Appearance
Operationalizing ISO/IEC 42001:2023 in Modulos — AIMS Playbook
Modulos has two Frameworks for ISO/IEC 42001:2023, and each has the name ISO 42001:
OFF-10at the Organization level, for the AI management system (AIMS) of the organization.MFF-10at the AI System level, for each AI system in the scope of the AIMS.
This page tells you how to use OFF-10 and MFF-10: the AI System structure, the steps, the Requirements, and the items with no Control. The Controls of each Requirement, their Guidance, and the examples of Evidence are in Modulos. On this page, "you" is the organization that operates the AIMS. "AI System" is the object in Modulos. "AI system" is an AI system that the organization makes, supplies, or uses, as in Clause 4.1.
Primary source
This page uses ISO/IEC 42001:2023 (first edition 2023-12) and the Modulos Frameworks OFF-10 and MFF-10. ISO catalog page.
Recommended AI System structure
For ISO/IEC 42001, Modulos uses two levels of AI System. The standard sets one AIMS for the organization, in the scope that the organization determines (Clause 4.3). The two levels, Organization and AI System, are the Modulos structure, not a structure of the standard. For the scope, see The scope of the AIMS.
| AI System | Framework | Clauses and Annex A controls in the Framework |
|---|---|---|
| The organization AI System | OFF-10 | Clauses 4.1 to 10.2 without 8.2 to 8.4 (with the processes of 6.1.2 to 6.1.4). Some Annex A controls. |
| One AI System for each AI system in the scope of the AIMS | MFF-10 | Clauses 8.2 to 8.4. All the other Annex A controls. |
The table in The Requirements gives the Requirement and the level of each clause and each Annex A control.
- Use
MFF-10for the work on each AI system. If you use onlyOFF-10, Clauses 8.2 to 8.4 have no Requirement for an AI System, and most Annex A controls have no Requirement. Clauses 8.2 to 8.4 are the AI risk assessment, the AI risk treatment, and the AI system impact assessment. - The scope gives the AI Systems. Modulos recommends one AI System with
MFF-10for each AI system in the scope of the AIMS. The AIMS scope can include more than one AI system (NOTE 2 to 6.1.1). Then, in the NOTE, the organization determines opportunities and uses for each AI system or for groups of AI systems. - Other management system standards. ISO/IEC 27001 has the Framework
OFF-9at the Organization level (ISO 27001). ISO/IEC 27701 has the FrameworkOFF-12at the Organization level (ISO 27701). A process can be part of the AIMS and also part of an information security management system (ISMS) or privacy information management system (PIMS). Such a process must also conform to ISO/IEC 42001. See Use with ISO/IEC 27001 and ISO/IEC 27701.
Organization AI Systems
Frameworks at the Organization level, for example OFF-10, attach to the organization AI System that your organization has. You cannot make a new organization AI System. If your organization does not have one, contact Modulos support before you add the Framework.
Set up: a sequence that works
Modulos recommends this sequence for an organization that operates its AIMS in Modulos. The sequence of the requirements in ISO/IEC 42001 does not show which requirement is more important or which to implement first (Introduction). But some requirements use the results of other requirements. For example, Clause 4.3 uses the results of Clauses 4.1 and 4.2. Each step refers to the page for the standard. In these steps, "you" is the organization.
- Determine your context and AI roles (Clause 4.1,
ORF-162). Determine which external and internal issues are "relevant" to your purpose. Clause 4.1 includes only the issues that have an effect on how your AIMS can get its intended results. Also determine if climate change is one of these issues. Consider the intended purpose of each AI system. For each AI system, determine the roles of your organization, for example AI provider, AI producer, or AI customer. The roles can determine if a requirement or a control applies, and how much of it applies. See AI roles and AI roles in the Requirements. - Determine the scope of the AIMS (Clauses 4.2 and 4.3,
ORF-163,ORF-164). First determine which interested parties are "relevant" to the AIMS, and their "relevant" requirements (Clause 4.2). Then determine which of these requirements the AIMS will apply to. Then determine the boundaries and applicability of the AIMS. When you do this, consider the external and internal issues from Clause 4.1 and the requirements from Clause 4.2. Keep the scope available as documented information. Then find the AI systems that are in the scope. See The scope of the AIMS. - Add
OFF-10to your organization AI System. If you do not have one, contact Modulos support. - For each AI system in the scope, find its AI System in the AI Registry. If the AI Registry has no AI System for it, make one. Add
MFF-10to each of these AI Systems. - Make the items at the Organization level in
OFF-10, for example:- the AI policy, which top management makes (5.2,
ORF-167) - the AI risk criteria (6.1.1,
ORF-169) - the processes for AI risk assessment, AI risk treatment, and AI system impact assessment (6.1.2 to 6.1.4,
ORF-170toORF-172) - the AI objectives (6.2,
ORF-173) - the other items of Clauses 4 to 7, for example roles and responsibilities (5.3), resources (7.1), competence (7.2), and documented information (7.5).
