ISO/IEC 42001 guide
ISO 42001 scope: which AI systems and roles an ISO/IEC 42001 certificate covers, and the mistakes that cost you
Clause by clause: ISO 42001 Scope: Identify the AI Activities You Can Explain →
How clause 4.3 sets the boundary of an AI management system: which AI systems and roles come into scope, what the Statement of Applicability may leave out, how suppliers fit, how the wording reads on the certificate and the scope mistakes that cost you.
Key points
- An ISO/IEC 42001 scope names the AI systems your management system governs, your role for each one, and the sites, functions and suppliers involved. Clause 4.3 requires it to be kept as documented information.
- Role matters as much as the list of systems: a model you build, a service you sell to customers and a tool your staff merely use each bring different controls and records into play.
- Annex A controls may be judged not needed, with a justification in the Statement of Applicability. The management system clauses themselves are not a menu.
- A third-party model or platform stays at the edge of your scope, not outside it: you remain answerable for how it is chosen, agreed and monitored.
- The scope sets the auditor's workload and the wording a buyer will check. Drawing it too wide, too narrow or with silent gaps is the costliest early mistake.
What does an ISO 42001 scope cover?
For an AI management system, listing offices and departments is not enough. The scope has to say which AI systems the organisation governs through the AIMS, whether it develops, provides or uses each of them, and which people, data, locations and external parties sit around those systems.
The requirement sits in clause 4.3, Determining the scope of the AI management system. As in every standard built on the harmonised structure, the boundary is informed by the issues you identified under clause 4.1 and the needs of the interested parties you identified under clause 4.2, and the result must be available as documented information. You cannot write it until you know what AI you actually have, so an inventory comes first.
The certification body's scope of certification can match yours or cover part of it, never more than was audited.
Your role for each AI system
ISO/IEC 42001 applies to any organisation that provides or uses products or services built on AI, and the same organisation often plays several parts at once. A software company may train its own model, embed a supplier's foundation model in a product and let staff use a drafting assistant: all three can be in scope, with different obligations.
| Your relationship to the system | What the scope pulls in | Records the auditor will expect |
|---|---|---|
| You develop it | Design and development processes, data acquisition and preparation, verification and validation, deployment decisions | Requirements, design records, data provenance and quality checks, test results, technical documentation |
| You provide it to customers | Information for users, external reporting, incident communication, responsibilities agreed with customers | User documentation, customer terms covering AI, incident records, the intended use you declare |
| You use it internally | Responsible-use processes, intended use, supplier selection, human oversight of outputs | An approved-use rule, supplier assessments, monitoring and event logs where the use affects people |
| A supplier builds it for you | Allocation of responsibilities, supplier control under clause 8.1, your own impact assessment | Contracts or agreements naming who does what, supplier evidence you reviewed, reassessment after changes |
Recording the role per system shows the auditor why some Annex A controls apply to one system and not another. The Annex A guide explains the nine control groups in detail.
What can be left out, and what cannot
Two different things get called exclusions, and confusing them causes trouble at Stage 1.
AI systems outside the boundary
You may decide that some AI stays outside the AIMS, for example a product line run by a separate legal entity, or a pilot that has not left the laboratory. That is legitimate if the scope says so, and not when the excluded system is the one your buyer is asking about.
Annex A controls judged not needed
Clause 6.1.3 asks you to compare the controls your risk treatment requires with the 38 reference controls in Annex A, and to record the outcome in a Statement of Applicability that justifies each inclusion and each exclusion. "Not yet in place" is a gap, not a justification. The standard also notes that Annex A is not exhaustive, so additional controls can be needed.
Clauses 4 to 10
These describe the system itself and are not framed as optional. An AIMS that skipped the AI system impact assessment under clause 6.1.4, or the internal audit under 9.2, would simply fail those requirements. The impact assessment guide covers how to run that assessment without it becoming academic.
Suppliers, customers and shared services at the boundary
Foundation models, cloud platforms, labelling vendors and group IT functions all touch the systems in scope. Clause 8.1 requires externally provided processes, products and services relevant to the AIMS to be controlled, and the Annex A group on third-party and customer relationships asks you to allocate responsibilities between you, your suppliers and your customers.
In practice, the scope statement should name the main dependencies, and the inventory should show for each system who supplies what. You show how you chose each supplier, what you agreed and how you would notice a change that matters. Group shared services are either inside the AIMS or treated as an external provider; keep that choice consistent everywhere.
How the scope changes audit days and cost
The certification body plans its audit time from the scope you give it: how many AI systems, what you do with each, how many people work within the AIMS and how many locations are involved. Two bodies quoting on different scope statements are not quoting on the same job.
