Clause 4 + 5
AI context & leadership
Define the organisation's AI use cases, interested parties, AI policy, and management commitment. The AIMS scope must reflect the actual AI footprint, not just ambition.
ISO/IEC 42001:2023 · AI Governance
ISO 42001
Readiness Assessment
The first certifiable AI management standard. Assesses governance structures, AI risk and impact assessment frameworks, and responsible AI practices for organisations developing or deploying AI systems.
- 18 QuestionsAssessment
- ~10 minDuration
- AI Developers & UsersScope
Who it applies to
- Organisations developing, deploying, or providing AI systems — including general-purpose AI, decision-support, and embedded AI in products
- Suppliers to enterprise customers, public sector, or regulated industries who must evidence responsible AI governance
- Organisations subject to the EU AI Act seeking a recognised conformity-with-good-practice baseline
Key articles & clauses, in plain English
The five points auditors and supervisors actually verify first.
Clause 6.1 / Annex A 5
AI risk & impact assessment
Each AI system requires a documented risk assessment covering safety, fairness, privacy, security, and societal impact — distinct from a generic IT risk assessment.
Annex A 7
Data management for AI
Defined data quality, lineage, bias monitoring, and dataset documentation requirements for training, validation, and operation of AI systems.
Annex A 9
Transparency & human oversight
Meaningful human oversight of consequential AI decisions, plain-language explanations of AI outputs, and disclosure that an AI system is in use.
Annex A 10
AI-specific incident management
A process for detecting and responding to model drift, bias emergence, hallucinations, and adversarial attacks — distinct from the general IT incident process.
What this assessment covers
5 topics · 18 self-assessment questions.
- Domain 01
AI Governance & Leadership
ISO 42001 Clause 5 requires top management to establish an AI policy, assign documented roles and responsibilities, and demonstrate active accountability for the AI Management System (AIMS). These are the first controls checked in any ISO 42001 lead audit.
- Domain 02
AI Risk & Impact Assessment
Clause 6 requires a formal AI risk assessment process, AI Impact Assessments (AIIAs) for high-consequence systems, explicit treatment of AI-specific risks, and a Statement of Applicability mapping risks to Annex A controls. These are the most technically demanding requirements in ISO 42001.
- Domain 03
Data & Model Governance
Annex A controls 8.2–8.4 require documented data governance covering AI training data quality, representational bias, model testing before deployment, and full lineage of training data sources. These controls directly affect regulatory compliance under GDPR and the EU AI Act.
- Domain 04
Transparency & Human Oversight
Annex A controls 9.1–9.3 require that AI systems support meaningful human oversight, that consequential AI-generated decisions are explainable, and that affected individuals are informed when AI is used. These controls align directly with GDPR Article 22 and EU AI Act obligations.
- Domain 05
Operations & Continual Improvement
Clauses 8–10 require controlled AI deployments, AI-specific incident management, mandatory internal audits of the AIMS, and a formal management review process. These requirements distinguish organisations with mature AI governance from those with AI policies that exist only on paper.
Top audit pitfalls
- Reusing the ISO 27001 risk register without adding AI-specific impact dimensions (fairness, explainability, drift).
- Vendor AI features used in production with no documented risk assessment because they were not a 'project'.
- No defined process for retraining or rolling back models when bias or drift is detected.
Frequently asked questions
Yes. ISO/IEC 42001:2023 is the first certifiable AI management system standard. Several accreditation bodies issued their first accredited certifications in 2024–2025.
Not automatically, but it covers a substantial portion of the AI Act's risk management, transparency, oversight, and post-market monitoring obligations. It is the most direct route to AI Act readiness.
Not strictly, but ISO 42001 assumes mature information security. Most organisations adopt 42001 alongside or after 27001 to avoid duplicating risk and operations infrastructure.
Yes. ISO 42001 covers AI users, not just developers. If your organisation uses AI to inform consequential decisions, the AIMS controls apply to your governance of that usage.
High-risk AI systems will require a documented risk management system, post-market monitoring, technical documentation, and human oversight — every one of which maps to ISO 42001 controls.
Currently a small group of certification bodies have accreditation for ISO 42001. Lead Auditor qualification (e.g. PECB) is required to perform certification audits.
Start your ISO 42001 assessment
18 questions · ~~10 min · Scorecard based on your answers. No sign-up to begin.