What are the ISO 42001 Requirements?
Understanding ISO 42001 requirements is essential for organisations developing, deploying, or using artificial intelligence systems. This guide provides a comprehensive checklist, explains the clause structure, and outlines what you need for compliance. Whether you’re exploring ISO 42001 training courses or preparing for certification, this article covers everything you need to know about what is ISO 42001 and its requirements.
In this article:
ISO 42001 Requirements Checklist
The ISO 42001 requirements are structured across ten clauses, with seven containing auditable requirements for an AI Management System (AIMS). Clauses 1-3 provide introductory information, while clauses 4-10 contain the ISO 42001 requirements organisations must fulfil. The standard is unique in addressing the responsible development and use of AI systems, incorporating ethical considerations alongside traditional management system elements.
The standard follows the Plan-Do-Check-Act (PDCA) cycle and is supported by four annexes: Annex A (normative) sets out reference control objectives and controls, Annex B (normative) provides implementation guidance for those controls, and Annexes C and D (informative) cover potential AI-related objectives and risk sources, and use of the AIMS across sectors. Below is a complete checklist covering all ten clauses:
1. Scope – Defines the boundaries and applicability of the standard to AI management systems.
2. Normative References – Refers to ISO/IEC 22989:2022, Information technology – Artificial intelligence – Artificial intelligence concepts and terminology.
3. Terms and Definitions – Provides AI-specific vocabulary including terms for AI systems, machine learning, and algorithmic processes.
4. Context of the Organization
This clause requires organisations to understand internal and external factors affecting their AIMS, including societal expectations regarding AI ethics and governance.
- 4.1 Understanding the organization and its context
- 4.2 Understanding the needs and expectations of interested parties
- 4.3 Determining the scope of the AI management system
- 4.4 AI management system
5. Leadership
Top management must demonstrate commitment to responsible AI by establishing policy, assigning roles, and ensuring accountability for AI governance.
- 5.1 Leadership and commitment
- 5.2 AI policy
- 5.3 Roles, responsibilities and authorities
6. Planning
Organisations must assess AI-specific risks, treat them, assess the impact of AI systems on individuals and society, and set objectives for responsible AI.
-
- 6.1 Actions to address risks and opportunities
- 6.1.1 General
- 6.1.2 AI risk assessment
- 6.1.3 AI risk treatment
- 6.1.4 AI system impact assessment
- 6.2 AI objectives and planning to achieve them
- 6.3 Planning of changes
7. Support
This clause addresses resources, competence (including AI-specific skills), awareness, communication, and documented information.
- 7.1 Resources
- 7.2 Competence
- 7.3 Awareness
- 7.4 Communication
- 7.5 Documented information
- 7.5.1 General
- 7.5.2 Creating and updating documented information
- 7.5.3 Control of documented information
8. Operation
Operational requirements focus on implementing the AI risk assessment, risk treatment and AI system impact assessment processes defined during planning.
- 8.1 Operational planning and control
- 8.2 AI risk assessment
- 8.3 AI risk treatment
- 8.4 AI system impact assessment
9. Performance Evaluation
Organisations must monitor AI system performance, conduct internal audits, and hold management reviews to evaluate AIMS effectiveness.
- 9.1 Monitoring, measurement, analysis and evaluation
- 9.2 Internal audit
- 9.2.1 General
- 9.2.2 Internal audit programme
- 9.3 Management review
- 9.3.1 General
- 9.3.2 Management review inputs
- 9.3.3 Management review results
10. Improvement
The final clause addresses nonconformities, corrective actions, and continual improvement of the AI management system.
- 10.1 Continual improvement
- 10.2 Nonconformity and corrective action
Non-Applicable Requirements
ISO 42001 requires all clause requirements (4-10) to be addressed within the defined scope. The standard also includes Annex A controls specific to AI systems, which must be assessed for applicability based on the organisation’s AI risk assessment and documented in a Statement of Applicability.
Organisations can exclude specific Annex A controls if they are not relevant to their AI systems or context, provided exclusions are justified and do not compromise responsible AI governance. The scope statement must clearly identify which AI systems and processes are covered.
Enrol in an ISO 42001 Training Course
Understanding these requirements demands professional training. As AI governance becomes increasingly critical, our certified courses provide the knowledge needed to interpret clauses, conduct audits, and implement effective AI management systems.
Our flagship programme:
- ISO 42001 Lead Auditor Course – Develop expertise to lead third-party certification audits for AI management systems
Ready to advance your AI governance expertise? Explore our ISO 42001 training today.
Frequently Asked Questions
Key requirements include establishing an AI policy, conducting AI risk assessments, implementing controls for AI system lifecycle management, ensuring data quality and governance, maintaining transparency, monitoring AI performance, and pursuing continual improvement. The standard addresses both technical and ethical aspects of AI governance.
Organisations that develop, provide, or use AI systems should consider ISO 42001 certification. This includes technology companies, financial services, healthcare providers, manufacturers using AI, and any organisation where AI impacts decision-making. Certification demonstrates responsible AI governance to regulators, customers, and stakeholders.
Key principles include transparency in AI operations, accountability for AI outcomes, fairness and non-discrimination, human oversight of AI systems, data privacy and security, robustness and reliability, and continuous monitoring and improvement. These principles ensure AI systems are developed and used responsibly.
ISO 27001 focuses on information security management, protecting data confidentiality, integrity, and availability. ISO 42001 specifically addresses AI management, covering AI ethics, algorithmic transparency, bias mitigation, and AI lifecycle governance. While both share the Harmonised Structure, ISO 42001 includes AI-specific controls and risk considerations not covered by ISO 27001.