- the AI policy, which top management makes (5.2,
- Do the assessments for each AI System in
MFF-10. Do the AI system impact assessment (8.4,MRF-215) and the AI risk assessment (8.2,MRF-213). Consider the results of the impact assessment in the risk assessment (6.1.4). Some risks to the AI objectives are not related to only one AI system. Also do the AI risk assessment for these risks at the Organization level (ORF-170). See Clause 8 — Operation. - Do the AI risk treatment (6.1.3,
ORF-171). Use the results of the AI risk assessment in the AI risk treatment process of Clause 6.1.3. The results of this process are the statement of applicability and the AI risk treatment plan. Get approval for the AI risk treatment plan from designated management (6.1.3). Also get approval from designated management to accept the residual AI risks. See The statement of applicability and Clause 6 — Planning. - Implement the AI risk treatment plan and check its effectiveness (8.3,
MRF-214). Some AI risk treatments are not related to only one AI system. Do this step for these AI risk treatments at the Organization level (ORF-171). Each Annex A control applies only where your AI risk treatment selects it. See Clause 8 — Operation and Annex A. - Operate, monitor, audit, review, and improve the AIMS (
ORF-182toORF-190). These Requirements are for operational planning and control (8.1), monitoring (9.1), internal audit (9.2), management review (9.3), and improvement (10.1 and 10.2). See Clause 9 — Performance evaluation. - Do the assessments again when they are necessary. Clauses 8.2, 8.4, 9.2.1, and 9.3.1 give the times for the assessments, internal audits, and management reviews. See When to do the assessments, audits, and reviews again.
- Optional: get certification. Select a certification body with an accreditation that includes ISO/IEC 42001. The certification body audits the AIMS.
OFF-10andMFF-10have no Requirement for certification. See Certification bodies and accreditation.
For the Review of a Requirement in Modulos, see Reviews & Statuses.
AI roles in the Requirements
In Modulos, each Requirement of OFF-10 and MFF-10 has one or more "AI Role" tags. Each tag gives a role of Clause 4.1 to which the Requirement applies. The tag values are "AI Provider", "AI Producer", "AI Customer", "AI Partner", "AI Subject", and "Relevant Authority". These are the six roles that NOTE 1 to Clause 4.1 gives as examples. Your organization determines its roles for the AI systems that it makes, supplies, or uses (Clause 4.1, step 1).
The Requirements in the table below do not have all six roles. All other Requirements of OFF-10 and MFF-10 have all six roles.
| Requirement | Roles that the Requirement does not have |
|---|---|
ORF-195 Management guidance for AI system development | "AI Customer", "AI Subject", "Relevant Authority" |
MRF-216 AI system life cycle | "AI Subject", "Relevant Authority" |
MRF-217 Data for AI systems | "AI Subject", "Relevant Authority" |
MRF-218 Information for interested parties of AI systems | "AI Subject", "Relevant Authority" |
MRF-219 Use of AI systems | "AI Subject", "Relevant Authority" |
MRF-220 Third-party and customer relationships | "AI Subject", "Relevant Authority" |
If your roles make an Annex A control not necessary, give the justification for its exclusion in the statement of applicability (6.1.3 f), and NOTE 3 to 6.1.3).
Modulos added these tags for use in a subsequent release. That release can remove Requirements and Controls from the scope of an organization or AI System without the role.
The Requirements
OFF-10 and MFF-10 give Requirements for Clauses 4 to 10 and for the Annex A controls of ISO/IEC 42001. Below, each Requirement has its name in Modulos, its level, its provisions, and the page for the standard.
