ISO/IEC 42001:2023 — AI Management System
The first international management-system standard for artificial intelligence. Provides certifiable framework for organisations developing, providing, or using AI systems. Modelled on ISO/IEC 27001's structure (Clauses 4-10) so organisations with mature ISMS can extend to AI management system with familiar PDCA + continual improvement cadence.
Organisational context determined
Clause 4.1 — Internal and external issues relevant to the AI management system, including organisational purpose, AI use cases, and obligations.
Interested parties identified
Clause 4.2 — Needs and expectations of interested parties (users, regulators, affected groups, suppliers) relevant to AI identified.
Leadership commitment to AIMS
Clause 5.1 — Top management demonstrates leadership and commitment: AI policy + accountability + resource allocation + integration into business processes + continual improvement.
AI policy established and communicated
Clause 5.2 — AI policy includes commitment to satisfying applicable requirements, framework for setting objectives, commitment to continual improvement, and is communicated within the organisation.
Actions to address risks and opportunities
Clause 6.1 — Risks and opportunities related to the AIMS planned and addressed; risk treatment plan with controls; opportunities pursued.
AI management system objectives
Clause 6.2 — Measurable AIMS objectives consistent with the AI policy; planning to achieve them.
Resources for AIMS allocated
Clause 7.1 — Resources determined and provided: people, infrastructure, environment, technology, financial.
Competence of AI personnel
Clause 7.2 — Persons performing AI-related work are competent based on education, training, experience; competence assured by certification or training records.
Communication about AIMS
Clause 7.4 — Communication needs determined: what, when, with whom, how, by whom.
AI workload least-privilege RBAC
Clause 8.2 — Operational controls applied to AI processes; access controls enforced.
AI system impact assessment
Clause 8.3 — Impact assessment performed for AI systems; updated as system evolves.
AI image registry policy
Clause 8.4 — Data and software components sourced from approved registries; integrity verified.
AIMS monitoring, measurement, evaluation
Clause 9.1 — AIMS performance monitored, measured, analysed, evaluated; results documented.
Internal audit of AIMS
Clause 9.2 — Internal audit at planned intervals; findings documented; corrective actions tracked.
Continual improvement of AIMS
Clause 10.1 — AIMS continually improved based on audit findings, incidents, management review, stakeholder feedback.