Requirements of ISO 42001

What does ISO/IEC 42001 actually ask for? On this page we explain the requirements of the standard. ISO 42001 follows the High Level Structure (HLS) that you may know from ISO 27001 or ISO 9001. The standard is available in the Netherlands from NEN . Alongside the clauses, the standard asks for the Annex A controls, which you will be tested on during the audit.

Structure of ISO 42001

ISO 42001 has ten clauses. The first three are introductory (scope, normative references, terms and definitions). Clauses 4 to 10 contain the requirements you will be audited against.

Part	Content
Clause 4	Context of the organisation
Clause 5	Leadership
Clause 6	Planning
Clause 7	Support
Clause 8	Operation
Clause 9	Performance evaluation
Clause 10	Improvement
Annex A	38 controls for AI management
Annex B	Implementation guidance
Annex C	AI objectives and risk sources
Annex D	Sector-specific standards

The High Level Structure means the clause structure is the same as in other modern ISO standards. If you know ISO 27001, you will recognise the structure. This makes it easier to integrate several management systems.

Clause 4: Context of the organisation

Before you can set up an AI management system, you must understand the context in which you operate.

Internal and external factors

You identify which factors are relevant to your AI activities.

External factors include, for example: laws and regulations (the EU AI Act), expectations of customers and society, technological developments, competition and public opinion about AI.

Internal factors include, for example: your organisational culture, technical capabilities, available expertise, existing governance structures and strategic direction.

Interested parties

Who has an interest in how you handle AI? Think of:

Customers who use your AI products or services
Employees who work with AI
Regulators and government bodies
Shareholders and investors
Wider society

For each group, you determine their expectations and requirements.

The scope

You define what falls within the AI management system. Which AI systems? Which processes? Which parts of the organisation?

The scope must be documented. An auditor checks whether your scope is logical and complete.

The AI management system

You must establish, implement, maintain and continually improve an AI management system (AIMS). This is the core of the standard: not arranging something once, but running an ongoing system. Read more about the structure, the PDCA cycle and the elements of an AIMS on the page what is an AI management system.

Clause 5: Leadership

AI governance only works with support from the top.

Commitment from top management

Top management must show that it is involved. This means:

Making resources available (people, money, time)
Communicating the importance of the AIMS
Making sure objectives are achieved
Encouraging people to contribute
Supporting improvement

This is not a paper exercise. Auditors check whether top management is genuinely involved.

AI policy

Top management establishes an AI policy. This policy describes:

The intentions and direction of the organisation regarding AI
Commitment to responsible AI (transparency, fairness, explainability)
Commitment to meeting requirements (laws, regulations, contracts)
Commitment to continual improvement

The policy must be documented, communicated and available.

Roles and responsibilities

It must be clear who is responsible for what. Typical roles:

Who owns specific AI systems?
Who carries out impact assessments?
Who decides on accepting risks?
Who is responsible for the AIMS as a whole?

AI governance is not only an IT responsibility. It also touches legal, compliance, HR and business. Make sure all relevant functions are involved.

Clause 6: Planning

Planning is about addressing risks and setting objectives.

Risks and opportunities

You identify risks and opportunities that affect the AIMS. This is a broader level than the risk analysis per AI system (which comes in clause 8).

At AIMS level, you think of risks such as: insufficient expertise, changing regulations, reputational damage from AI incidents. Opportunities can include: efficiency gains, new markets, competitive advantage.

AI risk assessment

The standard requires a documented process for assessing AI risks. This process must:

Define criteria for assessing risks
Produce consistent, valid and comparable results
Identify, analyse and evaluate risks

The difference from a standard risk analysis: you look specifically at AI risks. Technical risks (model drift, bias, errors), organisational risks, legal risks, ethical risks. Read more about AI risk management.

AI system impact assessment

Unique to ISO 42001 is the obligation to assess the impact of AI systems on individuals, groups and society.

The AI impact assessment asks you to consider:

What are the consequences if the AI makes wrong decisions?
Who is affected by this?
How serious is that?
Can people understand and challenge the decisions?
Are there groups that are systematically disadvantaged?

Risk treatment

For each identified risk, you decide what you will do:

Avoid: do not carry out the activity that causes the risk
Reduce: implement controls
Transfer: pass the risk on (insurance, outsourcing)
Accept: consciously accept the risk

For risks you reduce, you select controls from Annex A.

Statement of applicability

You document which Annex A controls you have selected and why. For controls you do not select, you explain why not.

