ISO 42001 training: who needs what, and the competence evidence auditors accept

What does ISO 42001 require for training and competence?

ISO/IEC 42001:2023 follows the harmonised structure shared by the other ISO management system standards, so its people requirements sit where an ISO/IEC 27001 or ISO 9001 user expects them: clause 7, Support, under competence, awareness and communication. What differs is whose competence matters: the people who design, build, procure, deploy, monitor and oversee AI systems, and the people whose judgement decides whether a risk or an impact is acceptable.

The competence requirement works as a loop. You determine the competence each such role needs; you ensure the people in it have it, on the basis of education, training or experience; where there is a shortfall, you act and then evaluate whether the action was effective; and you keep documented information that proves it. Training is one action among several. Mentoring, recruiting a specialist or contracting an external assessor are equally valid, provided the result is evaluated.

Awareness is lighter and broader. People doing work under your control should know the AI policy, how their own work contributes to the AIMS and the consequences of not following it. Two Annex A areas reinforce this: the controls on internal organisation cover AI roles and responsibilities and the reporting of concerns, and the controls on resources for AI systems include documenting the human resources each system depends on.

The standard sets no hours, no syllabus and no qualification for any role, internal auditors included. The form of evidence is yours to choose, and the certification body judges whether it convinces.

Who needs what: the roles in an AI management system

Top management

Leaders approve the AI policy, set AI objectives, accept residual risk through the designated management and chair the management review. They need a short, decision-focused briefing on those duties and on what the organisation's AI systems do. Their evidence is the approved treatment plan, the review minutes and how they answer an auditor's questions.

The AIMS lead

Whoever coordinates the system needs the whole standard in depth: the risk method, the impact assessment, the Statement of Applicability across the 38 Annex A controls, the life-cycle records and the link to any existing ISMS. ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS

AI system owners, developers and data scientists

These people need working knowledge of the controls that land on their systems: requirements and design records, verification and validation, deployment, monitoring, event logs, and data acquisition, quality, provenance and preparation.

Risk and impact assessors

The people who run the AI risk assessment and the AI system impact assessment, often drawn from risk, legal, privacy and the business, need method training and practice on a real system. ISO/IEC 23894 and ISO/IEC 42005 are the usual guidance for each. AI system impact assessment, with ISO/IEC 42005

Procurement and supplier managers

When the model or the platform comes from a third party, the people who contract for it need to know what responsibilities must be allocated, what to ask a supplier for and how to record it.

Internal auditors

Auditors need knowledge of ISO/IEC 42001 and of the AI processes they audit, plus audit skill. ISO 19011 is the common reference for evaluating auditor competence, and independence from the work audited still applies. ISO/IEC 42001 internal audit: auditing an AI management system

Everyone else in scope

Staff who use AI tools at work need awareness: the AI policy, which tools and uses are approved, how to handle data in them and how to report a concern.

An ISO 42001 training matrix: role, learning and evidence

A matrix links each role to the competence it needs and the proof that it exists. Treat the rows below as a starting point and rewrite them around your own AI systems and your role for each.

Revisit it when a new AI system enters scope, when your role for a system changes or when findings point to a skills gap.

What counts as competence evidence for ISO 42001?

Certification auditors test competence by sampling the people they meet while following an AI system through its life cycle. They ask for the criteria for the role, check the person's record against them, then ask the person to explain what they did. Evidence convinces when the three agree.

• Role criteria covering education, training, experience and skills for each AI-related role. Without criteria, a record measures nothing.
• Records traceable to the person: qualifications, course results, CVs showing relevant work, internal authorisations to approve a model release or an assessment.
• An effectiveness check: a test, a supervised first assessment, a peer review of a design record or a look at later work, recorded against the action it evaluates.
• Work products: the impact assessment the assessor wrote, the validation report the developer signed, the concern a user reported through the channel you trained them on.

Where ISO 42001 training evidence falls short

• Only the data science team is covered. Legal, procurement and leadership decide on risk too, and auditors sample them.
• Generic AI ethics courses with no link to your systems. Useful context, but they rarely show that someone can apply your risk criteria.
• No awareness for tool users. The widest group is often the one with no record at all.
• Contractors forgotten. External developers and annotators working under your control need criteria and records in proportion to their role.
• Records that never move. Systems change quickly; a matrix frozen at the start of the project no longer matches the scope.

Sterling Academy and internal auditor training

In a Sterling ISO/IEC 42001 engagement, training is planned from the gap analysis rather than picked from a catalogue. We compare your roles, job descriptions and existing records with the requirements, agree competence criteria for each AI-related role and plan the actions that close the gaps.

Internal auditor training, as applicable to your standard, is part of the engagement: your Sterling consultant prepares the people who will audit your AIMS on your own AI systems and controls. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

Contact us about Academy access

Effivity for ISO/IEC 42001: the guide

ISO 42001 training: questions buyers ask