What is an AI management system (AIMS)?

An AI management system (AIMS) is the whole of policies, processes, roles and measures with which an organisation manages its AI activities responsibly. ISO 42001 describes what such a system must contain. The standard is available via NEN and builds on the same High Level Structure as ISO 27001 and ISO 9001. The EU AI Act has no management system requirement of its own, but an AIMS helps you demonstrate compliance with that law.

An AIMS is not a document or handbook. It is an ongoing system that works, improves and moves along with your organisation and the AI you use. On the page requirements of the standard you can read what ISO 42001 requires per chapter. On this page we explain what an AIMS is, how it is structured and how it differs from an information security management system (ISMS).

The PDCA cycle as the backbone

ISO 42001 follows the Plan-Do-Check-Act cycle. That cycle drives continual improvement: you never stop, but you keep getting better.

Phase	What it means	ISO 42001 clauses
Plan	Determine context, identify risks, set objectives, choose measures	Clauses 4, 5, 6
Do	Run the system: risk management, impact assessments, implement measures	Clauses 7, 8
Check	Measure, monitor, audit, management review	Clause 9
Act	Correct deviations, improve the system	Clause 10

Concrete example: a mid-sized fintech company determines in the Plan phase that its credit scoring algorithm is high risk. In the Do phase it carries out an AI impact assessment and implements bias detection. In the Check phase it measures whether the outcomes are fair for different customer segments. In the Act phase it corrects the model if it sees unequal outcomes. Then the cycle starts again.

The elements of an AIMS

An AIMS consists of four layers. Below you can see which elements belong to each layer.

Layer	Elements
Policy and governance	AI policy, roles and responsibilities, top management commitment, objectives
Processes	AI inventory, risk assessment, impact assessment, lifecycle management, internal audit, management review
Measures	Annex A controls (technical, organisational, procedural)
Documentation	Scope, policy, risk register, Statement of Applicability, audit reports, impact analyses

Policy and governance is the foundation. Without a clear AI policy and named owners, the rest has no support. The policy describes the intentions and boundaries: which AI applications do you want? Which do you not want? Which principles apply? Read more about AI governance.

Processes are the engine. These include the risk assessment per AI system, the impact analysis and lifecycle management. These are the actions that take place periodically and that prove your AIMS works.

Measures are the concrete interventions. You select them from the Annex A controls based on your risks. The 38 measures are divided over nine domains, from AI policy to impact assessment.

Documentation is the evidence. Without documentation there is no audit and no certificate. But documentation is not the goal: it is the proof that the rest works.

ISO 42001 does not require a thick handbook. What matters is that you can demonstrate that processes are actually carried out and that your AI systems are managed responsibly. A concise but current set of documentation is better than an extensive but outdated one.

AIMS versus ISMS: similarities and differences

If you already have an information security management system (ISMS) that conforms to ISO 27001, you will recognise the structure of the AIMS straight away. They follow the same structure, but have a different focus.

Feature	ISMS (ISO 27001)	AIMS (ISO 42001)
Purpose	Protect information	Manage AI responsibly
Focus	Confidentiality, integrity, availability	Transparency, fairness, explainability
Risk analysis	Security risks	AI-specific risks (bias, model drift, impact on people)
Controls	93 controls (Annex A of ISO 27001)	38 controls (Annex A of ISO 42001)
Unique element	Information classification, cryptography	Impact assessment (AISIA), AI lifecycle management
Governance	CISO role central	AI officer role (new; see AI governance)
Certifiable	Yes	Yes

The big similarity: the governance structure, the risk management process, the internal audit and the management review are almost identical in both standards. If you already have an ISMS, you can reuse 60-70% of that infrastructure.

The big difference: the AI impact assessment does not exist in an ISMS. It goes further than security risks. It asks you to consider the societal consequences of your AI.

An ISMS protects information. An AIMS ensures responsible AI. If your AI processes personal data, ideally you have both. The two systems can be integrated into one combined management system.

How large should an AIMS be?

The scope fits your organisation. ISO 42001 does not prescribe a minimum set of documentation, only mandatory elements.

A start-up with one AI product has a different AIMS than a large company with dozens of AI applications. That is the intention. The standard says: you need a system that is proportionate to the complexity and risk of your AI.

Practical indications:

Small company (< 50 employees, 1-3 AI systems): An AIMS fits on about ten documents. Gap analysis, AI policy, AI register, risk register, one or two impact analyses, Statement of Applicability and an audit report.
Medium-sized (50-500 employees, 5-20 AI systems): More processes and more documentation, but still manageable. Expect implementation to take about half a year.
Large (500+ employees, a lot of AI): A complex system with formal governance structures, an AI committee and a dedicated AI officer.

The AIMS as a basis for AI Act compliance

A fully implemented AIMS does not guarantee compliance with the EU AI Act, but it provides a solid basis. The core of what the EU AI Act requires from providers of high-risk AI (risk management system, documentation, logging, governance, impact analysis) overlaps strongly with what an AIMS already covers.

What the AIMS does not cover: the formal conformity assessment procedure, CE marking, registration in the EU database and the EU Declaration of Conformity. These are additional steps that you must take alongside your AIMS.