ISO 42001 — AI Management System

How AuditTrue supports alignment with ISO/IEC 42001:2023 (AIMS).

About ISO 42001

ISO/IEC 42001:2023 is the first international standard providing a management system framework for AI. Published in December 2023, it specifies requirements for establishing, implementing, maintaining, and continually improving an AI Management System (AIMS) within an organization. The standard uses the High-Level Structure (HLS) shared across ISO management system standards, enabling seamless integration with ISO 9001 (quality), ISO 27001 (information security), and ISO 27701 (privacy).

High-Level Structure (HLS) and PDCA

ISO 42001 follows the same ten-clause HLS as other ISO management standards. The structure follows a Plan-Do-Check-Act (PDCA) cycle — Plan (clauses 4-6), Do (clauses 7-8), Check (clause 9), Act (clause 10). This shared architecture means organizations can integrate AI management into existing management systems without duplicating governance processes.

Clause-by-Clause Breakdown

Clause 4 — Context of the Organization

4.1 Understanding the organization and its context

Identify internal and external issues that affect the AIMS. This includes regulatory landscape, market pressures, technological capabilities, and ethical considerations. AuditTrue's discovery module inventories all AI assets and maps the organizational context that shapes your AI governance scope.

4.2 Understanding the needs and expectations of interested parties

Identify stakeholders — regulators, customers, employees, partners, civil society — and their expectations regarding AI. AuditTrue's stakeholder mapping tool documents interested parties, their requirements, and how they are addressed.

4.3 Determining the scope of the AIMS

Define boundaries — which AI systems, business units, and processes fall under the AIMS. AuditTrue's scope definition templates help document inclusions, exclusions, and justifications.

4.4 AI management system

Establish, implement, maintain, and continually improve the AIMS. AuditTrue provides the platform infrastructure for the entire AIMS lifecycle.

Clause 5 — Leadership

5.1 Leadership and commitment

Top management must demonstrate commitment to the AIMS, ensure AI policy alignment with strategy, and promote a culture of responsible AI. AuditTrue's leadership dashboards provide visibility into AIMS performance and compliance status.

5.2 Policy

Establish, implement, and communicate an AI policy. AuditTrue provides AI policy templates aligned with ISO 42001 requirements, including commitment to applicable requirements, continual improvement, and framework for setting objectives.

5.3 Roles, responsibilities, and authorities

Assign and communicate roles for AIMS operation. AuditTrue's RBAC system defines governance roles — AI Officer, Risk Manager, Compliance Lead, Auditor — with documented responsibilities and authority levels.

Clause 6 — Planning

6.1 Actions to address risks and opportunities

Identify AI-specific risks and opportunities, plan actions to address them. AuditTrue's risk assessment engine maps to ISO 42001 risk categories — bias, safety, transparency, accountability, robustness — and tracks mitigation through to closure.

6.2 AI objectives and planning to achieve them

Set measurable AI objectives at relevant functions and levels. AuditTrue's objective tracking module documents targets, timelines, responsible parties, and progress metrics.

6.3 Planning of changes

Plan and control changes to the AIMS. AuditTrue's change management workflows document change proposals, impact assessments, approval chains, and implementation records.

Clause 7 — Support

7.1 Resources

Determine and provide resources needed for the AIMS — people, infrastructure, data, tools. AuditTrue's resource tracking module documents allocated resources and identifies gaps.

7.2 Competence

Ensure persons are competent to perform AI-related tasks. AuditTrue tracks team qualifications, AI governance training records, and competency assessments.

7.3 Awareness

Ensure awareness of AI policy, objectives, and individual contributions. AuditTrue's awareness module tracks training completion and acknowledgment records.

7.4 Communication

Establish internal and external communication processes. AuditTrue provides communication templates for stakeholders, regulators, and the public.

7.5 Documented information

Maintain documented information required by the standard. AuditTrue's documentation center version-controls all AIMS documents with automated retention policies.

Clause 8 — Operation

8.1 Operational planning and control

Plan and control operational processes to meet AIMS requirements. AuditTrue's operational workflows enforce governance policies at execution time.

8.2 AI system impact assessment

Assess impacts of AI systems on individuals, groups, and society. AuditTrue's impact assessment engine provides structured templates with automated risk scoring.

