_1762866128417-DS2_OO1j.png)
What ISO 42001 covers
ISO/IEC 42001 sets out requirements for a management system for artificial intelligence. It applies to organisations that develop, provide or use AI systems – regardless of size and industry. The goal is responsible use of AI: risks to the organisation, affected people and society are identified and managed without needlessly slowing innovation.
The standard follows the Harmonized Structure and therefore combines well with ISO 27001 and ISO 9001. Clauses 4 to 10 are complemented by Annex A with 38 controls in nine areas – from AI policies, resources, impact assessment and lifecycle to data, information for interested parties, use of AI systems and third-party relationships.
The requirements at a glance
| Area | Requirement | Typical evidence |
|---|---|---|
| 4 Context | Role of the organisation (provider, deployer, user), interested parties, scope | Context analysis, AI inventory |
| 5 Leadership | AI policy, roles and responsibilities | Approved AI policy |
| 6.1.2 | AI risk assessment | Method and results |
| 6.1.3 | AI risk treatment, statement of applicability | Treatment plan, SoA for Annex A |
| 6.1.4 | AI system impact assessment | Impact assessment per system |
| 7 | Resources, competence, awareness, documentation | Training records, controlled documents |
| 8 | Operation: performing risk assessment, treatment and impact assessment | Updated assessments |
| 9, 10 | Monitoring, internal audit, management review, improvement | KPIs, audit reports, CAPA |
Risk assessment and impact assessment
A special feature of ISO 42001 is the distinction between risk assessment and system impact assessment. The risk assessment looks at risks to the organisation's objectives. The impact assessment looks outward: what effects can an AI system have on individuals, groups and society – for example through discrimination, lack of transparency, safety risks or interference with fundamental rights?
- Purpose and context: what is the system used for, who is affected, which decisions does it influence?
- Data: origin, quality, representativeness and possible bias of training and input data.
- Human oversight: who checks results, who can intervene, how are errors detected?
- Transparency: do affected people know AI is involved, and can they understand decisions?
- Robustness and security: how does the system behave with unexpected inputs or attacks?
docxpert provides the templates "AI risk & impact assessment" and "AI lifecycle, data & human oversight" for this.
How docxpert supports your AIMS
Five steps to an AI management system
- 1
Build the AI inventory
Record every AI system you use or develop – including assistants in standard software and freely used tools.
- 2
Define role and scope
For each system clarify whether you are provider, deployer or user, and define the scope of the AIMS.
- 3
Policy and responsibilities
Adopt an AI policy, assign AI governance roles and introduce an approval process for new AI systems.
- 4
Assess and define controls
Carry out risk and impact assessments, select Annex A controls and justify them in the SoA.
- 5
Train, monitor, improve
Build AI literacy, monitor systems in operation, audit internally and evaluate in the management review.
The guide EU AI Act AI inventory and the EU AI Act checklist help you get started.
Practical tips
- Make shadow AI visible: actively ask business areas which AI tools they use. Many systems arrive through standard software.
- Approve before use: a simple process for new AI tools keeps the inventory from going stale.
- Connect with existing systems: reuse roles, document control, audit and management review from ISO 9001 or ISO 27001.
- Include suppliers: for purchased AI systems, request information on data, models and limitations from the provider.
Frequently asked questions
Which documents belong to an AIMS?
At least the scope, AI policy, AI risk assessment method and results, impact assessments, statement of applicability, AI objectives, evidence of competence and the results of monitoring, internal audit and management review. Add evidence for the Annex A controls you have declared applicable.
Who should be responsible for ISO 42001 in the company?
A designated AI governance role that works closely with information security, data protection, legal and business areas has proven effective. As with all management systems, overall responsibility lies with top management.
Who is ISO 42001 relevant for?
For every organisation that develops, provides or uses AI and wants to do so demonstrably responsibly – such as software vendors with AI features, companies using AI in decision processes or service providers whose customers ask for evidence.
Is ISO 42001 mandatory?
No, the standard is voluntary. But it helps organise legal obligations such as those of the EU AI Act and is increasingly requested in tenders and supplier assessments.
How are ISO 42001 and ISO 27001 related?
Both follow the same structure. Context, roles, document control, internal audit and management review can be shared. ISO 42001 adds AI-specific topics such as impact assessment, data quality and human oversight.
Do all 38 Annex A controls have to be implemented?
No. As with ISO 27001, you consider all controls and justify in the statement of applicability which ones you apply. The selection follows from your risk and impact assessments.
How long does implementation take?
With an existing ISO 27001 or ISO 9001 system, four to eight months is realistic because many foundations are already in place. Without a management system, plan more time.
Does docxpert also support the EU AI Act?
Yes. A requirement catalogue and nine templates for the EU AI Act are built in, and the AI register records role and risk class per system.
How should I decide which AI systems fall within the AIMS scope?
Start with the organisational and subject boundaries of your management system, then identify AI systems developed, procured, integrated or used within them. Include features in standard software and externally operated services when they influence your organisation's decisions or processes. Describe purpose, users, data types, affected parties and dependencies before assessing risk. If a system sits outside the AIMS scope, document the reasoned boundary; that does not automatically remove its risks from other management systems. Reconcile the inventory with IT, procurement, business teams and privacy owners, and define an approval route for new uses. Review the scope when an intended use, provider or model changes materially so that governance continues to reflect actual use.