SoA guide for the decision and evidence trail.

6.1.4: examine effects on people and society

The organisation defines an AI system impact assessment process covering potential consequences of deployment, intended use and foreseeable misuse for individuals, groups and societies. It considers technical and societal context and relevant jurisdictions. Results are documented and considered in risk assessment; they can be made available to relevant parties where appropriate. Particular domains can call for additional discipline-specific assessment.

A hypothetical manufacturer uses AI to assess visual inspection results and generate suggestions about operator retraining. Even if defect detection performs acceptably, using results to judge employees can create different impacts. The impact discussion should examine that proposed use, how individuals may be affected and whether the evidence supports the decisions being contemplated.

The impact assessment guide distinguishes this work from a company-only risk analysis. Neither an assessment nor AIMS certification provides legal clearance for the use.

6.2: make AI objectives actionable

AI objectives are consistent with policy, measurable where practicable, informed by applicable requirements, monitored, communicated and updated as appropriate. They are documented. Planning addresses what will be done, necessary resources, responsibility, completion timing and evaluation of results.

A suggested objective might concern reliable review of a defined class of AI outputs, supported by an appropriate measure and operating evidence. Avoid claiming that a target of “responsible AI” is sufficiently actionable by itself. Explain the intended result, the limits of the measure and who can act when performance is unsatisfactory.

6.3: plan changes to the AIMS

Changes to the management system are carried out in a planned manner. A new governance structure, expanded scope or changed assessment method can affect multiple processes. Coordinate the change with responsibilities, competence, documents and evaluation rather than revising one policy in isolation.

Why AI planning matters to the business

Planning is where good intentions become defensible choices. A clear route from purpose and consequences to controls lets managers say yes to valuable uses, attach conditions where needed and decline others, with reasons they can explain to customers and regulators. It also stops two common wastes: buying controls that do not address any real risk, and discovering consequences for affected people only after complaints arrive. Objectives give the programme direction and let leadership judge whether effort is producing results. For organisations answering client due-diligence questions, a coherent planning trail is often the most persuasive evidence that AI is governed rather than merely discussed.

How to implement clause 6

The subclauses work as a chain, so design them together and test the chain on a real AI use. Sterling teams often begin with one use that matters commercially and build the method around it.

1. Agree what kinds of consequence would make an AI use unacceptable, and write criteria that distinguish unlike situations.
2. Define a risk assessment approach that produces comparable results when repeated and covers consequences for people as well as the organisation.
3. Define an impact assessment approach that asks who could be affected, including through foreseeable misuse, and make sure its results feed the risk assessment.
4. Set out how treatment options are chosen, how Annex A is used to check for omitted controls and how exclusions are justified.
5. Decide which management role approves the treatment plan and accepts residual risk, and what evidence that person needs.
6. Set AI objectives that express results, with owners, resources, timing and a way to judge progress.
7. Plan any change to the management system itself, so that responsibilities and records stay connected.

Evidence and planning mistakes

Explore each numbered part

Illustrative example: planning for route-optimisation AI

A hypothetical logistics company in the Netherlands plans to use AI to assign delivery routes and predict arrival times. In its criteria discussion, managers decide that a missed delivery for a hospital customer is a different kind of outcome from a late retail parcel. Impact work shows that drivers could be affected if the system repeatedly assigns difficult routes to the same people. The risk assessment uses both findings, and treatment includes limits on automated assignment, review of unusual routes by a dispatcher and a feedback route for drivers. The statement of applicability records why some Annex A controls are included and others are not. The operations director approves the plan and accepts the remaining risk. An objective is set to improve reliability of exception handling, with progress judged from sampled cases.