ISO 42001 Clause 7.5: Manage the Information Behind AI Decisions
ISO 42001 clause 7.5 connects three questions: what documented information the AIMS needs, how that information is created or updated, and how it remains controlled. The aim is reliable information for decisions and evidence. A large document library can still fail if users cannot identify the current instruction or explain the basis of an earlier approval.
What clause 7.5 requires in practice
Clause 7.5 governs the documented information that carries the AI management system, and its three subclauses work as one chain. Clause 7.5.1 asks the organisation to decide what the system must contain: the items the standard itself calls for, plus anything else the organisation judges necessary for the system to work. Clause 7.5.2 covers creation and updating, so that each item can be identified, suits its format and media, and has been reviewed and approved as suitable and adequate. Clause 7.5.3 covers life after approval: availability where and when needed, adequate protection, and attention to distribution, access, retrieval, storage, preservation, version control, retention and disposal.
Information of external origin that the organisation relies on for planning or operating the system must also be identified and controlled. The standard accepts that the amount of information differs with size, complexity and competence. What an auditor can inspect is the information itself and the evidence that these arrangements actually operate.
Connect the three parts
Clause 7.5.1 includes information expressly required by the standard and information the organisation needs for effectiveness. Clause 7.5.2 addresses identification, suitable format and media, and review and approval. Clause 7.5.3 addresses availability, protection and lifecycle controls, including necessary external information.
These questions apply across formats. A decision in a managed workflow, a supplier notice or an electronic assessment record can be relevant. The standard does not require every item to become a separate paper procedure.
Why clause 7.5 matters to the business
Every other part of an AI management system leaves a trail through documented information: the scope, the assessments, the approvals, the operating limits and the audit results. If that trail is unreliable, the organisation cannot show a customer, regulator or auditor why it allowed an AI use, and its own staff cannot tell which instruction is current. Weak control also costs money, because teams repeat assessments they cannot find and argue over which version applies. Over-control carries a cost too, when people cannot reach the guidance they need and invent workarounds. Treating clause 7.5 well gives leaders a dependable basis for decisions and gives the business evidence it can produce quickly when a client questionnaire, incident or audit asks for it.
How to implement clause 7.5
Treat this clause as a design exercise across the whole information chain, not as a document-numbering task. One way Sterling teams approach it is to trace a single AI use from approval to operation and fix the gaps along that path.
- Pick one consequential AI use and list the information that explains it, from scope statement to latest evaluation result.
- Mark which items the standard expressly calls for and which exist only because your process needs them.
- Agree how each item will be identified, who reviews it for suitability and who has authority to approve it.
- Decide where each item lives, who may read it, who may change it and how users find the current version.
- Name the external sources you depend on, such as supplier guidance, and assign someone to watch them for change.
- Set retention and disposal for evidence of past decisions, separate from instructions that are simply replaced.
- Test the chain by asking an employee and a reviewer to find the basis of an earlier approval, then adjust.
Illustrative software example: approval and instructions disagree
A software company approves an AI assistant only for internal technical support. The assessment record contains that limit, but the user guide describes the feature without it. A customer team later assumes the assistant is approved for direct customer advice.
The information problem crosses the lifecycle. The organisation needs to identify the decision information required, review the user guide for consistency and ensure the current guide reaches the relevant audience. A perfectly controlled version number would not fix missing content. Equally, correct wording in an inaccessible file would not support operation.
Illustrative BPO example: preserve the reason for a past decision
A BPO service changes its AI summarisation supplier. An earlier assessment relied on a particular output limitation and review arrangement. The team keeps only the latest assessment, making it difficult to explain why cases handled before the change followed different conditions.
The organisation considers which historical records need retention, how they are linked to the relevant service version and who may access them. This supports interpretation without requiring every transient draft to be kept indefinitely. Applicable obligations and the purpose of the evidence inform the arrangement.
Distinguish instruction from evidence
An operating instruction explains how work should be performed. A record shows what happened or what decision was made. They need different treatment when changed. Updating an instruction may be appropriate; overwriting the evidence of a completed assessment can destroy the ability to understand the original decision.
Suggested practice is to follow one consequential use through scope, assessment, treatment, approval, operation and evaluation. Identify where a reader needs a link or shared reference to understand the relationship. Avoid duplicating the same facts in many documents unless the copies can be kept consistent.
Keep information proportionate
The needed detail depends on activities, complexity and competence. An experienced team managing one constrained use may need different supporting information from a group operating many customer services. Proportionality does not remove explicit requirements for documented scope, policy, processes or results.
Optional aids such as an AI-use inventory or evidence index can help people find information. They are useful because of what they enable, not because their titles appear in every implementation pack. Review whether each item supports a decision, an operating need or a required record.
Common failures
Watch for inconsistent definitions across assessments, external instructions that change without local review, or broad access that exposes sensitive impact findings. Conversely, overly restrictive access can prevent an authorised employee from applying a control. Information needs to be both protected and usable where required.
Software can support agreed information arrangements, but it cannot determine whether a risk explanation is sound or whether a reviewer has suitable authority. Those decisions remain part of the management system.
Explore each numbered part
7.5.1 · Decide What AIMS Information You Need
Decide what information the AIMS must contain and what additional information your processes need to work. Construction and manufacturing examples distinguish mandatory evidence from useful supporting aids. Learn to avoid both missing decision records and documentary overload, while considering complexity, organisational scale and the competence of the people using the information.
7.5.2 · Review and Approve AI Information Before Use
Create and update AIMS information so readers can identify it and trust its suitability for the intended purpose. Software and IT examples distinguish technical review from approval and show why format matters. Learn how to assess changed content, assign appropriate reviewers and avoid treating an automated status change as evidence of judgement.
7.5.3 · Keep AI Information Available and Protected
Keep AIMS information suitable and available where needed while protecting it from loss or misuse. BPO and manufacturing examples examine sensitive impact findings and changing supplier instructions. Learn how access, retrieval, versions, preservation and retention work together, and why external information needs control when it affects planning or operation.
Frequently asked questions
Is documented information limited to formal procedures?
No. It includes operating information and evidence in different formats and media. Identify what needs control for the AIMS.
Can one platform hold both instructions and records?
Yes, if the arrangements preserve their different purposes, access and change needs. One location does not automatically establish effective control.
Does more documentation mean better conformity?
No. The required information must exist and support effectiveness. Extra files can create inconsistency if they add no useful purpose.
Follow one decision through its information trail
Ask Sterling to review the documentation behind an AI approval. Scoped support can include information architecture, implementation and Effivity ISO & GRC automation software. Documented Information Management develops relevant control principles. Return to clause 7 or the requirements hub.