ISO/IEC 42001:2023 Clauses 4–10 — Practical Implementation Guide

ISO/IEC 42001:2023 gives the requirements for an AI management system (AIMS) in Clauses 4 to 10. These clauses use "shall" for each requirement. To conform to the standard, an organization must obey all of these requirements (see ISO/IEC 42001). Annex A and Annex B are normative, and Annex C and Annex D are informative (see Annexes A to D). The Introduction of the standard gives this information: the sequence of the requirements does not show which requirement is more important. It also does not set the sequence in which the organization implements them.

Clauses 4 to 10 use the harmonized structure of ISO management system standards (also known as Annex SL). Each standard with this structure uses the same clause numbers, the same clause names, the same basic text, and the same basic terms and definitions. ISO/IEC 42001 puts its requirements for AI into these clauses. Of its sub-clauses, only 6.1.4 and 8.4 (AI system impact assessment) have no equivalent clause in ISO/IEC 27001:2022 (see Use with ISO/IEC 27001 and ISO/IEC 27701).

Primary source

ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, first edition (2023-12): Clauses 4 to 10, parts of Clause 3 (Terms and definitions), and Annex A control A.2.4. Source: ISO catalog page.

The organization, top management, and interested parties

ISO/IEC 42001 Clauses 4 to 10 give most requirements to the organization (3.1). If a large group includes the organization, "organization" refers only to the part in the AIMS scope (3.1, Note 2). Clause 3 and Clauses 4 to 10 also name these persons and groups:

• Top management — the person or group of persons who gives direction to the organization and controls it at the top level (3.3). Top management has the requirements of 5.1 to 5.3 and does the management review (9.3).
• Designated management — the organization must get approval from designated management for its AI risk treatment plan (6.1.3). The organization must also get approval from designated management to accept the residual AI risks.
• Internal auditors — the organization selects them to make sure that the audit process has objectivity and impartiality (9.2.2).
• Persons who do work that the organization controls — they must know the AI policy (7.3). If their work has an effect on AI performance, the organization must make sure that they have the necessary competence (7.2).
• Interested parties — persons or organizations with a relation to a decision or work of the organization (3.2). They can have an effect on it, it can have an effect on them, or they think that it has an effect on them. The organization must determine which interested parties are "relevant" to the AIMS (4.2).
• Governing body — Clauses 4 to 10 give no requirement to the governing body (3.22). Some organizations, for example small organizations, do not have a governing body that is different from top management (3.22, Note 1).

Documented information in Clauses 4 to 10

ISO/IEC 42001 Clause 7.5.1 requires the organization to include 2 types of documented information in its AIMS:

• The documented information that the standard requires.
• The documented information that the organization determines is necessary for the effectiveness of the AIMS.

The quantity of documented information can be different from one organization to a different organization (7.5.1, NOTE).

The clauses name the documented information in the table below. For some items, the clause requires the information to be available. For other items, the clause requires the organization to retain the information as a record. For 6.1.3 f), the clause requires the organization to make the statement of applicability, which is documentation in the definition of 3.26. For 4.4 and 6.1.4, the clause requires the organization to document the item.

Clause	Documented information	Type
4.3	The scope of the AIMS	Available
4.4	The AIMS, with the necessary processes and the relations between them	Documented
5.2	The AI policy	Available
6.1.1	Information about the actions on AI risks and AI opportunities	Retained
6.1.2	Information about the AI risk assessment process	Retained
6.1.3	The necessary controls	Available
6.1.3 f)	The statement of applicability (documentation in the definition of 3.26)	Documentation
6.1.3	Information about the AI risk treatment process	Retained
6.1.4	The result of each AI system impact assessment	Documented
6.2	The AI objectives	Available
7.2	Evidence of competence	Available
8.1	Information about the processes of 8.1, as much as is necessary to be sure that the processes occurred as "planned"	Available
8.2	The result of each AI risk assessment	Retained
8.3	The result of each AI risk treatment	Retained
8.4	The result of each AI system impact assessment	Retained
9.1	Evidence of the results of monitoring and measurement	Available
9.2.2	Evidence that the organization implements the audit program, and evidence of the audit results	Available
9.3.3	Evidence of the results of the management reviews	Available
10.2	Evidence of the type of each nonconformity, the actions after it, and the results of each corrective action	Available