| Requirement | Level | Provisions of ISO/IEC 42001 | Page for the standard |
|---|---|---|---|
ORF-162 Understanding the organization and its context | Organization | 4.1 | Clause 4, AI roles |
ORF-163 Understanding the needs and expectations of interested parties | Organization | 4.2 | Clause 4 |
ORF-164 Determining the scope of the AI management system | Organization | 4.3 | The scope of the AIMS |
ORF-165 AI management system | Organization | 4.4 | Clause 4 |
ORF-166 Leadership and commitment | Organization | 5.1 | Clause 5 |
ORF-167 AI policy | Organization | 5.2 | Clause 5 |
ORF-168 Roles, responsibilities and authorities | Organization | 5.3 | Clause 5 |
ORF-169 Actions to address risks and opportunities - General | Organization | 6.1.1 | Clause 6 |
ORF-170 AI risk assessment | Organization | 6.1.2 | Clause 6 |
ORF-171 AI risk treatment | Organization | 6.1.3, with the statement of applicability | Clause 6, The statement of applicability |
ORF-172 AI system impact assessment | Organization | 6.1.4 | Clause 6 |
ORF-173 AI objectives and planning to achieve them | Organization | 6.2, A.9.3 | Clause 6, Annex A |
ORF-174 Planning of changes | Organization | 6.3 | Clause 6 |
ORF-175 Resources | Organization | 7.1 | Clause 7 |
ORF-176 Competence | Organization | 7.2 | Clause 7 |
ORF-177 Awareness | Organization | 7.3 | Clause 7 |
ORF-178 Communication | Organization | 7.4 | Clause 7 |
ORF-179 Documented information - General | Organization | 7.5.1 | Clause 7 |
ORF-180 Creating and updating documented information | Organization | 7.5.2 | Clause 7 |
ORF-181 Control of documented information | Organization | 7.5.3 | Clause 7 |
ORF-182 Operational planning and control | Organization | 8.1 | Clause 8 |
ORF-183 Monitoring, measurement, analysis and evaluation | Organization | 9.1 | Clause 9 |
ORF-184 Internal audit | Organization | 9.2.1 | Clause 9 |
ORF-185 Internal audit program | Organization | 9.2.2 | Clause 9 |
ORF-186 Management review | Organization | 9.3.1 | Clause 9 |
ORF-187 Management review inputs | Organization | 9.3.2 | Clause 9 |
ORF-188 Management review results | Organization | 9.3.3 | Clause 9 |
ORF-189 Continual improvement | Organization | 10.1 | Clause 10 |
ORF-190 Nonconformity and corrective action | Organization | 10.2 | Clause 10 |
ORF-191 Policies related to AI | Organization | A.2.2 to A.2.4 | Annex A |
ORF-192 Internal organization | Organization | A.3.2, A.3.3 | Annex A |
ORF-193 Resources for AI systems | Organization | A.4.2 | Annex A |
ORF-194 Assessing impacts of AI systems | Organization | A.5.2 | Annex A |
ORF-195 Management guidance for AI system development | Organization | A.6.1.2, A.6.1.3 | Annex A |
MRF-213 AI risk assessment | AI System | 8.2 | Clause 8 |
MRF-214 AI risk treatment | AI System | 8.3 | Clause 8 |
MRF-215 AI system impact assessment | AI System | 8.4, A.5.3 to A.5.5 | Clause 8, Annex A |
MRF-216 AI system life cycle | AI System | A.4.3 to A.4.6, A.6.2.2 to A.6.2.8 | Annex A |
MRF-217 Data for AI systems | AI System | A.7.2 to A.7.6 | Annex A |
MRF-218 Information for interested parties of AI systems | AI System | A.8.2 to A.8.5 | Annex A |
MRF-219 Use of AI systems | AI System | A.9.2, A.9.4 | Annex A |
MRF-220 Third-party and customer relationships | AI System | A.10.2 to A.10.4 | Annex A |
For the Controls that are in OFF-10 or MFF-10 and also in other Frameworks, see Control overlap.
Items with no Control in the Frameworks
For ISO/IEC 42001, OFF-10 and MFF-10 have no Requirement and no Control for these items.
- Certification. The Frameworks do not contain the selection of a certification body or the certification audits. ISO/IEC 42001 sets no certification procedure. See Certification bodies and accreditation.
- Annex C and Annex D. These two annexes are informative, and the Frameworks have no Requirement for them. See Annexes A to D.
Where to go next
ISO/IEC 42001 overview
The standard, the organizations that it applies to, its structure, its use with ISO/IEC 27001, and the EU AI Act
Scope and certification
The AI roles, the scope of the AIMS, the statement of applicability, and certification
Clauses 4 to 10
The requirements of Clauses 4 to 10 and their documented information
Annexes A to D
The Annex A controls, the Annex B implementation guidance, and the informative Annexes C and D
ISO/IEC 27001 and AI governance
The ISO/IEC 27001 page about AI governance
Sources of this page
- The standard: ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, first edition 2023-12. ISO catalog page. This page refers to these parts:
- Introduction, 3.26, and Clauses 4.1 to 10.2, as in the Requirement table
- Annexes A to D.
- Regulation (EU) 2024/1689 (EU AI Act), Article 27, in the consolidated text of 27 July 2026.
- The Modulos Frameworks
OFF-10andMFF-10.
Disclaimer
This page gives general information only. It is not legal advice. Before you make a decision, compare this page with ISO/IEC 42001:2023.