ISO 42001 Requirements Explained

ISO 42001 is the international standard for AI management systems. Here are the management-system clauses, Annex A control objectives and the evidence a Stage 2 auditor will sample.

The management-system clauses

ISO 42001 uses the same high-level structure as ISO 27001 and other ISO management-system standards. Clauses 4 through 10 define the AIMS itself — how you set it up, run it, measure it and improve it.

Context of the organisation

Define scope — which AI systems the AIMS covers, interested parties, external and internal issues shaping the AI programme.

Leadership

Executive accountability, AI policy approval, roles and responsibilities for AI governance.

Planning

AI risk assessment and treatment, AI objectives, change planning for the AIMS.

Support

Resources, competence, awareness, communication and documented information for the AIMS.

Operation

AI system lifecycle controls, impact assessments, pre-deployment reviews, change management.

Performance evaluation

Monitoring, measurement, analysis, internal audit of the AIMS, management review cadence.

Improvement

Non-conformity handling, corrective actions, continual improvement rhythm.

Annex A control objectives

Annex A groups the AIMS-specific controls under nine objectives. These are the AI-native practices the standard asks you to run.

A.2 Policies related to AI

AI policy approved by leadership, communicated across the organisation and reviewed on a defined cadence.

A.3 Internal organisation

Roles for AI governance — model owner, oversight owner, risk owner — with clear escalation paths.

A.4 Resources for AI systems

Data, tooling, compute and competence budgeted and tracked across the AI lifecycle.

A.5 AI system impact assessments

Impact assessments per high-risk system, revisited on material change and after significant incidents.

A.6 AI system lifecycle

Development, evaluation, deployment, operation and decommissioning gates with sign-off and traceability.

A.7 Data for AI systems

Data governance across training, evaluation and inference — provenance, consent, quality, retention, bias checks.

A.8 Information for interested parties

Transparency to users and affected parties — what the AI system does, limitations, routes for feedback or appeal.

A.9 Use of AI systems

Intended-use statements, prohibited uses, acceptable-use training for operators and end users.

A.10 Third-party relationships

Governance over foundation-model vendors, tooling providers and downstream deployers of your AI systems.

AI impact assessments — the core artefact

The AI impact assessment is the single most-sampled artefact at Stage 2. Every high-risk AI system needs one, and it needs to be a real document — not a box-tick. A good impact assessment covers:

Intended use: what the system is designed to do, who it is for, where it is deployed.
Affected parties: who is impacted — users, operators, decision subjects, third parties.
Risk scenarios: bias, hallucination, misuse, safety, security, privacy, environmental.
Mitigations: controls that reduce likelihood or impact, with evidence of their operation.
Residual risk: what remains after mitigations, who accepts it, what triggers re-assessment.
Monitoring: what signals indicate the risks are materialising in production.

The impact assessment is revisited when the system changes materially — new data sources, new use cases, new deployment context, significant incidents.

AI inventory and risk tiering

Before any Annex A control is evaluated the auditor expects a documented inventory: every production AI system, its intended use, its risk tier (typically low / medium / high) and its named owner. Teams that walk into Stage 2 without an inventory get a mandatory corrective action.

What the Stage 2 auditor samples

Stage 2 is evidence sampling. For ISO 42001 expect the auditor to walk every artefact below for a sampled high-risk system:

AI policy with executive approval record
AI system inventory with intended use, risk tier and owner per system
AI impact assessments for high-risk systems
Dataset documentation — provenance, consent, bias checks, retention
Evaluation reports — benchmarks, red-team, bias assessment pre-deployment
Human-oversight runbook with escalation path for high-risk inferences
Monitoring dashboard with drift, performance and incident logs
Risk register with AI-specific scenarios (bias, hallucination, misuse, supply-chain)
Supplier register for foundation-model and tooling vendors
Internal audit record of the AIMS
Management review minutes with actions tracked
Training records — AI awareness, role-based secure ML development

How ISO 42001 relates to ISO 27001

ISO 42001 reuses the ISO management-system structure. If you already run an ISO 27001 ISMS, the clauses 4–10 machinery (leadership, planning, support, operation, performance evaluation, improvement) is already in place. The AIMS adds the Annex A controls specific to AI — impact assessments, data governance, lifecycle controls, oversight — on top of your existing ISMS.

Running both together on one audit calendar is the common pattern. See the ISO 27001 framework page.

Frequently asked questions

Who does ISO 42001 apply to?

Any organisation that develops, deploys or uses AI systems. The standard is sector-agnostic — SaaS teams building AI features, model-first startups, enterprises deploying third-party AI, and public-sector programmes all fit the scope.

Does ISO 42001 require technical AI benchmarks?

Not directly. ISO 42001 is a management-system standard. It asks that you have evaluation processes, documented benchmarks appropriate to the use case, and sign-off gates. The auditor samples that the processes run — not that your model hits a particular accuracy number.

How does ISO 42001 relate to the EU AI Act?

Overlapping, not identical. The EU AI Act imposes legal obligations for high-risk AI with monetary and operational consequences. ISO 42001 is a voluntary management-system standard whose practices make meeting the Act substantially easier — but the Act has specific requirements (conformity assessments, declarations, registration) that ISO 42001 does not fully cover.

What is an AI impact assessment?

A documented analysis of the harm pathways from a specific AI system: who is affected, what can go wrong, what mitigations are in place, and what residual risk remains. ISO 42001 requires one per high-risk system, revisited when the system changes materially.

How does ISO 42001 overlap with ISO 27001?

ISO 42001 shares the management-system structure (context, leadership, risk management, continual improvement) with ISO 27001. If you already run an ISMS you reuse the governance, risk-management and audit machinery — the AIMS adds AI-specific Annex A controls on top.