Clauses 4 to 10 name no other documented information. The definition of the statement of applicability adds one item (3.26, Note 2): the organization must document all identified risks (see The statement of applicability). Some Annex A controls also name documentation, for example A.5.3 and A.6.2.7, if the organization selects them (see Annex A). The organization can keep other records as documented information that it determines is necessary (7.5.1 b)).

Clause 4 — Context of the organization

ISO/IEC 42001 Clause 4 requires the organization to determine its issues and its roles for its AI systems. The organization must also determine which interested parties are "relevant" to the AIMS, and their "relevant" requirements (4.2). It must determine the scope of the AIMS (4.3). It must establish, implement, maintain, continually improve, and document the AIMS (4.4).

4.1 Issues. The organization must determine each external and internal issue that is "relevant" to its purpose and that has an effect on how the AIMS can get its intended results. NOTE 2 to 4.1 gives examples. The issues can change with the roles and the jurisdiction of the organization. 2 examples are the applicable legal requirements and contractual obligations. The legal requirements include rules that prevent some uses of AI.

4.1 Climate change. The organization must determine if climate change is a "relevant" issue. This requirement is in the text of the first edition (2023). It does not come from a subsequent change to the standard. The NOTE to 4.2 tells organizations that "relevant" interested parties can have requirements about climate change.

4.1 Intended purpose and roles. The organization must consider the intended purpose of each AI system that it makes, supplies, or uses. It must also determine its roles for these AI systems, for example AI provider, AI producer, or AI customer (see AI roles (Clause 4.1)). NOTE 1 to 4.1 tells organizations that these roles can determine if a requirement or control of the standard applies, and how far it applies.

4.2 Interested parties. The organization must determine which interested parties are "relevant" to the AIMS, and the "relevant" requirements of these interested parties. It must also determine which of these requirements the AIMS will apply to. Clause 4.2 does not require a record of all interested parties.

4.3 Scope. The organization must determine the boundaries and applicability of the AIMS, which set its scope. The scope must be available as documented information (see The scope of the AIMS (Clause 4.3)).

4.4 AI management system. The organization must establish, implement, maintain, and continually improve an AIMS, and it must document the AIMS. The AIMS includes the processes that are necessary and the relations between these processes, as the standard requires. Clause 4.4 gives no rules for the relation with other management systems.

Clause 5 — Leadership

ISO/IEC 42001 Clause 5 gives its requirements to top management.

5.1 Leadership and commitment. Top management must show leadership and commitment for the AIMS with these tasks:

• Make sure that the AI policy (5.2) and the AI objectives (6.2) are established.
• Make sure that the AI policy and the AI objectives agree with the "strategic direction" of the organization.
• Make sure that the "business processes" of the organization include the AIMS requirements.
• Make sure that the AIMS has the necessary resources.
• Tell persons in the organization that "effective AI management" is important, and that conformity with the AIMS requirements is important.
• Make sure that the AIMS gets its intended results.
• Give direction and help to persons, to increase the effectiveness of the AIMS.
• Help the organization to continually improve the AIMS.
• Help other "relevant" roles to show leadership in their areas of responsibility.

5.2 AI policy. Top management must establish an AI policy. The AI policy must:

• Be "appropriate" to the purpose of the organization.
• Give a framework to set AI objectives.
• Include a commitment to conform to applicable requirements.
• Include a commitment to the continual improvement of the AIMS.

The AI policy must also be available as documented information, and it must refer to other organizational policies, as "relevant". The AI policy must be "communicated" in the organization. The AI policy must be available to interested parties, as "appropriate". Annex A (A.2) gives controls for the AI policy (see Annex A).