Each system in scope also needs an owner, an impact assessment and life-cycle records before Stage 2. The cost guide sets out what moves the price, and the timeline guide shows how the number of systems stretches or shortens each stage. A narrower first scope, extended later, works if it still answers the buyer's question.
How the scope reads on the certificate
A line such as "the AI management system for the design, development and provision of AI-enabled credit-scoring services, from the Manila and Dubai offices" tells them what was audited. A line such as "management of artificial intelligence" tells them nothing and invites questions. That example is illustrative; the body words the final text from your scope statement.
Good wording names the activity, the systems or service lines and the locations, and avoids implying anything the certificate does not give, such as conformity with the EU AI Act, which the guide on ISO/IEC 42001 and the EU AI Act addresses. Checking the scope line is also the first step in verifying anyone else's certificate.
Scope mistakes that cost you
Scope problems surface at Stage 1, when they are cheap, or when a buyer rejects the certificate, when they are not.
| Mistake | How it shows up | The fix |
|---|---|---|
| Scoping before the inventory | Staff turn out to use AI tools nobody listed; the auditor finds systems the scope ignores | Survey functions and procurement for AI use first, then write the scope |
| Too wide | Every system needs impact assessments and records at once; the timeline slips and evidence is thin | Start with the systems customers and regulators care about; plan extensions |
| Too narrow | The certificate covers an internal pilot while the buyer asks about the product | Test the draft scope against the actual requirement the certificate must answer |
| Roles left unstated | Annex A exclusions look arbitrary because nobody recorded who develops, provides or uses what | Record the role per system in the inventory and refer to it in the Statement of Applicability |
| Silent gaps at the boundary | A third-party model or group service is neither inside nor controlled as a supplier | Name each dependency and decide how it is treated |
| A frozen scope | New systems go live without reassessment; the scope drifts from reality before surveillance | Tie scope review to change control and to the management review |
ISO/IEC 27001 holders add one more: assuming both scopes must match. The guide on extending an ISMS into an AIMS shows how to handle that.
How Sterling sets the scope
An inventory first, then a scope your buyer will accept
Our expert and experienced consultants start with the AI your organisation genuinely develops, provides and uses, record the role for each system, and test the draft scope against the requirement the certificate has to meet before the certification body quotes. The inventory and scope live in Effivity from the first workshop. Sterling has supported 8,100+ client engagements in 60+ countries since 2003. We ensure successful certification for our clients.
Book a free discovery callISO 42001 scope: questions buyers ask
Can our ISO 42001 scope cover just one AI product?
Yes, a single product or service line can form the whole scope, provided the statement explains the boundary and the certificate answers the customer or regulator who asked for it.
Can we leave Annex A controls out of our ISO 42001 scope?
You can mark an Annex A control as not needed, but only in the Statement of Applicability and with a justification drawn from your risk treatment. Lack of time or resources is not a valid reason.
Is a supplier's AI model inside our ISO 42001 scope?
Your use of it is, and your control over the supplier is. You are not expected to audit the provider's internal development, but you must show how you selected it, what responsibilities you agreed, how you assessed its impact in your context and how you would detect changes that matter.
What happens when we add a new AI system after certification?
The new system goes through your risk and impact assessment first, and then you update the scope statement and the Statement of Applicability. Tell your certification body; it decides how and when to verify the extension before the new system appears on the certificate.
Must our ISO/IEC 27001 and ISO 42001 scopes be identical?
No. They are separate statements for separate systems and often differ: the ISMS may cover the whole company while the AIMS covers two AI services. Where they overlap, shared records serve both.
Does a narrow scope make an ISO 42001 certificate less credible?
Only when it does not match what the reader needs. A precise scope that covers the product a buyer is purchasing is more credible than a broad one written vaguely.
More ISO/IEC 42001 guides
Every guide in the ISO/IEC 42001 series is written for one question and links back to the hub for the whole picture.
- AI system impact assessment, with ISO/IEC 42005
- ISO/IEC 42001 Annex A: the 38 controls explained
- ISO/IEC 42001 certification process, step by step
- ISO/IEC 42001 certification cost: what moves the price
- ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS
- ISO 42001 for professional services
- ISO/IEC 42001 requirements explained, clause by clause
- ISO 42001 for retail and e-commerce
- ISO 42001 certification in Singapore and South East Asia
- ISO 42001 Stage 1 and Stage 2 audit
- ISO 42001 for start-ups and small AI teams
- ISO/IEC 42001 and the EU AI Act: what the certificate does not give
Keep exploring
Explore more about ISO/IEC 42001
Watch a video on how to implement ISO 42001 here.
Watch a video on ISO 42001 requirements here.
ISO/IEC 42001 resources
Services for ISO/IEC 42001
Talk to a consultant
Set an ISO/IEC 42001 scope your buyers will accept.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice