Artificial intelligence is already embedded in everyday business decisions: drafting documents, screening applications, answering customers and analysing sensitive information. The question for many organisations is no longer whether they use AI, but whether they can explain how they govern it. ISO/IEC 42001:2023 provides a framework for establishing, operating and continually improving an artificial intelligence management system (AIMS). It applies to organisations that develop, provide or use AI, including those that rely heavily on third-party tools. AI management systems
Implementation is a management project, not merely a technical exercise. It needs executive ownership, input from people who use the systems, and evidence that stated controls work in practice. The following steps offer a workable starting point.
1. Define the scope and take stock
Start by deciding which business units, products, activities and AI systems the AIMS will cover. A narrow scope can be sensible initially, provided its boundaries and dependencies are clear. For example, a professional services firm might begin with client-facing generative AI tools and automated document processing, then expand to internal recruitment and marketing uses.
Build an inventory for each system: its purpose, owner, supplier, data inputs, outputs, users, affected people and degree of human oversight. Record whether the organisation develops the model, configures a third-party product or simply uses an external service. Include experiments and informal use where possible. Otherwise, a polished register may omit the tools creating the greatest uncertainty.
Map applicable legal, contractual and professional obligations alongside this inventory. Privacy, confidentiality, discrimination, intellectual property, consumer protection and sector-specific rules may all matter. ISO/IEC 42001 provides a management framework; implementing it does not itself establish compliance with every law.
2. Give people clear authority
Senior management should approve an AI policy, set measurable objectives and allocate resources. A group with legal, privacy, security, procurement, human resources, operations and technical expertise can coordinate the work. Each AI system also needs a named owner with authority to raise problems and pause or change its use.
Decisions should follow the real workflow. Who can approve a new use case? Who checks a supplier’s claims? Who investigates an inaccurate or harmful output? Who decides when a human must review a result before it affects a person? Answering these questions in advance turns a general commitment to responsible AI into an operating process.
Training must fit each role. A person using a chatbot needs practical guidance on confidential information, verification and escalation. A procurement officer needs criteria for assessing vendor documentation and contract terms. Developers and technical reviewers need methods for testing, monitoring and recording changes.
3. Assess risks and impacts
Use a consistent method to assess each system before deployment and when it changes materially. Consider errors, security failures, privacy breaches, bias, overreliance, misuse and loss of human control. Evaluate the setting as well as the technology: the same model may pose modest risk when drafting an internal summary and serious risk when recommending whether someone receives a service.
AI system impact assessment deserves distinct attention. Ask who may be affected, what interests are at stake, whether a person can challenge an outcome and what could happen if the system is wrong. Consult relevant operational staff and, where appropriate, representatives of affected groups. ISO/IEC 42005:2025 offers additional guidance on assessing effects on individuals, groups and society throughout an AI system’s life cycle. AI system impact assessment
Document the assessment, the decision to accept or treat each risk, the responsible person and the date for review. An impact assessment is useful only if its findings can change the design, limits or approval of a system.
4. Select controls and make them usable
ISO/IEC 42001 includes an annex of AI controls that organisations consider when planning risk treatment. The selected controls should match the scope and risks; document why controls apply and how they operate. Common measures include approval gates, access restrictions, data-quality checks, technical testing, human review, supplier due diligence, incident reporting and change management.
Make each control specific. “Human oversight” might mean that a qualified employee checks source material and signs off on a proposed decision before it reaches a customer. “Testing” might require documented evaluation on representative cases, including edge cases, before release. For a purchased system, require enough information from the vendor to understand its intended use, limitations, security arrangements and update process.
Keep an evidence trail: policies, assessment records, approvals, test results, training logs, supplier reviews and incidents. Reuse existing privacy, information security and quality processes where they fit, while adding the AI-specific checks those processes lack.
5. Monitor, audit and improve
Deployment is the beginning of operational oversight. Define measures that reflect the system’s purpose and risks: error rates, complaint trends, inappropriate outputs, human overrides, drift, incidents or time taken to resolve issues. Set triggers for reassessment when a model, data source, supplier, use case or law changes.
Schedule internal audits to check whether the AIMS is followed in real work. Management should review performance, resources, incidents, audit findings and opportunities for improvement. Corrective actions need an owner and a completion check. This cycle of planning, operation, evaluation and improvement is central to ISO’s description of the standard. committee.iso.org
External certification may be useful where customers or procurement processes seek independent assurance. ISO/IEC 42006:2025 sets additional requirements for bodies auditing and certifying AI management systems. Certification assesses a defined management-system scope; it should not be described as a guarantee that every AI output is accurate or lawful. iso.org
Start with one real system
A practical first project is to choose a significant AI use case and run it through the full cycle: inventory, ownership, risk and impact assessment, controls, approval, monitoring and review. That exercise will reveal where existing governance works and where responsibilities or evidence are missing. Expand from that foundation, prioritising uses with the greatest effect on people and the business.
Implemented well, ISO/IEC 42001 gives an organisation a repeatable way to make decisions about AI as its tools and risks change. The lasting result is the ability to show what is being used, why it is appropriate, who is accountable and how problems are found and fixed.
Leave a Reply