5.3 Roles, responsibilities and authorities. Clause 5.3 requires top management to make sure that each "relevant" role has its responsibilities and authorities. Top management must also make sure that these responsibilities and authorities are "communicated" in the organization. Top management must also give the responsibility and the authority for these 2 tasks:

• Make sure that the AIMS conforms to the requirements of ISO/IEC 42001.
• Report on the performance of the AIMS to top management.

Clause 6 — Planning

ISO/IEC 42001 Clause 6 gives the requirements for the planning of the AIMS. The planning includes the actions on risks and opportunities (6.1), the AI objectives (6.2), and changes to the AIMS (6.3). Clauses 6.1.2 to 6.1.4 give processes. Clauses 8.2 to 8.4 require the organization to use these processes (see Clause 8 below).

6.1.1 Risks and opportunities. For the planning of the AIMS, the organization must consider the issues of 4.1 and the requirements of 4.2. It must determine the risks and opportunities that it must work on, for these 3 results:

• To make sure that the AIMS can get its intended results.
• To prevent or decrease unwanted effects.
• To get continual improvement.

The organization must also:

• Establish and maintain AI risk criteria. With these criteria, the organization can find which risks it can accept and which risks it cannot accept. The criteria also help the organization to do AI risk assessments, to do AI risk treatment, and to assess AI risk impacts.
• Determine the risks and opportunities from 3 items: the "domain" and application context of the AI system, its intended use, and the 4.1 context.
• Include in its planning the actions on these risks and opportunities. Also include how to make the actions part of the AIMS processes, how to implement them, and how to evaluate their effectiveness.
• Retain documented information on the actions that it does on AI risks and AI opportunities.

NOTE 2 to 6.1.1 tells organizations that the AIMS scope can include more than one AI system. Then the organization determines opportunities and uses for each AI system or for groups of AI systems.

6.1.2 AI risk assessment. Clause 6.1.2 requires the organization to make an AI risk assessment process and to establish it. The process must:

• Agree with the AI policy and the AI objectives.
• Have a design that can give "consistent", "valid", and "comparable" results when the organization does the assessment again.
• Identify the risks that can help the organization to get its AI objectives, or prevent it.
• Analyze the AI risks. The process assesses the possible effects on the organization, on individuals, and on societies if the risks occur. Where applicable, it assesses the "realistic likelihood" of the risks. It determines the levels of risk.
• Evaluate the AI risks. The process compares the results of the analysis with the risk criteria of 6.1.1. Then it puts the risks in a sequence for risk treatment, with the most important risks first.

A NOTE to 6.1.2 tells organizations that they can use an AI system impact assessment (6.1.4) when they assess these effects. The organization must retain documented information on its AI risk assessment process. Clause 6.1.2 does not set when the organization does the assessment again. Clause 8.2 sets it.

6.1.3 AI risk treatment. With the results of the AI risk assessment, the organization must make an AI risk treatment process. The process must:

• a) Select the "appropriate" AI risk treatment options.
• b) Determine each control that is necessary for the selected risk treatment options. Compare these controls with the controls in Annex A, to make sure that no necessary control is missing.
• c) Consider the Annex A controls that are "relevant" to implement the selected risk treatment options.
• d) Identify if more controls than the controls in Annex A are necessary for the risk treatment options.
• e) Consider the Annex B guidance about how to implement the controls of b) and c) (see Annex B).
• f) Make a statement of applicability.
• g) Make an AI risk treatment plan.

Items c) and e) are obligations to consider. It is not necessary for the organization to use each Annex A control or each item of Annex B guidance. NOTE 2 to 6.1.3 tells organizations that Annex A does not contain all possible controls. The organization can design other controls or get them from other sources. The statement of applicability contains the necessary controls of b), c), and d), and the justification for each inclusion and each exclusion of controls (see The statement of applicability).

The organization must get approval for the AI risk treatment plan from designated management. It must also get approval from designated management to accept the residual AI risks. The necessary controls must agree with the AI objectives of 6.2. They must be available as documented information, and they must be "communicated" in the organization. They must be available to interested parties, as "appropriate". Also, the organization must retain documented information on its AI risk treatment process.

