ISO 42001:2023

Determine the internal and external issues relevant to the organisation's purpose that affect the intended outcomes of the AI management system, including the organisation's role with respect to AI systems (provider, developer, user).

Determine the interested parties relevant to the AI management system and their relevant requirements, including those arising from the use and impacts of AI systems.

Define and document the boundaries and applicability of the AI management system, considering context, interested-party requirements, and the organisation's activities involving AI systems.

Establish, implement, maintain, and continually improve the AI management system, including the processes needed and their interactions, in line with the standard.

Top management must demonstrate leadership and commitment to the AI management system, ensuring policy and objectives, integrating requirements into business processes, providing resources, and promoting continual improvement.

Top management must establish an AI policy appropriate to the organisation that provides a framework for objectives, commits to meeting applicable requirements and to continual improvement, and is documented, communicated, and available.

Assign and communicate responsibilities and authorities for roles relevant to the AI management system, including ensuring conformity to the standard and reporting on performance to top management.

When planning the AI management system, consider context and interested-party requirements to determine the risks and opportunities to be addressed to assure intended outcomes, prevent undesired effects, and achieve continual improvement.

Define and apply an AI risk assessment process with documented criteria that identifies, analyses, and evaluates risks to the organisation and, where relevant, to individuals and society, producing consistent and comparable results.

Define an AI risk treatment process that selects appropriate treatment options and controls, compares them against the Annex A reference controls, produces a Statement of Applicability, and formulates a treatment plan approved by risk owners.

Establish a process to assess the potential consequences of AI systems for individuals, groups, and society throughout their life cycle, and integrate the results into risk treatment.

Establish measurable AI objectives consistent with the policy, and plan how to achieve them including what will be done, resources, responsibility, timing, and how results are evaluated; keep documented information.

When the organisation determines a need to change the AI management system, carry out those changes in a planned manner.

Determine and provide the resources needed to establish, implement, maintain, and continually improve the AI management system.

Determine the competence needed for people whose work affects AI management performance, ensure it through education, training, or experience, take action where gaps exist, and retain evidence.

Ensure people doing work under the organisation's control are aware of the AI policy, their contribution to the system's effectiveness, and the implications of not conforming.

Determine the internal and external communications relevant to the AI management system: what, when, with whom, and how to communicate.

The AI management system must include the documented information required by the standard plus whatever the organisation determines is necessary for its effectiveness.

When creating or updating documented information, ensure appropriate identification and description, format and media, and review and approval for suitability and adequacy.

Control documented information so it is available and suitable where needed and adequately protected, addressing distribution, access, storage, version control, retention, disposal, and documents of external origin.

Plan, implement, and control the processes needed to meet requirements and treat AI risks, keep documented information to give confidence processes ran as planned, and control planned and unintended changes, including outsourced processes.

Perform AI risk assessments at planned intervals and when significant changes occur, using the defined criteria, and retain the results as documented information.

Implement the AI risk treatment plan and retain documented information on the results of the treatment.

Perform AI system impact assessments at planned intervals and when significant changes occur, and retain the results as documented information.

Determine what needs monitoring and measuring, the methods, and when, to evaluate the AI management system's performance and effectiveness, and retain the evidence of results.

Conduct internal audits at planned intervals to confirm the AI management system conforms to the organisation's own requirements and the standard and is effectively implemented and maintained.

Plan, establish, and maintain an audit programme, defining criteria and scope, selecting objective auditors, and reporting results to relevant management; retain documented evidence.

Top management must review the AI management system at planned intervals to ensure its continuing suitability, adequacy, and effectiveness.

The management review must consider inputs such as status of prior actions, changes in context, performance and audit results, feedback, risk assessment outcomes, and opportunities for improvement.

The results of the management review must include decisions on continual improvement and any changes needed to the AI management system, and be retained as documented information.

Continually improve the suitability, adequacy, and effectiveness of the AI management system.

React to nonconformities, correct them, evaluate whether corrective action is needed to prevent recurrence, implement and review that action, and retain evidence of the nonconformity and the response.

Document an AI policy that is approved by management, sets the organisation's approach to developing or using AI systems, and is aligned with business objectives and applicable obligations.

Determine where AI touches other organisational policies (such as security, privacy, safety, and quality) and ensure the AI policy is consistent with them.

Review the AI policy at planned intervals or when significant changes occur, so it stays suitable and effective.

Define and allocate roles and responsibilities for AI across the organisation, covering the AI life cycle and associated risks and impacts.

Provide a mechanism for people to report concerns about the organisation's AI systems in a defined and safe manner.

Identify and document the resources required for the AI system life-cycle activities so they can be planned and provided.

Document and manage the data resources used for AI systems, including their characteristics relevant to intended use.

Document and manage the tooling resources used across the AI system life cycle.

Document and manage the system and computing resources used to develop, deploy, and operate AI systems.

Document and manage the human resources and the competencies needed for the AI system life cycle.

Establish a process to assess the potential impacts of AI systems on individuals, groups, and society, and define when it is performed.

Document the results of AI system impact assessments and retain them for the relevant period.

Assess and document the potential impacts of AI systems on individuals or groups of individuals throughout the life cycle.

Assess and document the potential wider societal impacts of AI systems throughout the life cycle.

Identify and document objectives to guide the responsible development of AI systems.

Define and document the processes for responsible design and development of AI systems.

Specify and document the requirements for new or substantially changed AI systems.

Document the AI system design and development so the approach and decisions are traceable.

Define and document verification and validation measures for AI systems and the criteria for using them.

Document a deployment plan and ensure requirements are met before an AI system is deployed.

Define and document what is necessary for the ongoing operation and monitoring of AI systems.

Produce and maintain technical documentation of AI systems for relevant interested parties.

Determine and document what event logging AI systems produce during their operation.

Define and document requirements for the data used to develop and enhance AI systems.

Determine and document the provenance and method of acquisition of data used in AI systems.

Define and document requirements for data quality and ensure data meets them for the intended use.

Define and document a process to record and maintain the provenance of data used in AI systems.

Define and document the criteria and methods used to prepare data for AI systems.

Provide users of the AI system with the documentation and information they need to use it appropriately.

Provide the ability for affected parties to receive information and report adverse impacts of the AI system.

Define and document a process to communicate AI system incidents to relevant users and interested parties.

Determine and provide the information that interested parties need about the AI system and its obligations.

Define and document the processes for responsible use of AI systems.

Identify and document objectives to guide the responsible use of AI systems.

Ensure the AI system is used in accordance with its intended use and accompanying documentation.

Allocate responsibilities within the AI value chain between the organisation, its suppliers, partners, and customers.

Ensure suppliers used in the AI life cycle apply appropriate controls aligned with the organisation's approach to responsible AI.

Provide customers with the information and capabilities they need to meet their responsibilities for the AI system.