Organizations that use artificial intelligence (AI) need clear rules. Which applications are approved? Who is responsible? How are results reviewed and risks assessed? These questions apply both to AI systems developed in-house and to externally acquired AI tools.

ISO/IEC 42001 specifies the requirements for an Artificial Intelligence Management System (AIMS). It defines how an organization manages and improves the development, provision, and use of AI. This includes assessing risks and impacts, assigning clear responsibilities, and regularly reviewing the measures that have been implemented. Process Fellows supports you in translating these requirements into your day-to-day operations.

The starting point is your existing AI applications and the processes you already use.

ISO/IEC 42001 is a certifiable management system standard for organizations that provide, develop, or use AI. Its basic structure (Clauses 4–10) corresponds to ISO 9001 and ISO/IEC 27001:

Clause	AI-specific requirement	Builds on
4 Context	Role of the organisation (provider, developer, user), AI inventory and scope	Context analysis under ISO 9001 / ISO/IEC 27001
5.2 AI policy	Management-approved AI policy with objectives and commitments	Quality and information security policies
6.1.2 / 6.1.3	AI risk assessment and treatment; Statement of Applicability (SoA)	ISMS risk process and Statement of Applicability
6.1.4	AI system impact assessment: effects on individuals and society	Data protection impact assessment (GDPR), fundamental rights impact assessment (AI Act)
8.2–8.4	Perform risk assessments, risk treatment and impact assessments in operation	Operational processes and Automotive SPICE MLE
9 and 10	Monitoring, internal audit, management review and improvement	Existing audit programme

Annexes: A – 38 reference controls, B – Implementation guidance, C – AI objectives and sources of risk, D – Application in different industries

Certification: By certification bodies accredited according to ISO/IEC 42006.

For further information, see also the Frequently Asked Questions section below.

In many organizations, AI applications initially emerge within individual teams. As their use expands, management, business departments, development, IT, and data protection need to agree on a common approach.

Organizations frequently face similar tasks:

• Identifying the AI systems in use and their intended purposes
• Defining responsibilities and decision-making authority
• Assessing risks and potential impacts in a transparent and traceable manner
• Establishing rules for data, approvals, and the review of AI-generated results
• Managing changes and incidents and providing targeted employee training

The level of effort required for these processes depends on your applications and the associated risks. We focus on making use of existing structures and involving the relevant teams at an early stage.

Our collaboration starts wherever you are today. The following three building blocks range from initial orientation to piloting your AI management system.

ISO 42001 Management Workshop

Together with your management team and the relevant business departments, we clarify what ISO/IEC 42001 means for your organization. We discuss relevant AI applications, the potential scope of the AIMS, and responsibilities within the organization. Based on this, we derive objectives and initial steps.

You receive an agreed basis for decision-making, including priorities and the next tasks to be addressed.

ISO 42001 Readiness Check

We review selected documentation and discuss existing processes and practices with the responsible stakeholders. By comparing these with the requirements of ISO/IEC 42001, we identify which foundations are already in place and where action is still required. The scope and depth of the assessment are agreed in advance.

We document the results in a gap analysis and a prioritized action plan. The Readiness Check is intended to assess your current status and does not constitute a certification audit.

AIMS Implementation and Piloting

Together with your team, we develop the necessary rules and processes. These may include the AI policy, an AI inventory, responsibilities, and the assessment of risks and impacts. Using selected use cases, we test how approvals, controls, and changes work in day-to-day operations. Internal training and coaching support the implementation.

Following the pilot, we adapt the processes based on the experience gained and plan the rollout to additional areas.

ISO/IEC 5338 as a Complementary Standard

Where appropriate, we also incorporate ISO/IEC 5338 when designing lifecycle processes. The standard builds on established systems and software development processes and supplements them with AI-specific content. It therefore helps translate management system requirements into practical processes for development, procurement, and operation.

Audit Preparation

We also support you in reviewing your evidence, addressing outstanding issues, and preparing for an external certification audit. This may include internal audits while ensuring objectivity and impartiality.

Ongoing AIMS Support

We support you in operating your AIMS, for example when introducing new AI applications, changing processes, conducting management reviews, or following up on improvement actions.

Interested?

Would you like to find out what ISO/IEC 42001 means for your organization or how to get started with implementation?
Use our Contact Form or feel free to contact us via:

Phone: +49 9194 3719957 
E-Mail: ​office@processfellows.de