How to use this
Work top to bottom. The clauses come before the controls for a reason — Annex A applicability is decided by your scope and risk work, so picking controls first produces a system you cannot defend at Stage 1.
Three things have to be true for every item: it is documented, it actually happens, and you can evidence that it happened. The third is where implementations fail.
Clause 4 — Context
- Internal and external issues affecting the AIMS are documented.
- Interested parties and their requirements are identified.
- Your role is determined — AI developer, provider, user, or several.
- The AIMS scope statement is documented and defensible.
- An inventory of AI systems in scope exists and is current.
The inventory is the item most often missing, and it routinely surfaces third-party models embedded in features nobody catalogued.
Clause 5 — Leadership
- An AI policy is approved by top management and communicated.
- The policy aligns with other organizational policies.
- AI roles and responsibilities are assigned and understood.
- Top management demonstrates commitment through documented decisions.
Clause 6 — Planning
- A documented risk assessment process exists and is repeatable.
- AI risks are identified, analysed and evaluated against defined criteria.
- Each risk has a named owner.
- A risk treatment plan exists with actions, owners and dates.
- AI impact assessments are documented per system.
- A Statement of Applicability covers all 38 Annex A controls with justification.
- AI objectives are defined and measurable.
Item 5 is the requirement with no ISO 27001 equivalent and the one teams underestimate.
Clause 7 — Support
- Resources for the AIMS are determined and provided.
- Competence requirements for AI roles are defined and met.
- Awareness training is delivered and completion is evidenced.
- Internal and external communication about AI is planned.
- Documented information is controlled, versioned and current.
Clauses 8, 9 and 10 — Operation, evaluation, improvement
- Operational planning and control are documented.
- The risk treatment plan is actually executed, with evidence.
- Impact assessments are performed and revisited when systems change.
- AIMS performance is monitored and measured.
- An internal audit covering the AIMS has been completed.
- A management review has been held and recorded.
- Nonconformities are logged with corrective actions and closure evidence.
Items 5 and 6 are mandatory and must precede your certification audit. Missing them is the most common Stage 1 finding across every ISO management system standard.
Annex A — the nine areas
| Area | Checklist focus | Evidence that works |
|---|---|---|
| A.2 Policies | AI policy exists, reviewed, aligned | Approved policy with review date |
| A.3 Internal organization | Roles assigned, concern reporting route exists | RACI plus a working reporting channel |
| A.4 Resources | Data, tooling, compute and people documented | Current AI system and resource inventory |
| A.5 Impact assessment | Per-system impact on people documented | Dated assessments naming affected parties and oversight |
| A.6 Life cycle | Objectives, design, V&V, deployment, monitoring | Life cycle records per system |
| A.7 Data | Acquisition, quality, provenance, preparation | Provenance records — hardest to retrofit |
| A.8 Information | Transparency, documentation, incident reporting | User-facing documentation and incident log |
| A.9 Use | Intended purpose, responsible use, monitoring | Usage policy plus monitoring output |
| A.10 Third parties | Supplier and customer responsibility allocation | Agreements naming AI responsibilities |
Remember the applicability rule: you consider all 38 controls and justify which apply. See the Annex A controls in detail.
The five things that delay certification
No AI inventory. You cannot scope, assess or certify what you have not found.
Impact assessments treated as risk assessments. They ask different questions and an auditor notices immediately.
Data provenance never tracked. The hardest gap to close and impossible to reconstruct quickly.
Internal audit and management review left until after certification. Both are prerequisites.
Booking the certification body late. The accredited pool for ISO 42001 is small, and scheduling is frequently the binding constraint.
FAQs
What is on an ISO 42001 checklist?
Clauses 4 to 10 of the management system — context and scope, leadership and policy, risk assessment and AI impact assessment, support, operation, internal audit and management review, and improvement — plus a decision and justification on each of the 38 Annex A controls across the nine areas.
What evidence does an ISO 42001 auditor want?
Documented information that shows things actually happened: an approved AI policy with a review date, a current AI system inventory, dated impact assessments naming affected parties, life cycle records per system, data provenance records, internal audit reports and management review minutes.
What is the most common ISO 42001 gap?
No current inventory of AI systems, which blocks scoping, impact assessment and control applicability simultaneously. It is also the gap that most often grows mid-project, because inventories surface third-party models embedded in features nobody had catalogued.
Do I need an AI impact assessment for every system?
For every AI system inside your AIMS scope, yes, and they must be revisited when systems change materially. An impact assessment is not a risk assessment — it examines consequences for the people the system affects rather than risk to the organization.
Is internal audit required before ISO 42001 certification?
Yes. Internal audit and management review are mandatory clauses and both must be complete before the certification audit. Evidence of them is requested at Stage 1, and their absence is the most common Stage 1 finding across ISO management system standards.
Where to go next
See ISO 42001 certification services, how long certification takes, or what it costs.