ISO 42001

Organisations must document a policy governing the development or use of AI systems, aligned with business requirements and ethical considerations.

AI policies should be integrated with business strategy, organisational values, and existing risk management processes so they do not conflict with other management systems.

The AI policy shall be reviewed at planned intervals to ensure it remains relevant and effective as AI technologies, regulations, and organisational context evolve.

Roles and responsibilities for AI system management shall be clearly defined and allocated across development, deployment, and oversight activities.

The organisation shall establish a mechanism allowing personnel and other interested parties to report concerns about the organisation's role in the AI system life cycle.

The organisation shall determine external and internal issues relevant to its purpose and that affect its ability to achieve the intended outcomes of its AIMS.

The organisation shall determine interested parties relevant to the AIMS and their requirements.

The organisation shall document the resources (data, tooling, systems, human resources) that are relevant to the AI system's life cycle.

Data used as a resource for AI systems shall be identified and documented.

Tooling used to build, test, deploy, and monitor AI systems shall be identified and documented.

Computing infrastructure supporting AI systems, including its capabilities and limitations, shall be documented and managed.

The competence and qualifications of personnel involved in the AI system life cycle shall be identified and documented.

Top management shall demonstrate leadership and commitment with respect to the AIMS.

The organisation shall establish a process to assess the potential consequences of AI systems for individuals and society throughout the AI system life cycle.

Results of AI system impact assessments shall be documented, including the intended use and identified impacts.

The organisation shall specifically assess how an AI system affects individual users or groups of individuals.

The organisation shall assess the broader societal consequences of deploying an AI system.

The organisation shall consider the issues referred to in Clause 4 and determine the risks and opportunities that need to be addressed.

The organisation shall define objectives guiding the responsible development of its AI systems.

Documented processes shall govern responsible design and development practices throughout AI system creation.

The organisation shall establish AI objectives at relevant functions and levels, ensuring they are measurable and monitored.

Requirements and specifications for the AI system shall be defined before development proceeds.

Design decisions and development activities for the AI system shall be documented.

The AI system shall be verified and validated against defined criteria for performance, safety, and intended use.

Procedures for safely introducing the AI system into its operational environment shall be documented and followed.

The organisation shall monitor the AI system's operation to track performance and identify anomalies.

Technical documentation for the AI system shall be created and maintained throughout its life cycle.

Events and activities of the AI system shall be logged to provide an audit trail of its operation.

The organisation shall determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the AIMS.

The organisation shall determine necessary competence of persons doing work under its control that affects AI performance.

Data used to develop and improve AI systems shall be identified and documented.

The organisation shall document the source, categories, and characteristics of data acquired for use in AI systems.

Data quality requirements shall be defined and documented to ensure AI system reliability.

A process for recording the provenance of data, tracking its sources and transformations, shall be established.

Methods for cleaning, labelling, and transforming data used by AI systems shall be defined and documented.

The organisation shall plan, implement and control the processes needed to meet requirements and implement actions identified in Clause 6.

The organisation shall implement an AI risk assessment process and assess the AI risks identified during planning.

Users shall be provided with information on the AI system's purpose, usage instructions, and technical limitations.

Information about the AI system shall be disclosed to relevant external stakeholders as appropriate.

A documented plan for communicating AI system incidents to users and other affected parties shall be established.

The organisation shall determine and communicate essential information about the AI system to relevant stakeholder groups.

The organisation shall determine what needs to be monitored and measured, including AI processes and controls.

The organisation shall conduct internal audits at planned intervals to determine whether the AIMS conforms to the organisation's own requirements and the standard.

Processes for the responsible use of AI systems within the organisation shall be defined.

The organisation shall establish clear objectives for how AI systems will be responsibly used.

AI systems shall be used according to their documented intended purposes and use cases.

When a nonconformity occurs, the organisation shall evaluate the need for action and implement corrective actions.

The organisation shall continually improve the suitability, adequacy and effectiveness of the AIMS.

Responsibilities for AI-related obligations shall be clearly allocated among the organisation, its partners, and third parties.

The organisation shall establish processes to assess suppliers of AI-related products or services against ethical and compliance standards.

Customer expectations and needs relevant to the AI system shall be understood and integrated into its development and operation.