> Build an ISO 42001 AI management system: AI inventory, risk and impact assessment, statement of applicability and AI literacy training – bridged to the EU AI Act. Source: [https://docxpert.io/en/standards/iso-42001](https://docxpert.io/en/standards/iso-42001) # ISO 42001 AI Management System with docxpert ## What ISO 42001 covers ISO/IEC 42001 sets out requirements for a management system for artificial intelligence. It applies to organisations that develop, provide or use AI systems – regardless of size and industry. The goal is responsible use of AI: risks to the organisation, affected people and society are identified and managed without needlessly slowing innovation. The standard follows the Harmonized Structure and therefore combines well with [ISO 27001](https://docxpert.io/en/standards/iso-27001) and [ISO 9001](https://docxpert.io/en/standards/iso-9001). Clauses 4 to 10 are complemented by **Annex A with 38 controls** in nine areas – from AI policies, resources, impact assessment and lifecycle to data, information for interested parties, use of AI systems and third-party relationships. ISO 42001 and the EU AI Act The EU AI Act is a regulation with obligations depending on role and risk class. ISO 42001 is a voluntary management system standard. An AIMS provides the organisation to meet AI Act obligations in a structured way – but an ISO 42001 certificate alone does not create a presumption of conformity under the AI Act. ## The requirements at a glance | Area | Requirement | Typical evidence | | --- | --- | --- | | 4 Context | Role of the organisation (provider, deployer, user), interested parties, scope | Context analysis, AI inventory | | 5 Leadership | AI policy, roles and responsibilities | Approved AI policy | | 6.1.2 | AI risk assessment | Method and results | | 6.1.3 | AI risk treatment, statement of applicability | Treatment plan, SoA for Annex A | | 6.1.4 | AI system impact assessment | Impact assessment per system | | 7 | Resources, competence, awareness, documentation | Training records, controlled documents | | 8 | Operation: performing risk assessment, treatment and impact assessment | Updated assessments | | 9, 10 | Monitoring, internal audit, management review, improvement | KPIs, audit reports, CAPA | ## Risk assessment and impact assessment A special feature of ISO 42001 is the distinction between **risk assessment** and **system impact assessment**. The risk assessment looks at risks to the organisation's objectives. The impact assessment looks outward: what effects can an AI system have on individuals, groups and society – for example through discrimination, lack of transparency, safety risks or interference with fundamental rights? - **Purpose and context:** what is the system used for, who is affected, which decisions does it influence? - **Data:** origin, quality, representativeness and possible bias of training and input data. - **Human oversight:** who checks results, who can intervene, how are errors detected? - **Transparency:** do affected people know AI is involved, and can they understand decisions? - **Robustness and security:** how does the system behave with unexpected inputs or attacks? docxpert provides the templates "AI risk & impact assessment" and "AI lifecycle, data & human oversight" for this. ## How docxpert supports your AIMS AI registerThe [AI register](https://docxpert.io/en/features/ai-register) records every AI system with purpose, role, risk class and linked evidence – the basis for context and scope. 22 templatesTemplates mapped to ISO 42001, including AI inventory and risk classification, AI risk and impact assessment, statement of applicability and AI lifecycle. Gap analysisRequirement catalogues for ISO 42001 and for the EU AI Act are built in. The [gap analysis](https://docxpert.io/en/features/gap-analysis) shows open items for both. AI literacy trainingTrainings with quiz and certificate demonstrate the competence required by ISO 42001 clause 7.2 and Article 4 of the EU AI Act. Controlled AI policiesAI policy and usage rules are versioned, approved and distributed with a [read acknowledgement](https://docxpert.io/en/features/read-acknowledgement). Transparent about our own AIdocxpert lists its own AI function, "Docxpert.io Document Intelligence", in the AI register and logs AI results traceably. Each AI system with role, risk class and linked requirements. · Screenshot with sample data ## Five steps to an AI management system 1. 1 Build the AI inventory Record every AI system you use or develop – including assistants in standard software and freely used tools. 2. 2 Define role and scope For each system clarify whether you are provider, deployer or user, and define the scope of the AIMS. 3. 3 Policy and responsibilities Adopt an AI policy, assign AI governance roles and introduce an approval process for new AI systems. 