This is the statement of applicability (SoA), a mandatory document for certification. Read more about required documentation.

Objectives

You set objectives for the AIMS. These must:

Be consistent with the AI policy
Be measurable where possible
Be monitored
Be communicated
Be updated when necessary

Examples: “95% of new AI systems go through the impact assessment process before going live”, “All employees who work with AI complete training every year”.

Clause 7: Support

This clause covers the resources you need.

Resources

You must make sufficient resources available. People, time, money, tooling. Without resources, there is no working system.

Competence

Employees must have the right competences for their tasks. This means:

Determining which competences are needed
Making sure employees have them (through training, experience or hiring)
Keeping evidence (certificates, training records)

AI governance requires specific competences. Technical knowledge about AI, but also knowledge about ethics, privacy and risk management.

Awareness

Everyone in the organisation must be aware of:

The AI policy
Their contribution to the AIMS
The benefits of good AI governance
The consequences of non-compliance

Communication

You plan how you communicate about the AIMS:

What do you communicate?
When?
To whom?
How?
Who is responsible?

Documented information

The standard requires certain documents. In addition, you decide which further documentation is needed.

Mandatory documents:

Scope of the AIMS
AI policy
Risk assessment and treatment
Statement of applicability
Objectives
Evidence of competence
Results of internal audits
Results of management reviews
Nonconformities and corrective actions

Document management is also required: version control, approval, availability, protection.

Clause 8: Operation

This is where the actual work takes place.

Operational planning and control

You plan and control the processes needed to meet the requirements. This includes:

Establishing criteria for processes
Implementing control of processes
Keeping documented information

Carrying out risk and impact assessments

You must actually carry out the processes defined in clause 6. For each AI system, you perform the risk assessment and impact assessment.

You document and retain the results.

Implementing risk treatment

You actually implement the selected controls. This is where theory becomes practice.

AI system lifecycle

The standard asks for attention to the whole lifecycle of AI systems: development, testing, deployment, monitoring, maintenance and decommissioning.

Each stage has specific points of attention. In development: data quality, bias detection. In deployment: monitoring, logging. In decommissioning: data retention, archiving.

The lifecycle approach matters. AI is not “finished” after the first release. Models can degrade, data changes, the world changes. Ongoing attention is needed.

Clause 9: Performance evaluation

You must check whether the system works.

Monitoring and measurement

You determine:

What you measure (effectiveness of the AIMS, performance of AI systems)
How you measure
When you measure
Who measures
How you analyse the results

Internal audit

You carry out internal audits at planned intervals. The audit checks:

Does the AIMS meet the requirements of the standard?
Does the AIMS meet your own requirements?
Is the AIMS effectively implemented and maintained?

The audit must be independent. An auditor may not review their own work.

You must have an audit programme: frequency, methods, responsibilities, reporting. Read more about internal audits.

Management review

At planned intervals, top management reviews how the AIMS is functioning. The management review looks at:

Status of actions from previous reviews
Changes in context and interested parties
Performance: nonconformities, audits, objectives
Opportunities for improvement

The output is decisions on improvements, any changes to the AIMS, and the resources needed.

Clause 10: Improvement

The system must continually get better.

Nonconformities and corrective actions

When something goes wrong (a nonconformity), you must:

React: address the problem
Evaluate: is action needed to prevent recurrence?
Correct: remove the cause
Review effectiveness: does the correction work?
Document: record what happened and what was done

Continual improvement

You continually improve the suitability, adequacy and effectiveness of the AIMS.

This is not a vague intention but a concrete obligation. You must be able to show that you are improving.

The annexes of ISO 42001

Annex A: Controls

Annex A contains 38 controls spread across nine domains. It is not a checklist to work through blindly. You select controls based on your risks.

Annex B: Implementation guidance

Annex B gives practical guidance for each control in Annex A. How can you implement the control? What are the points of attention?

Annex C: Objectives and risk sources

Annex C helps you identify AI-related objectives and risk sources. It gives examples of what you might consider.

Annex D: Sector-specific standards

Annex D refers to other standards that may be relevant to specific sectors or applications.

Difference between ISO 42001 and ISO 27001

If you know ISO 27001, you will recognise a lot. The structure is identical. But there are fundamental differences.

AI-specific elements: impact assessment, attention to bias and fairness, explainability, the whole AI lifecycle.

Different controls: Annex A of ISO 42001 is about AI, not about information security.

Different focus: ISO 27001 protects information. ISO 42001 ensures responsible AI. There is overlap (AI processes data), but the angle is different.