Annex A is a set of reference controls that the organization uses to compare its controls in 6.1.3. The organization must consider the result of each AI system impact assessment in the AI risk assessment (6.1.4). The AI risk treatment process uses the results of the AI risk assessment. The statement of applicability is one of the results of AI risk treatment.

6.1.4 AI system impact assessment. Clause 6.1.4 requires the organization to make a process that assesses the possible effects of AI systems on individuals, groups of individuals, and societies. These effects can come from the development, the supply, or the use of AI systems. Each AI system impact assessment must:

• Determine the possible effects of the deployment, the intended use, and the foreseeable misuse of the AI system on individuals, groups of individuals, and societies.
• Consider the "technical and societal context" of the deployment of the AI system, and the applicable jurisdictions.

The organization must document the result of each AI system impact assessment. Where "appropriate", the organization can make the result available to the "relevant" interested parties that it identifies. The organization must consider the results in the AI risk assessment (6.1.2). Annex A (A.5) gives controls to assess the impacts of AI systems. A NOTE to 6.1.4 tells organizations that, in some conditions, they can require AI system impact assessments for a specified area as part of their risk management. Examples of these areas are safety, privacy, and security.

ISO/IEC 42005:2025 gives guidance for AI system impact assessments (see Other standards for AI management systems). Article 27 of the EU AI Act is a different obligation for some deployers of high-risk AI systems (see ISO/IEC 42001, the EU AI Act, and NIS2).

6.2 AI objectives. The organization must establish AI objectives for the "relevant" functions and levels. The AI objectives must:

• Agree with the AI policy.
• Be "measurable (if practicable)".
• Consider the applicable requirements.
• Be monitored.
• Be "communicated".
• Be "updated as appropriate".
• Be available as documented information.

For the planning of how to get its AI objectives, the organization must determine these items:

• The work that it will do.
• The resources that are necessary.
• The person who has the responsibility.
• The date when it will complete the work.
• How it will evaluate the results.

The NOTE to 6.2 refers to Annex C for AI objectives that are related to risk management (see Annex C). It also refers to A.6.1 and A.9.3 of Annex A, which give control objectives and controls.

6.3 Planning of changes. Clause 6.3 applies when the organization determines that changes to the AIMS are necessary. The organization must then make the changes in a planned manner. Clause 6.3 does not set the conditions that start a new AI risk assessment or a new AI system impact assessment. Clause 8.2 sets them for the AI risk assessment. Clause 8.4 sets them for the AI system impact assessment.

Clause 7 — Support

ISO/IEC 42001 Clause 7 requires the organization to give the AIMS the necessary resources, persons with the necessary competence, communication, and documented information.

7.1 Resources. The organization must determine and supply the resources that are necessary to establish, implement, maintain, and continually improve the AIMS.

7.2 Competence. The organization must determine the necessary competence of the persons who do work that it controls, if their work has an effect on its AI performance. It must make sure that these persons have this competence from "appropriate" education, training, or experience. Where applicable, it must do actions to get the necessary competence. It must also evaluate the effectiveness of these actions. Documented information that is "appropriate" must be available as evidence of competence.

7.3 Awareness. Persons who do work that the organization controls must know the AI policy. They must also know how their work helps the effectiveness of the AIMS. This includes the good effects of an increase in AI performance. They must know the possible results if they do not conform to the AIMS requirements.

7.4 Communication. The organization must determine the internal and external communication that is "relevant" to the AIMS. It must determine which information it will give, when, to which persons, and how.

7.5.2 Creating and updating documented information. Clause 7.5.2 applies when the organization makes or changes documented information. The organization must make sure that the information has "appropriate" identification and description, format and media, and review and approval of its adequacy and suitability.