4. 4 Assess and define controls Carry out risk and impact assessments, select Annex A controls and justify them in the SoA. 5. 5 Train, monitor, improve Build AI literacy, monitor systems in operation, audit internally and evaluate in the management review. The guide [EU AI Act AI inventory](https://docxpert.io/en/guides/eu-ai-act-ai-inventory) and the [EU AI Act checklist](https://docxpert.io/en/checklists/eu-ai-act) help you get started. ## Practical tips - **Make shadow AI visible:** actively ask business areas which AI tools they use. Many systems arrive through standard software. - **Approve before use:** a simple process for new AI tools keeps the inventory from going stale. - **Connect with existing systems:** reuse roles, document control, audit and management review from ISO 9001 or ISO 27001. - **Include suppliers:** for purchased AI systems, request information on data, models and limitations from the provider. ## Frequently asked questions Which documents belong to an AIMS? At least the scope, AI policy, AI risk assessment method and results, impact assessments, statement of applicability, AI objectives, evidence of competence and the results of monitoring, internal audit and management review. Add evidence for the Annex A controls you have declared applicable. Who should be responsible for ISO 42001 in the company? A designated AI governance role that works closely with information security, data protection, legal and business areas has proven effective. As with all management systems, overall responsibility lies with top management. Who is ISO 42001 relevant for? For every organisation that develops, provides or uses AI and wants to do so demonstrably responsibly – such as software vendors with AI features, companies using AI in decision processes or service providers whose customers ask for evidence. Is ISO 42001 mandatory? No, the standard is voluntary. But it helps organise legal obligations such as those of the EU AI Act and is increasingly requested in tenders and supplier assessments. How are ISO 42001 and ISO 27001 related? Both follow the same structure. Context, roles, document control, internal audit and management review can be shared. ISO 42001 adds AI-specific topics such as impact assessment, data quality and human oversight. Do all 38 Annex A controls have to be implemented? No. As with ISO 27001, you consider all controls and justify in the statement of applicability which ones you apply. The selection follows from your risk and impact assessments. How long does implementation take? With an existing ISO 27001 or ISO 9001 system, four to eight months is realistic because many foundations are already in place. Without a management system, plan more time. Does docxpert also support the EU AI Act? Yes. A requirement catalogue and nine templates for the EU AI Act are built in, and the AI register records role and risk class per system. How should I decide which AI systems fall within the AIMS scope? Start with the organisational and subject boundaries of your management system, then identify AI systems developed, procured, integrated or used within them. Include features in standard software and externally operated services when they influence your organisation's decisions or processes. Describe purpose, users, data types, affected parties and dependencies before assessing risk. If a system sits outside the AIMS scope, document the reasoned boundary; that does not automatically remove its risks from other management systems. Reconcile the inventory with IT, procurement, business teams and privacy owners, and define an approval route for new uses. Review the scope when an intended use, provider or model changes materially so that governance continues to reflect actual use. ## Read next [AI registerRecord every AI system with role, risk class and requirements – the basis for the EU AI Act and ISO 42001.Learn more](https://docxpert.io/en/features/ai-register) [EU AI Act obligationsRoles, risk classes, AI literacy and the AI inventory – what companies should do now.Learn more](https://docxpert.io/en/guides/eu-ai-act-ai-inventory) [EU AI Act checklistCheck AI inventory, roles, risk classes, prohibited practices and AI literacy.Learn more](https://docxpert.io/en/checklists/eu-ai-act) [ISO 27001ISMS documentation, policies, Statement of Applicability and awareness training under control.Learn more](https://docxpert.io/en/standards/iso-27001) [Gap analysisCheck existing documents against standard requirements and work off gaps as tasks.Learn more](https://docxpert.io/en/features/gap-analysis) ## Try docxpert free for 14 days Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards. [Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)