ISO 42001:2023

Requirements and controls

• Clauses Management system clauses

  • 4 Organizational context

    • 4.1 Organizational context for AI

      Identify the internal and external issues that affect the AI management system, including the roles the organization plays for its AI systems and what those systems are meant to do.

      • AI Management System Scope & Roles
      • Data Governance

    • 4.2 Interested parties and their needs

      Identify the stakeholders relevant to the AI management system and which of their requirements it will address.

      • AI Management System Scope & Roles
      • Data Governance
      • Contractual Obligations Register

    • 4.3 Scope of the AIMS

      Decide and document the boundaries and applicability of the AI management system.

      • AI Management System Scope & Roles

    • 4.4 Running the AIMS

      Establish, operate, maintain and keep improving the AI management system and its processes.

      • AI Management System Scope & Roles
      • AI Policy

  • 5 Leadership and direction

    • 5.1 Leadership commitment

      Top management directs and supports the AI management system, aligns it with business strategy and provides the resources it needs.

      • Security & Privacy Program Review
      • AI Policy

    • 5.2 Setting the AI policy

      Top management sets an AI policy suited to the organization's purpose that frames its AI objectives and commits to meeting requirements and improving.

      • AI Policy
      • Information Security & Privacy Policies

    • 5.3 AI roles and authorities

      Responsibilities and authorities for the AI management system are assigned and communicated.

      • AI Management System Scope & Roles
      • Assigned Security & Privacy Responsibilities

  • 6 Planning the management system

    • 6.1.1 Planning for risks and opportunities

      Plan actions for AI-related risks and opportunities, and set criteria for telling acceptable risks from unacceptable ones.

      • Risk Framing
      • Risk Assessment Policy & Procedure

    • 6.1.2 AI risk assessment method

      Define a repeatable method to identify, analyze and evaluate risks that could stop the organization meeting its AI objectives.

      • Risk Assessment
      • Risk Framing

    • 6.1.3 AI risk treatment and applicability

      Choose treatment options and controls, compare them against Annex A, and justify inclusions and exclusions in a statement of applicability.

      • Risk Assessment
      • Management Review of Risks

    • 6.1.4 AI system impact assessment process

      Define a process for assessing the potential consequences that developing, providing or using AI systems can have for individuals, groups and society.

      • AI System Impact Assessment

    • 6.2 AI objectives

      Set measurable AI objectives at relevant functions and levels and plan how to achieve them.

      • AI Policy
      • Security & Privacy Program Review

    • 6.3 Planning changes to the AIMS

      Make changes to the AI management system in a planned way.

      • Security & Privacy Program Review
      • AI Management System Scope & Roles

  • 7 Resources and support

    • 7.1 Providing resources

      Provide the people, budget and tools the AI management system needs.

      • Security & Privacy Program Review
      • AI System Inventory & Resources

    • 7.2 Competent personnel

      Make sure people whose work affects AI performance are competent, and keep evidence of it.

      • Competency Screening
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training
      • Performance Review

    • 7.3 Staff awareness

      Make staff aware of the AI policy, their contribution to the AIMS and the consequences of not following it.

      • Periodic Policy Acknowledgement
      • Periodic Security & Privacy Training
      • AI Policy

    • 7.4 Internal and external communication

      Decide what to communicate about the AIMS, when, to whom and how.

      • Publishing Security & Privacy Documentation
      • AI Transparency & User Information

    • 7.5.1 Required documentation

      Keep the documents and records the AIMS requires and any others the organization judges necessary.

      • Information Security & Privacy Policies
      • AI Management System Scope & Roles

    • 7.5.2 Creating and updating documents

      Give each AIMS document clear identification and a suitable format, and review and approve it before use.

      • Information Security & Privacy Policies
      • Management Review of Policies

    • 7.5.3 Controlling documents

      Protect, distribute, retain and dispose of AIMS documents in a controlled way.

      • Information Security & Privacy Policies
      • Policy Documentation Retention

  • 8 Operating the management system

    • 8.1 Planning and controlling operations

      Plan, run and control the processes needed for the AIMS, including the controls chosen during risk treatment.

      • Responsible AI Development & Validation
      • AI Management System Scope & Roles

    • 8.2 Carrying out AI risk assessments

      Perform AI risk assessments at planned intervals and when significant changes are proposed, and keep the results.