7.5.3 Control of documented information. The organization must control the documented information. The control must make sure that the information is available and "suitable" for use at the necessary location and time. The control must also make sure that the documented information has sufficient protection. As applicable, the control includes these items:

• Storage and preservation.
• Distribution, access, retrieval, and use.
• Control of changes.
• Retention and disposition.

The organization must also identify and control the documented information of external origin that is necessary for the planning and the operation of the AIMS.

Clause 7.5 does not set a period for the review of documented information. The section Documented information in Clauses 4 to 10 gives 7.5.1 and the documented information that each clause names.

Clause 8 — Operation

ISO/IEC 42001 Clause 8 requires the organization to operate the AIMS processes and to use the processes that Clause 6 gives.

8.1 Operational planning and control. Clause 8.1 requires the organization to "plan", implement, and control the necessary processes. These processes are necessary to conform to requirements and to do the actions of Clause 6. To do this, the organization must set criteria for the processes and control the processes against these criteria. The organization must also:

• Implement the 6.1.3 controls for the operation of the AIMS. An example is the controls for the life cycle of AI system development and use.
• Monitor the effectiveness of these controls, and consider corrective actions if the intended results do not occur.
• Make documented information available, as much as is necessary to be sure that the processes occurred as "planned".
• Control the changes that are part of its planning. For an "unintended" change, examine the effects and decrease bad effects, as necessary.
• Control the processes and the products or services that external providers supply, if they are "relevant" to the AIMS.

8.2 AI risk assessment. The organization must do AI risk assessments with the 6.1.2 process at planned intervals. It must also do an AI risk assessment when a significant change is "proposed" or when a significant change occurs. It must retain the results of each AI risk assessment as documented information.

8.3 AI risk treatment. The organization must implement the AI risk treatment plan of 6.1.3 and check the effectiveness of the AI risk treatment plan. When risk assessments identify new risks for which risk treatment is necessary, the organization must use the 6.1.3 process for these risks. If risk treatment options in the AI risk treatment plan are not "effective", the organization must examine these risk treatment options and "revalidate" them with the 6.1.3 process. It must then change the AI risk treatment plan. It must retain the results of each AI risk treatment as documented information.

8.4 AI system impact assessment. Clause 8.4 requires the organization to do AI system impact assessments with the 6.1.4 process at planned intervals. It must also do an AI system impact assessment when a significant change is "proposed". Clause 8.4 names only "proposed" changes, and Clause 8.2 also names changes that occur. The organization must retain the results of each AI system impact assessment as documented information.

Clause 9 — Performance evaluation

ISO/IEC 42001 Clause 9 requires the organization to monitor, audit, and review the AIMS.

9.1 Monitoring, measurement, analysis and evaluation. Clause 9.1 requires the organization to determine these items:

• The items that it must monitor and measure.
• How it monitors, measures, analyzes, and evaluates, as applicable, to get "valid" results.
• When it monitors and measures.
• When it analyzes and evaluates the results.

Documented information must be available as evidence of these results. The organization must also evaluate the performance and the effectiveness of its AIMS.

9.2.1 Internal audit. The organization must do internal audits at planned intervals. Each internal audit gives information on these 3 items:

• If the AIMS conforms to the requirements of the organization for its AIMS.
• If the AIMS conforms to the requirements of ISO/IEC 42001.
• If the organization implements and maintains the AIMS with effectiveness.

An internal audit can be a combined audit (3.18, Note 1).

9.2.2 Internal audit program. The organization must "plan", establish, implement, and maintain 1 or more audit programs. An audit program includes how frequently audits occur, the methods, the responsibilities, the planning requirements, and the reports. When it establishes an audit program, the organization must consider how important the processes are and the results of previous audits. It must also do these tasks:

• For each audit, set its objectives, its criteria, and its scope.
• Select auditors and do audits to make sure that the audit process has objectivity and impartiality.
• Make sure that the "relevant managers" receive the results of the audits.

Documented information must be available as evidence that the organization implements the audit program, and as evidence of the audit results. Clause 9.2 sets the internal audit of the organization. It does not set the audit of a certification body (see Scope and certification).

