ISO/IEC 42001:2023 is the world’s first international standard for an AI Management System (AIMS). It uses the same clause structure as ISO 27001 (clauses 4–10) but focuses on AI governance rather than information security.
The ISO 27001 Bridge: 60% Already Done
Organisations with ISO 27001 have completed most structural work. Identical elements: context of organisation, leadership, support, performance evaluation, improvement.
Genuinely New Elements
- AI-specific risk assessment beyond CIA (confidentiality, integrity, availability)
- AI Impact Assessment (no ISO 27001 equivalent)
- Data governance specifically for AI training and operations
- Responsible AI principles as auditable commitments
- AI system lifecycle management from design through retirement
What You Need to Implement
AI Policy (Clause 5)
Must address fairness, transparency, accountability, safety, human oversight with specific, auditable commitments. "We are committed to ethical AI" lacks auditability.
AI Risk Assessment (Clause 6)
- Bias and discrimination: Unfair outcomes for protected groups
- Safety and reliability: Physical or psychological harm potential
- Transparency: Decision understandability
- Privacy: Model memorisation, inference attacks
- Societal impact: Job displacement, environmental costs
- Accountability gaps: When harmful decisions occur
AI System Lifecycle (Clause 8)
Design
Requirements specs, data quality criteria, fairness metrics, stakeholder consultation
Development
Data governance, model documentation, testing (fairness, robustness, edge cases)
Deployment
Approval process, user documentation, monitoring plan, rollback procedures
Monitoring
Performance tracking, AI-specific IR, regular risk reassessment, feedback mechanisms
Retirement
Decommissioning, data deletion, stakeholder notification, knowledge capture
Annex A: 38 AI-Specific Controls
| Category | Focus |
|---|---|
| A.2–A.4: Policies & Organisation | Policy establishment, roles, responsibilities |
| A.5–A.7: Risk Management | Assessment, treatment, documentation |
| A.8–A.12: Development & Data | Data quality, design docs, testing, validation |
| A.13–A.15: Transparency | Disclosures, explainability, capability communication |
| A.16–A.20: Operations | Performance tracking, incidents, bias monitoring |
| A.21–A.23: Human Oversight | HITL, override mechanisms, escalation |
EU AI Act Connection
ISO 42001 maps closely to EU AI Act requirements. The European Commission indicated that harmonised standards including ISO 42001 provide presumption of conformity.
90-Day Implementation
Month 1: Foundation
AI inventory including shadow AI. Gap assessment against ISO 42001. Define AIMS scope. Secure management commitment.
Month 2: Risk & Policy
Extend risk methodology. Conduct assessments for in-scope systems. Draft AI policy. Develop AIA procedure.
Month 3: Controls & Audit
Map Annex A controls. Complete Statement of Applicability. Internal audit. Management review. Corrective actions.
Need help implementing this?
First strategy session is complimentary. We typically respond within 4 hours.