ISO 42001 Operational Controls: Define the Conditions for Use

What clause 8.1 requires in practice

Clause 8.1 asks the organisation to run the AI management system through controlled processes. In practice that means five things. It plans, implements and controls the processes required to satisfy the requirements and to carry out the actions determined in clause 6. It establishes criteria for those processes and controls them against the criteria. It puts into operation the controls chosen under risk treatment that relate to running the system, for example controls tied to the AI development and use life cycle. It monitors whether those controls work and considers corrective action if intended results are missed. Finally it controls planned changes, reviews the consequences of unintended changes, and keeps control over externally provided processes, products or services relevant to the system. Documented information is kept to the extent needed for confidence that processes ran as planned.

Turn a governance decision into an operating criterion

A criterion gives people a basis for deciding whether an activity can proceed or whether a response is needed. If risk treatment calls for review before use, the operating arrangement should make clear what is reviewed, by whom, with what information and what happens when the result is unacceptable.

The organisation needs documented information to the extent necessary for confidence that processes occurred as planned. That does not mean retaining every possible log indefinitely. Determine what evidence supports the process and applicable requirements, then control it appropriately.

Why clause 8.1 matters to the business

Most AI problems in practice do not come from the original design. They come from use that moves beyond what was assessed: a new function, a changed supplier behaviour, a shortcut adopted under pressure. Operational control is how a business keeps promises made to customers and to its own board. It limits surprise, because deviations are noticed and routed to the people who can decide. It also protects commercial relationships, since a client who audits your service will look for proof that approved conditions are applied in the work itself. Clear criteria reduce arguments between delivery teams and governance teams about what is permitted.

How to implement clause 8.1

Begin with the points where operation can diverge from approval. The approach below is one that Sterling teams find workable, and the standard does not prescribe a particular life cycle or tool.

1. Translate each approved condition into a plain criterion, stating what is checked, by whom and what happens on failure.
2. Give a named person authority to pause or restrict a use, and make sure staff know how to reach that person.
3. Map every supplier and externally provided service relevant to the AIMS and record what information you receive from each about change.
4. Create a short route for proposing an extension of use, so people have a legitimate alternative to informal workarounds.
5. Choose a few control-effectiveness checks that look at results rather than activity, such as errors reaching the customer.
6. Decide what operating records are enough to show processes ran as planned, avoiding indiscriminate log retention.
7. Compare written instructions with what staff actually do on at least two sites or shifts, and close the differences.

Example: an IT service uses AI during incident triage

Control planned and unintended changes

Planned changes are controlled, and the consequences of unintended changes are reviewed with action to reduce adverse effects where necessary. Identify how changes become visible: development releases, supplier notifications, altered inputs, revised instructions or informal workarounds may all matter in a particular context.

The response should be proportionate and authorised. Some changes may need additional evidence or operating restrictions; others may be manageable through existing arrangements. A universal rule that every change is harmless is no more useful than a rule that every minor change requires the same lengthy process.

Example: a BPO service relies on an external AI supplier

A BPO firm uses an external AI service to extract fields from incoming customer documents. Its own process checks selected fields before the data enters the customer system. The supplier changes the service's handling of uncertain values, replacing blank outputs with suggested values.

The BPO's review method may no longer identify uncertainty in the same way. Operational control should therefore connect supplier information with the organisation's own criteria, assessment and instructions. A contract and a favourable supplier demonstration do not by themselves show that the changed service remains suitable for the actual process.

This illustrates why externally provided processes, products and services relevant to the AIMS need control. The organisation may not control the supplier's engineering decisions, but it can establish appropriate information, acceptance and response arrangements within its own role.

Monitor whether the controls achieve their purpose

Clause 8.1 requires monitoring of control effectiveness and consideration of corrective action when intended results are not achieved. This connects daily operation with risk treatment verification and performance evaluation. A completed approval task is useful evidence of process activity, but the organisation also needs to understand whether the control achieves its intended result.

For the BPO example, monitoring can examine whether important extraction errors reach the customer system despite review. The measure should reflect the risk and the limitations of the available evidence. Avoid presenting a count of documents processed as proof that the review control is effective.

Evidence an auditor may follow

Common nonconformities with clause 8.1

Auditors who follow a real activity through clause 8.1 tend to find gaps of these kinds.

• Operating criteria exist in a policy but cannot be applied by staff doing the work, or differ from what they actually do.
• A use was extended after the original approval and no one examined the changed consequences.
• A supplier changed how its service behaves and the organisation's instructions and checks were not revisited.
• Controls chosen in risk treatment are listed but no one monitors whether they achieve their intended result.
• Nobody has clear authority to pause a use when a control fails, or staff do not know who does.