8.3 AI system lifecycle

Manage AI systems throughout their lifecycle — design, development, deployment, operation, monitoring, decommissioning. AuditTrue's lifecycle module documents each stage with control gates and approval records.

8.4 Third-party AI system assessment

Assess AI systems provided by third parties. AuditTrue's vendor assessment pipeline runs automated safety, bias, and compliance scoring on external models.

Clause 9 — Performance Evaluation

9.1 Monitoring, measurement, analysis, and evaluation

Determine what to monitor and measure, and when. AuditTrue's real-time dashboards track compliance scores, model drift, bias metrics, and AIMS KPIs.

9.2 Internal audit

Conduct internal audits at planned intervals. AuditTrue's audit module schedules audits, tracks findings, and documents corrective actions.

9.3 Management review

Top management reviews AIMS performance. AuditTrue generates review-ready reports with KPIs, trends, audit results, and improvement recommendations.

Clause 10 — Improvement

10.1 Continual improvement

Continually improve the suitability, adequacy, and effectiveness of the AIMS. AuditTrue's improvement workflows drive continuous refinement through data-driven recommendations.

10.2 Nonconformity and corrective action

Identify nonconformities, determine causes, implement corrective actions. AuditTrue's non-conformity tracker logs issues, routes them through root cause analysis, and verifies closure.

Annex A Controls Overview

ISO 42001's Annex A provides AI-specific controls organized into nine categories:

• A.2 — Policies related to AI: AI usage policies, acceptable use guidelines, ethical principles, and policy alignment.
• A.3 — Internal organization: Governance structures, roles, responsibilities, and committee charters for AI management.
• A.4 — Resources for AI systems: Resource planning, data assets, computational infrastructure, and tooling.
• A.5 — Assessing impacts of AI systems: Impact assessment methodologies, stakeholder analysis, and risk evaluation.
• A.6 — AI system lifecycle: Controls across design, development, deployment, operation, monitoring, and decommissioning.
• A.7 — Data for AI systems: Data acquisition, quality, provenance, preparation, and governance controls.
• A.8 — Information for interested parties: Transparency obligations, documentation, and communication protocols.
• A.9 — Use of AI systems: Operational controls, responsible use guidelines, and human oversight.
• A.10 — Third-party relationships: Supplier assessment, vendor AI risk management, and contractual requirements.

Integration with ISO 27001 and ISO 9001

Organizations certified to ISO 27001 or ISO 9001 can integrate ISO 42001 efficiently:

• Shared HLS structure: Clauses 4-10 follow identical structure — context, leadership, planning, support, operation, evaluation, improvement can be unified.
• Combined risk management: ISO 27001 information security risks and ISO 42001 AI risks can be managed in a single framework via AuditTrue's risk engine.
• Unified controls register: Annex A controls from multiple standards can be cross-mapped and managed together.
• Integrated audit programs: Internal audits can cover multiple management systems, reducing assessment burden.
• Shared documentation: Policies, procedures, and records can be shared across management systems with AuditTrue's cross-referencing documentation center.

Certification Process

1. Gap analysis: Assess current AI governance against ISO 42001. AuditTrue's compliance mapping generates a gap report.
2. AIMS implementation: Build policies, procedures, roles, controls, and documentation. AuditTrue provides templates and workflows.
3. Internal audit: First-party audit to verify AIMS. AuditTrue's audit module schedules, tracks, and documents.
4. Management review: Top management reviews performance. AuditTrue generates review-ready reports.
5. Stage 1 certification audit: Certification body reviews documentation. AuditTrue exports complete AIMS packages.
6. Stage 2 certification audit: On-site or remote implementation assessment. AuditTrue provides evidence trails.
7. Certification decision: Certificate issued — valid 3 years with annual surveillance audits.
8. Surveillance & recertification: Annual audits verify ongoing compliance. AuditTrue maintains continuous readiness.

What We Do Not Do

• Act as an accredited certification body
• Conduct formal ISO audits or issue certificates
• Guarantee certification outcomes
• Provide legal advice
• Replace qualified ISO auditors or consultants

---

Last updated: July 10, 2026. Informational only — consult qualified professionals and accredited certification bodies.