What are the requirements of the ISO 42001 standard?

Requirements of ISO/IEC 42001:2023

Artificial Intelligence Management System (AIMS)

The requirements of the standard are in clauses 4 to 10 and in Annex A. See details and comments on the requirements of ISO 42001:2023.

Clause 4 – Context

Objective: To understand why and how AI is used in the organization

Requirements:

4.1 Understanding the organization and its context

Identify the internal and external issues that influence AI systems (technological, ethical, regulatory, societal, etc.)

4.2 Stakeholders (interested parties) and needs

Identify interested parties (customers, users, authorities, employees) and their expectations regarding responsible AI

4.3 Defining the scope of the AIMS

Specify which AI activities, products, processes, and technologies are included in the system

4.4 AI Management System

Establish, document, and maintain the AIMS, including its interactions with other systems (quality, security, etc.)

Clause 5 – Leadership

Objective: To engage top management in responsible AI governance

Requirements:

5.1 Leadership and Commitment

Top management must demonstrate its involvement in and support for the AIMS

5.2 AI Policy

Define a policy that specifies the ethical values, compliance, transparency, security, and quality expected for AI

5.3 Roles, Responsibilities, and Authorities

Clearly designate responsibilities related to AI (e.g., AI governance officer, data officer, etc.)

Clause 6 – Planning

Objective: To anticipate risks and plan mitigation actions

Requirements:

6.1 Actions to Address Risks and Opportunities

Identify, assess, and address AI-related risks: algorithmic bias, regulatory non-compliance, privacy breaches, ethical lapses, technical or security failures

6.2 Objectives and Planning

Define measurable objectives related to the performance, security, reliability, and explainability of AI

6.3 Change Planning

Manage changes to AI systems (new versions, datasets, algorithms, etc.)

Clause 7 – Support

Objective: Provide the necessary resources, skills, and tools

Requirements:

7.1 Resources

Allocate the human, technological, and financial resources for the AI Management System

7.2 Skills

Ensure that AI teams are qualified (ethics, regulations, data science, cybersecurity)

7.3 Awareness

Raise awareness among all staff regarding the impacts and obligations related to AI

7.4 Communication

Define internal/external communication methods (e.g., transparency of AI decisions)

7.5 Documentation

Create and maintain up-to-date AIMS documentation: policies, procedures, registers, traceability of AI models

Clause 8 – Implementation

Objective: To manage the complete lifecycle of AI systems

Requirements:

8.1 Operational Planning and Control

Define the processes necessary for the development, deployment, and monitoring of AI

8.2 AI Risk Assessment

Include: model validation and verification, management of training/test data, bias assessment, quality control of AI outputs

8.3 AI Risk Management

Monitor post-deployment performance, detect deviations, and update models

8.4 AI System Impact Assessment

Impose equivalent governance and compliance criteria for AI partners

Clause 9 – Performance

Objective: Verify that the AIMS is effective and efficient

Requirements:

9.1 Monitoring, Measurement, Analysis, and Evaluation

Define Key Performance Indicators (KPIs): reliability, accuracy, transparency, and user satisfaction

9.2 Internal Audit

Conduct regular audits of the AIMS

9.3 Management Review

Top management periodically assesses the compliance, effectiveness, and suitability of the AIMS

Clause 10 – Improvement

Objective: Ensure continuous improvement.

Requirements:

10.1 Continual Improvement

Review AI policies, procedures, and models to continually improve them

10.2 Nonconformity and Corrective Action

Identify nonconformities, determine root causes, and implement corrective actions

Annex A Reference control Objectives and controls

Objective: To detail specific controls for managing AI-related risks, such as transparency, fairness, security, confidentiality, and the robustness of AI systems

Annex B Implementation Guidance for AI controls

Objective: Information to support the implementation of the controls in Annex A

ISO/IEC 42001:2023 provides a range of strategic, organizational, operational, ethical, societal, regulatory, compliance, economic, image, and reputational benefits to organizations that develop, use, or integrate artificial intelligence (AI)

The Benefits of ISO/IEC 42001:2023

1. Strategic Benefits

Leadership in Responsible AI: Enables the organization to position itself as a reliable and ethical player in the field of artificial intelligence

Competitive Differentiation: Companies certified to ISO 42001 stand out in the market thanks to governed, traceable, and compliant AI

Customer and Partner Trust: Certification strengthens credibility and transparency with customers, investors, and authorities

Regulatory Alignment (European AI Act): Facilitates future legal compliance, as the standard incorporates the governance principles required by AI regulations

2. Organizational Benefits

Structured Governance Framework: Provides a clear methodology for organizing the management of AI projects and systems

Clarification of Roles and Responsibilities: Clearly defines who does what (developers, ethics officers, data managers, management, etc.)

Improved AI life cycle management: covers all stages (design, validation, deployment, monitoring, update, retirement)

Integration with other management systems (ISO 9001, ISO 27001, ISO 27701): facilitates consistent quality-security-ethics management within a comprehensive approach

3. Operational Benefits

Reduced AI incidents: by identifying and addressing biases, errors, or deviations, the organization avoids costly failures

Improved model quality: validation and testing requirements ensure more robust and efficient AI

Optimized AI processes: standardization reduces duplication, costs, and development time

Effective management of AI suppliers and partners: imposes quality and compliance criteria throughout the entire chain

4. Ethical and Societal Benefits

Prevention of bias and discrimination: the standard mandates methods for detecting, evaluating, and correcting algorithmic biases

Protection of human rights and privacy: consistency with the GDPR and the principles of privacy by design

Transparency and explainability of AI decisions: requires documentation and clear explanation of how algorithms work

Contribution to trustworthy AI: fosters social acceptance and accountability for AI technologies

5. Regulatory and compliance benefits

Anticipating legal obligations (AI Act, GDPR, etc.): the standard aligns with the governance principles of the future European AI regulatory framework

Reduced legal risks: control and traceability policies reduce the likelihood of litigation or penalties

Facilitates certification or external audits: the evidence required by the standard already structures the documentation needed by regulators

6. Economic benefits

Optimized AI costs: fewer errors, fewer fixes, and improved resource efficiency

Improved ROI for AI projects: Thanks to rigorous governance, projects succeed more often and more sustainably

Access to new markets: Increasingly, public and private tenders require ISO guarantees for AI

7. Image and reputation benefits

Increased credibility with stakeholders: Certification is perceived as a guarantee of seriousness and mastery of AI

Ethical and transparent communication: Enhances the company's image with the public, the media, and regulators

Enhanced attractiveness: Attracts talent, clients, and partners committed to responsible AI