      • Risk Assessment
      • Risk Framing

    • 8.3 Carrying out AI risk treatment

      Implement the AI risk treatment plan, verify that it works and keep records.

      • Risk Assessment
      • Management Review of Risks

    • 8.4 Carrying out AI system impact assessments

      Perform AI system impact assessments at planned intervals and when significant changes are proposed, and keep the results.

      • AI System Impact Assessment

  • 9 Evaluating performance

    • 9.1 Monitoring and measurement

      Decide what to monitor and measure about the AIMS and its AI systems, how and when, and evaluate the results.

      • Internal Audit
      • Security & Privacy Program Review
      • AI System Monitoring & Event Logs

    • 9.2.1 Internal audits

      Audit the AIMS at planned intervals to confirm that it meets requirements and works effectively.

      • Internal Audit

    • 9.2.2 Internal audit programme

      Plan and run an audit programme with defined criteria, scope and frequency, objective auditors and reporting to management.

      • Internal Audit

    • 9.3.1 Management reviews

      Top management reviews the AIMS at planned intervals to confirm it remains suitable, adequate and effective.

      • Security & Privacy Program Review

    • 9.3.2 Management review inputs

      The review considers earlier actions, changes in context, AIMS performance, feedback from interested parties, risks and improvement opportunities.

      • Security & Privacy Program Review
      • Management Review of Risks

    • 9.3.3 Management review results

      The review produces recorded decisions on improvements and any changes needed to the AIMS.

      • Security & Privacy Program Review

  • 10 Improving the management system

    • 10.1 Ongoing improvement

      Keep improving how suitable, adequate and effective the AIMS is.

      • Security & Privacy Program Review
      • Internal Audit

    • 10.2 Correcting nonconformities

      Respond to nonconformities, remove their causes and confirm that corrective actions worked.

      • Internal Audit
      • Security & Privacy Program Review
      • Incident Tracking

• Annex A Reference controls

  • A.2 Policies for AI

    • A.2.2 AI policy document

      Document a policy that governs how the organization develops or uses AI systems.

      • AI Policy
      • Information Security & Privacy Policies

    • A.2.3 Alignment with other policies

      Determine where existing policies, such as security, privacy or quality policies, are affected by or apply to the organization's AI objectives.

      • AI Policy
      • Information Security & Privacy Policies
      • Management Review of Policies

    • A.2.4 Reviewing the AI policy

      Review the AI policy at planned intervals, and when circumstances change, so it stays suitable and effective.

      • AI Policy
      • Management Review of Policies

  • A.3 Organizing for AI

    • A.3.2 Defining AI roles

      Define and allocate the roles and responsibilities the organization needs for AI.

      • AI Management System Scope & Roles
      • Roles & Responsibilities
      • Assigned Security & Privacy Responsibilities

    • A.3.3 Raising concerns about AI

      Give people a way to report concerns about the organization's role with respect to an AI system at any point in its life cycle.

      • Automated Incident Reporting
      • Incident Reporting Assistance
      • Code of Business Conduct

  • A.4 AI system resources

    • A.4.2 Documenting resources

      Identify and document the resources each AI system needs across its life cycle.

      • AI System Inventory & Resources

    • A.4.3 Documenting data resources

      Document information about the data that AI systems use.

      • AI System Inventory & Resources
      • AI Data Management

    • A.4.4 Documenting tools

      Document the tools, frameworks and libraries used to build and run AI systems.

      • AI System Inventory & Resources

    • A.4.5 Computing resources

      Document the system and computing resources that AI systems rely on.

      • AI System Inventory & Resources
      • Capacity & Performance Management
      • Inventory of Infrastructure Assets

    • A.4.6 People and skills

      Document the people and competences needed to develop, deploy, operate and oversee AI systems.

      • AI System Inventory & Resources
      • Competency Screening
      • Roles & Responsibilities

  • A.5 AI impact assessment

    • A.5.2 Impact assessment process

      Run a defined process to assess the potential consequences of AI systems for individuals, groups and society across their life cycle.

      • AI System Impact Assessment

    • A.5.3 Recording impact assessments

      Document the results of AI system impact assessments and keep them for a defined period.

      • AI System Impact Assessment

    • A.5.4 Impacts on individuals and groups

      Assess and document how an AI system could affect individuals or groups of individuals throughout its life cycle.

      • AI System Impact Assessment
      • Data Protection Impact Assessments

    • A.5.5 Societal impacts

      Assess and document how an AI system could affect society more broadly.

