Terms and definitions for ISO 42001

ISO 42001 and AI are full of jargon. The EU AI Act adds even more terms. This page explains the most important concepts in plain language.

A

Adversarial attack

An attack where someone deliberately tries to mislead an AI by giving it specific input. Think of an image that looks normal to people but is wrongly classified by the AI.

AI literacy

The knowledge and skills needed to work with AI responsibly. The EU AI Act requires this for everyone who develops, deploys or uses AI.

AI management system (AIMS)

A structured set of policies, processes and procedures for developing and using AI responsibly. The AIMS is what ISO 42001 asks of you.

AI system impact assessment (AISIA)

An analysis of the effects an AI system can have on individuals, groups and society. It looks at things such as fairness, privacy, safety and autonomy.

Read more about the AI impact assessment.

Annex A

The annex of ISO 42001 with 38 controls. You select which controls you apply, based on your risk assessment.

Audit

An independent assessment of whether your management system meets the standard. There are internal audits (carried out by you) and external audits (carried out by the certification body).

Read more about the audit process and internal audits.

B

Bias

A systematic distortion in the output of an AI system. It can arise from skewed training data, wrong assumptions in the model or measurement errors.

Example: An AI for credit assessment that systematically scores women lower because historical data contained this pattern.

Read more about bias in AI risk management.

Black box

An AI system where you cannot see how it reaches a decision. You see the input and output, but not what happens in between.

C

Certification body (CB)

The organisation that carries out audits and issues certificates. It must be accredited by the Dutch Accreditation Council (Raad voor Accreditatie, RvA).

Conformity assessment

The process of establishing whether something meets certain requirements. Under the EU AI Act, high-risk AI systems must go through a conformity assessment.

Context of the organisation

Understanding your organisation, its environment, interested parties and their expectations. Clause 4 of ISO 42001 covers this.

Corrective action

A measure to remove the cause of a deviation and prevent it from happening again. Not just fixing the symptom, but solving the underlying problem.

D

Data governance

The whole of policies, processes and responsibilities for managing data. With AI it matters even more: the quality of the data directly determines the quality of the AI.

Data lineage

The documentation of where data comes from and which operations have been performed on it. Important for traceability and quality control.

Data poisoning

Manipulating training data so that an AI model learns incorrectly. A form of attack on AI systems.

Deployer

In the context of the EU AI Act: the organisation that deploys an AI system. You do not have to have built it yourself to be a deployer.

Due diligence

Thorough research before you make a decision. In supplier management, this means researching your supplier’s AI practices.

E

Explainability

The ability to explain how an AI reaches a decision or prediction. Dutch term: uitlegbaarheid.

Explainability is not the same as transparency. Transparency is about being open about the existence and use of AI. Explainability is about being able to explain specific decisions.

F

Fairness

Fairness. With AI: the system treats all groups justly and does not discriminate. There are different definitions of fairness, and they cannot always all be achieved at the same time.

Feature

An input variable for an AI model. The characteristics on which the model bases its predictions.

Example: In a model that predicts house prices, floor area, location and year of construction are features.

Foundation model

A large AI model trained on huge amounts of data that can be adapted for different applications. GPT-4, Claude and Gemini are examples.

G

Generative AI

AI that can create new content: text, images, video, code. ChatGPT and DALL-E are well-known examples.

Governance

The system of rules, processes and responsibilities by which an organisation is directed. AI governance specifically covers steering AI activities.

H

Hallucination

When an AI system makes up information that was not in its training data and is not correct. It mainly occurs in large language models.

Example: A chatbot that convincingly cites a fictitious study, complete with an invented author and publication date.

High Level Structure (HLS)

The common structure shared by all modern ISO management system standards. It makes it easier to integrate different certifications.

Read more about integration with existing systems.

High-risk AI

A category in the EU AI Act for AI systems with a significant impact on people. Think of AI in recruitment, credit assessment, education and law enforcement. Strict requirements apply.

I

Impact analysis

See AI system impact assessment.

Inference

The process in which a trained AI model makes predictions on new data. Using the model after training.

