ISO/IEC 42001:2023 Handbook

• Context of the organization

  Define the organizational context, interested parties, scope, and AI management system.

  4 controls

• Leadership

  Establish leadership commitment, AI policy, responsibilities, and authorities.

  3 controls

• Planning

  Plan actions for AI risks, impacts, objectives, opportunities, and changes.

  6 controls

• Support

  Provide resources, competence, awareness, communication, and controlled information.

  7 controls

• Operation

  Operate controlled processes for AI risk assessment, treatment, and impact assessment.

  4 controls

• Performance evaluation

  Monitor, measure, audit, and review the AI management system.

  6 controls

• Improvement

  Continually improve and correct AI management system nonconformities.

  2 controls

• Policies related to AI

  Set management direction for AI through a documented, aligned, and regularly reviewed AI policy.

  3 controls

• Internal organization

  Assign clear roles, responsibilities, and concern-reporting channels for AI across the organization.

  2 controls

• Resources for AI systems

  Document the data, tooling, system, computing, and human resources behind each AI system.

  5 controls

• Assessing impacts of AI systems

  Assess and document how AI systems affect individuals, groups, and societies across their life cycle.

  4 controls

• Management guidance for AI system development

  Set objectives and processes for responsible AI system design and development.

  2 controls

• AI system life cycle

  Define requirements, documentation, verification, deployment, operation, and logging for every AI life cycle stage.

  7 controls

• Data for AI systems

  Govern how data for AI systems is acquired, checked for quality, traced, and prepared.

  5 controls

• Information for interested parties of AI systems

  Give users and other interested parties the information they need to understand, assess, and report on AI systems.

  4 controls

• Use of AI systems

  Ensure AI systems are used responsibly, per policy, and within their intended purposes.

  3 controls

• Third-party and customer relationships

  Keep responsibilities and risks clearly allocated when suppliers, partners, and customers touch the AI life cycle.

  3 controls

Need help putting this into practice? See our ISO/IEC 42001 compliance services.