AIMS

ISO/IEC 42001 / AIMS

The certifiable standard for governing how an organization builds or uses AI.

72 terms

Search this domain

An AI management system (AIMS) is an organization's ongoing, documented program for governing how it develops, provides, or uses AI — policies, risk processes, defined roles, and continual improvement, not a one-time checklist. ISO/IEC 42001 is the international standard for building and certifying one.

Certification isn't self-declared. An accredited certification body audits an organization's AIMS against the standard, and ISO/IEC 42006 sets the requirements those certification bodies themselves have to meet.

42001 shares the same Harmonized Structure — Clauses 4 through 10 — as ISO/IEC 27001. For a firm already running an ISMS, that means an AIMS can be integrated into it rather than run as a separate, parallel program.

Why a small firm would care: client due diligence questionnaires increasingly ask about AI governance, insurers are starting to as well, the EU AI Act is phasing in real obligations, and vendor security reviews are starting to include an AI section by default.

Clause map — Clauses 4–10

Context of the organization

Identify the internal and external issues, and the interested parties, that shape what the AIMS needs to cover.

Leadership

Top management owns the AI policy, assigns roles, and commits real resources — AI governance isn't delegated away entirely.

Planning

Set AI objectives, assess and treat AI risk, and run impact assessments on how AI systems affect people.

Support

Provide the resources, competence, awareness, and documentation the AIMS actually needs to function.

Operation

Carry out the risk treatment and impact assessment processes day to day, not just on paper.

Performance evaluation

Monitor whether it's working, audit it internally, and have leadership review it on a schedule.

Improvement

Fix nonconformities at the root cause and keep improving the system over time.

Annex A — reference controls (A.2–A.10)

A.2 Policies related to AI A.3 Internal organization A.4 Resources for AI systems A.5 Assessing impacts of AI systems A.6 AI system life cycle A.7 Data for AI systems A.8 Information for interested parties A.9 Use of AI systems A.10 Third-party and customer relationships

Annexes B, C & D

Annex B Implementation guidance Annex C AI-related objectives and risk sources Annex D Use across domains and sectors

Showing 72 of 72

A

Accountability Having someone clearly answerable for an AI system's behavior. AI customer An organization or individual that acquires an AI product or service. ISO/IEC 22989 AI management system (AIMS) An organization's ongoing, structured program for governing its AI use. AI objectives Specific, measurable goals the AIMS is working toward. 42001 · Clause 6 AI partner An organization supplying services to an AI producer or provider. ISO/IEC 22989 AI policy The top-level, leadership-approved statement of AI governance commitments. 42001 · Clause 5 AI producer The organization responsible for designing, building, and deploying an AI system. ISO/IEC 22989 AI provider An organization that supplies a product or service built on AI. ISO/IEC 22989 AI risk assessment Identifying and evaluating the risks a given AI system poses. 42001 · 6.1.2 AI risk treatment Deciding how to handle each identified AI risk and selecting controls. 42001 · 6.1.3 AI subject An individual affected by an AI system's decisions or outputs. ISO/IEC 22989 AI system A system that generates outputs — predictions, decisions — from defined objectives. ISO/IEC 22989 AI system impact assessment Assessing how an AI system affects people, not just the organization's own risk. 42001 · 6.1.4 AI system life cycle The full span of an AI system's existence, from design to retirement. ISO/IEC 5338:2023 AIMS scope The documented boundary of what the AI management system covers. 42001 · Clause 4 Annex A controls A reference set of AI-specific controls selected based on actual risk. 42001 · Annex A Annex A.10 — Third-party and customer relationships Controls for AI risk from suppliers and expectations with customers. Annex A.10 Annex A.2 — Policies related to AI Controls for establishing and reviewing an organization's AI policies. Annex A.2 Annex A.3 — Internal organization Controls for AI roles, reporting lines, and ethics escalation. Annex A.3 Annex A.4 — Resources for AI systems Controls covering the data, tooling, compute, and people AI depends on. Annex A.4 Annex A.5 — Assessing impacts of AI systems Controls for actually running AI system impact assessments. Annex A.5 Annex A.6 — AI system life cycle Controls spanning design through decommissioning of an AI system. Annex A.6 Annex A.7 — Data for AI systems Controls for the quality, provenance, and prep of data feeding AI systems. Annex A.7 Annex A.8 — Information for interested parties Controls for what's documented and disclosed about an AI system. Annex A.8 Annex A.9 — Use of AI systems Controls for intended use, objectives, and monitoring once deployed. Annex A.9 Annex B — Implementation guidance Informative guidance for actually implementing Annex A's controls. 42001 · Annex B Annex C — AI-related objectives and risk sources A catalogue of typical AI risk sources and related objectives. 42001 · Annex C Annex D — Use across domains and sectors Guidance on applying 42001 across sectors and alongside other standards. 42001 · Annex D Awareness Making sure staff understand the AI policy and their part in it. 42001 · Clause 7