9.3 Management review. Top management must review the AIMS at planned intervals, to make sure that the AIMS continues to have suitability, adequacy, and effectiveness (9.3.1). The management review must include these inputs (9.3.2):

• The "status" of the actions from previous management reviews.
• Changes in the internal and external issues that are "relevant" to the AIMS.
• Changes in the needs and expectations of interested parties, if these are "relevant" to the AIMS.
• Information on the performance of the AIMS. This information includes "trends" in nonconformities and corrective actions, in monitoring and measurement results, and in audit results.
• Opportunities for continual improvement.

The results of the management review must include decisions on opportunities for continual improvement, and decisions on if changes to the AIMS are necessary (9.3.3). Documented information about these results must be available as evidence.

Clause 10 — Improvement

ISO/IEC 42001 Clause 10 requires the organization to improve the AIMS and to correct nonconformities.

10.1 Continual improvement. The organization must continually improve the AIMS, to increase its suitability, adequacy, and effectiveness.

10.2 Nonconformity and corrective action. Clause 10.2 applies when a nonconformity occurs. Then the organization must do these steps:

1. As applicable, control and correct the nonconformity, and do work on its effects.
2. Evaluate if it must do actions to remove the causes of the nonconformity. The purpose of these actions is that the nonconformity does not occur again, here or at a different location. For this evaluation, do these 3 steps:
   • Examine the nonconformity.
   • Find its causes.
   • Find if nonconformities of the same type occur or can occur.
3. Implement the necessary actions.
4. Examine the effectiveness of each corrective action.
5. If necessary, change the AIMS.

Each corrective action must be "appropriate" to the effects of the nonconformity that it corrects. Documented information must be available as evidence of the type of each nonconformity, the actions after it, and the results of each corrective action.

When to do the assessments, audits, and reviews again

ISO/IEC 42001 sets no period for its assessments, audits, and reviews. Where it uses "planned intervals", the organization sets the intervals. The standard gives these times:

Task	Clause	When
AI risk assessment	8.2	At planned intervals. Also when a significant change is "proposed" or occurs.
AI system impact assessment	8.4	At planned intervals. Also when a significant change is "proposed".
Internal audit	9.2.1	At planned intervals.
Management review	9.3.1	At planned intervals.
Review of the AI policy	Annex A, A.2.4	At planned intervals, and also when necessary. This applies if the organization selects the control in 6.1.3.
Changes to the AIMS	6.3	When the organization determines that changes to the AIMS are necessary.

The Requirements in Modulos

Modulos gives ISO/IEC 42001 as 2 Frameworks with the name ISO 42001: OFF-10 at the Organization level and MFF-10 at the AI System level. The page Operationalizing ISO/IEC 42001 in Modulos gives the Requirement for each clause, the level of each Requirement, and the steps that Modulos recommends.

Where to go next

ISO/IEC 42001 overview

The standard, the organizations that it applies to, certification, and the EU AI Act

Scope and certification

AI roles, the AIMS scope, the statement of applicability, and certification

Annexes A to D

Annex A controls, Annex B guidance, Annex C objectives and risk sources, and Annex D

Operationalizing in Modulos

OFF-10 and MFF-10, the Requirement for each clause, and the steps

ISO 42001 vs ISO 27001

The 2 standards compared, clause by clause

Sources of this page

• ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, first edition (2023-12): Introduction, Clause 3 (3.1, 3.2, 3.3, 3.18, 3.22, 3.24, 3.26), Clauses 4.1 to 10.2, and Annex A control A.2.4. ISO catalog page.
• ISO/IEC 27001:2022 — the table of contents and Clause 6.3, for the 2 sub-clauses with no equivalent clause.
• ISO/IEC 42005:2025 — Edition 1 (2025-05). ISO catalog page.
• EU AI Act — Regulation (EU) 2024/1689, Article 27(1), in the consolidated text of 2026-07-27.

Disclaimer

This page gives general information. It is not legal advice. Always compare this page with the text of ISO/IEC 42001:2023.