Internal audit

An audit that you carry out yourself to check whether your system works. A mandatory part of ISO 42001.

K

Criticality

The degree to which an AI system is important to your organisation or has an impact on people. Critical systems require more control.

L

Lifecycle

The stages an AI system goes through: from design, through development and deployment, to decommissioning. ISO 42001 pays attention to the whole lifecycle.

Supplier management

The process of selecting, assessing and monitoring suppliers. Important for AI because you are also responsible for AI that you purchase.

M

Machine learning (ML)

A branch of AI in which systems learn from data instead of being explicitly programmed. The model discovers patterns in the training data.

Management review

A periodic assessment of the management system by top management. A mandatory part of ISO 42001.

Model card

A document that describes an AI model: what it does, how it was trained, what its limitations are and who it is intended for.

Model drift

The phenomenon where an AI model performs worse over time because reality changes but the model does not.

Example: A fraud detection system trained before COVID misses new fraud patterns that appeared after COVID.

N

Non-conformity

A deviation from the standard. It can be minor (a small problem) or major (a serious problem). Non-conformities are documented during audits.

O

Overfitting

When a model is trained too specifically on its training data and therefore performs poorly on new data. The model has “memorised” the training data instead of generalising.

P

PDCA cycle

Plan-Do-Check-Act. A method for continual improvement that recurs in all ISO management systems.

Provider

In the context of the EU AI Act: the developer or supplier of an AI system. It has different obligations from the deployer.

Proxy discrimination

Discrimination through indirect routes. The model does not discriminate directly on protected characteristics, but through characteristics that correlate with them.

Example: Using postcode as a feature while postcode correlates with ethnicity.

R

Residual risk

The risk that remains after you have taken your controls. It must be consciously accepted by management.

Risk appetite

The degree to which your organisation is willing to accept risks. It determines which risks need treatment.

Risk assessment

The process of identifying, analysing and evaluating risks. A core part of ISO 42001.

S

Scope

The reach of your AIMS. Which AI systems, locations and processes fall within it?

Statement of Applicability (SoA)

A document in which you state, for each Annex A control, whether you apply it and why or why not.

Read more about the required documentation.

Supervised learning

A form of machine learning in which the model learns from labelled data. You give examples with the “correct” answer.

T

Training

In AI: the process in which a model learns patterns from data. Not to be confused with training people.

Training data

The data an AI model learns from. The quality and representativeness of the training data largely determine the quality of the model.

Transparency

Openness about the use of AI. Letting people know that AI is being used, how it works and how decisions are reached.

U

Explainability (Dutch: uitlegbaarheid)

See explainability.

Unsupervised learning

A form of machine learning in which the model discovers patterns in data without given labels.

V

Validation

Checking whether the AI system is suitable for its intended purpose. Does it do what it should do?

Verification

Checking whether the AI system has been built correctly. Has it been made according to the specifications?

Verklaring van Toepasselijkheid (Statement of Applicability)

See Statement of Applicability.

Terms from the EU AI Act

Prohibited AI practices

AI applications that the EU AI Act prohibits. For example: social scoring by governments, and real-time remote biometric identification in publicly accessible places (with exceptions).

High-risk AI systems

AI systems with a significant impact. Annex III of the AI Act provides the list: biometrics, critical infrastructure, education, employment, credit, law enforcement and so on.

Limited-risk AI systems

AI systems with transparency obligations. For example: chatbots must disclose that you are talking to AI.

Minimal-risk AI systems

Most AI systems. There are no specific obligations under the AI Act, but ISO 42001 applies if you want to be certified.

Abbreviations

Abbreviation	Meaning
AI	Artificial Intelligence
AIMS	AI Management System
AISIA	AI System Impact Assessment
CI	Certification Body
HLS	High Level Structure
ML	Machine Learning
NLP	Natural Language Processing
RvA	Dutch Accreditation Council (Raad voor Accreditatie)
SoA	Statement of Applicability
VvT	Verklaring van Toepasselijkheid (Statement of Applicability)