C

Certification audit The independent audit confirming an AIMS actually meets ISO/IEC 42001. Certification body The accredited organization authorized to audit and certify an AIMS. 42001 · certification Communication Defining what AIMS information gets shared, with whom, and how. 42001 · Clause 7 Competence Making sure people doing AIMS work actually have the skills to do it. 42001 · Clause 7 Context of the organization Identifying the issues and interested parties relevant to the AIMS. 42001 · Clause 4 Continual improvement Keeping the AIMS getting better over time instead of standing still. 42001 · Clause 10 Control objective The specific goal a given Annex A control exists to achieve. 42001 · Annex A Corrective action Fixing the root cause of a nonconformity, not just the symptom. 42001 · Clause 10

D

Data provenance The documented origin and history of a dataset. Data quality How accurate, complete, and representative the data feeding AI actually is. Documented information The records an AIMS has to keep as evidence it's actually operating. 42001 · Clause 7

E

EU AI Act The EU's risk-tiered AI law, phasing in obligations through 2027–2028. EU AI Act Explainability Describing, in human terms, the factors behind a specific AI decision.

F

Fairness & bias Treating people equitably, and the systematic skew that can work against it. ISO/IEC TR 24027

H

Harmonized Structure The common Clause 4–10 skeleton shared by all modern ISO management standards. Human oversight Keeping a person meaningfully able to monitor or override an AI system.

I

Interested parties Everyone with a stake in how an organization manages its AI. 42001 · Clause 4 Internal audit A self-check confirming the AIMS meets the standard and its own requirements. 42001 · Clause 9 ISO/IEC 22989 Defines the shared AI vocabulary the rest of the AI standards family builds on. ISO/IEC 22989:2022 ISO/IEC 23053 A framework describing the building blocks of machine-learning-based AI systems. ISO/IEC 23053 ISO/IEC 23894 Adapts general risk management principles specifically to AI. ISO/IEC 23894:2023 ISO/IEC 38507 Gives governing bodies guidance on overseeing an organization's use of AI. ISO/IEC 38507:2022 ISO/IEC 42001 The international standard for building and certifying an AI management system. ISO/IEC 42001:2023 ISO/IEC 42005 Detailed guidance for conducting an AI system impact assessment. ISO/IEC 42005:2025 ISO/IEC 42006 Sets the requirements certification bodies must meet to audit against 42001. ISO/IEC 42006:2025 ISO/IEC 5338 Defines the processes that make up an AI system's life cycle. ISO/IEC 5338:2023 ISO/IEC TR 24027 A technical report on measuring bias in AI systems and AI-aided decisions. ISO/IEC TR 24027:2021

M

Machine learning (ML) Building AI systems that learn patterns from data instead of fixed rules. Management review Leadership's periodic review of how the AIMS is performing. 42001 · Clause 9 Monitoring and measurement Tracking whether the AIMS and its controls are actually working. 42001 · Clause 9

N

NIST AI 600-1 (Generative AI Profile) NIST's guidance on risks specific to generative AI, like confabulation. NIST AI 600-1 NIST AI Risk Management Framework (NIST AI RMF) A voluntary US framework built around four functions for managing AI risk. NIST AI RMF 1.0 Nonconformity A point where the AIMS fails to meet a requirement. 42001 · Clause 10

O

Operational planning and control Carrying out AI risk treatment and impact assessment day to day. 42001 · Clause 8

P

Planning of changes Planning changes to the AIMS in a controlled way as AI use evolves. 42001 · Clause 6

R

Recertification The renewed audit, typically every three years, that keeps certification valid. Resources Providing what the AIMS actually needs to function — people, time, budget. 42001 · Clause 7 Risk criteria The organization's own yardsticks for likelihood, impact, and acceptable risk. 42001 · Clause 6 Roles and responsibilities (42001) Clearly assigning who owns which part of the AIMS. 42001 · Clause 5

S

Statement of Applicability (SoA) The document listing which Annex A controls apply, and why. 42001 · 6.1.3 / Annex A

T

Top management commitment Leadership actively owning the AI policy, not delegating it entirely. 42001 · Clause 5 Transparency Making appropriate information about an AI system available to who needs it. Trustworthiness An AI system's demonstrated reliability across accuracy, safety, and fairness.