      • AI System Impact Assessment

  • A.6 Life cycle of AI systems

    • A.6.1 Direction for AI development

      • A.6.1.2 Responsible development objectives

        Identify and document the objectives that guide responsible AI development and build them into the life cycle.

        • Responsible AI Development & Validation
        • AI Policy

      • A.6.1.3 Responsible design and development processes

        Define and document the processes used to design and develop AI systems responsibly.

        • Responsible AI Development & Validation
        • Change Management Policy & Procedure

    • A.6.2 Life cycle stages

      • A.6.2.2 Requirements and specification

        Specify and document requirements for new AI systems and for significant changes to existing ones.

        • Responsible AI Development & Validation

      • A.6.2.3 Design and development records

        Document the design and development of each AI system against its objectives and requirements.

        • Responsible AI Development & Validation
        • AI Transparency & User Information

      • A.6.2.4 Verifying and validating AI systems

        Define and document how AI systems are verified and validated, and the criteria they must meet.

        • Responsible AI Development & Validation
        • Regression Testing

      • A.6.2.5 Releasing AI systems

        Document a deployment plan and confirm the requirements are met before an AI system goes live.

        • Responsible AI Development & Validation
        • Approval of Changes
        • Deployment Notifications

      • A.6.2.6 Operation and monitoring

        Define what is needed to operate and monitor an AI system in use, including repairs, updates and support.

        • AI System Monitoring & Event Logs
        • Capacity & Performance Management

      • A.6.2.7 Technical documentation for stakeholders

        Decide what technical documentation each group of interested parties needs and provide it.

        • AI Transparency & User Information

      • A.6.2.8 Recording AI system events

        Decide at which life cycle stages event logs are kept, and record them at least while the AI system is in use.

        • AI System Monitoring & Event Logs
        • Centralized Security Logging

  • A.7 Managing AI data

    • A.7.2 Data management processes

      Define and apply data management processes for developing and improving AI systems.

      • AI Data Management

    • A.7.3 Acquiring data

      Determine and document how data for AI systems is selected and obtained.

      • AI Data Management
      • Data Protection Policy & Procedure

    • A.7.4 Data quality requirements

      Define data quality requirements and check that the data used to develop and run AI systems meets them.

      • AI Data Management

    • A.7.5 Tracing data origin

      Record where the data used in AI systems comes from, across the data and system life cycles.

      • AI Data Management

    • A.7.6 Preparing data

      Define and document the criteria and methods used to prepare data.

      • AI Data Management

  • A.8 Informing interested parties

    • A.8.2 Information for users

      Give users the information they need to understand and use the AI system appropriately.

      • AI Transparency & User Information

    • A.8.3 Reporting adverse impacts

      Give interested parties a way to report adverse impacts of an AI system.

      • AI Transparency & User Information
      • Incident Reporting Assistance

    • A.8.4 Communicating incidents

      Plan how incidents involving AI systems are communicated to users and other affected parties.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Breach Risk Assessment & Notification

    • A.8.5 Reporting obligations

      Identify and meet the organization's obligations to report information about its AI systems to interested parties.

      • AI Transparency & User Information
      • Publishing Security & Privacy Documentation

  • A.9 Using AI systems

    • A.9.2 Responsible use processes

      Define and document processes for using AI systems responsibly.

      • Responsible Use of AI Systems

    • A.9.3 Responsible use objectives

      Identify and document the objectives that guide responsible use of AI systems.

      • Responsible Use of AI Systems
      • AI Policy

    • A.9.4 Staying within intended use

      Use AI systems according to their intended purpose and the documentation that comes with them.

      • Responsible Use of AI Systems
      • AI Transparency & User Information

  • A.10 Suppliers, partners and customers

    • A.10.2 Dividing life cycle responsibilities

      Allocate responsibilities across the AI system life cycle between the organization, its partners, suppliers, customers and other third parties.

      • AI Supplier & Customer Responsibilities
      • Shared Responsibility Model

    • A.10.3 AI suppliers

      Make sure services, products and materials from suppliers fit the organization's approach to responsible AI.

      • AI Supplier & Customer Responsibilities
      • Third-Party Criticality Assessments
      • Vendor Management Policy & Procedure

    • A.10.4 Customer expectations

      Take customers' expectations and needs into account in the organization's approach to responsible AI.

      • AI Supplier & Customer Responsibilities
      • Contractual Obligations Register