ISO/IEC 42001:2023 on iso.org, the AI management system standard published on 18 December 2023, has 10 clauses. Clauses 4 to 10 hold the requirements an organization must meet to claim conformity. Clauses 1 to 3 give the scope, one normative reference and the terms. Clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement.
Those seven clauses follow the harmonized structure shared by ISO management system standards, so their numbers and top-level titles match ISO/IEC 27001 and ISO 9001. The AI content sits inside: AI roles in 4.1, an AI policy in 5.2, and AI risk and impact assessment in 6.1, repeated in 8.2 to 8.4.
ISO 42001 Clauses 4 to 10 at a Glance
Each ISO/IEC 42001 requirement clause has an official title, a place in the Plan-Do-Check-Act cycle, a record an auditor reads and, often, an Annex A objective area that supports it. Titles are exactly as printed in the standard.
| Clause | Official title | PDCA | Evidence an auditor reads | Annex A link |
| 4.1 | Understanding the organization and its context | Plan | Issues record, climate change decision, AI role and intended purpose per AI system | A.9 Use of AI systems |
| 4.2 | Understanding the needs and expectations of interested parties | Plan | Interested parties register, marked with the requirements the AIMS addresses | A.10 Third-party and customer relationships |
| 4.3 | Determining the scope of the AI management system | Plan | Scope statement (required documented information) | None directly |
| 4.4 | AI management system | Plan | Map of AIMS processes and their interactions | All areas |
| 5.1 | Leadership and commitment | Plan | Mandate, resourcing decisions, review minutes signed by top management | A.3 Internal organization |
| 5.2 | AI policy | Plan | Approved AI policy and evidence it was communicated | A.2 Policies related to AI |
| 5.3 | Roles, responsibilities and authorities | Plan | Roles and authorities record | A.3 Internal organization |
| 6.1.1 | General (under 6.1 Actions to address risks and opportunities) | Plan | AI risk criteria; planned actions on risks and opportunities | Annex C (risk sources) |
| 6.1.2 | AI risk assessment | Plan | Risk assessment process; AI risk register | A.7 Data for AI systems, among others |
| 6.1.3 | AI risk treatment | Plan | Risk treatment plan; Statement of Applicability | Every area (compared one by one) |
| 6.1.4 | AI system impact assessment | Plan | Impact assessment process; completed assessments | A.5 Assessing impacts of AI systems |
| 6.2 | AI objectives and planning to achieve them | Plan | AI objectives with owners, resources, dates and measures | A.6 AI system life cycle; A.9 |
| 6.3 | Planning of changes | Plan | Change records for the AIMS | None directly |
| 7.1 | Resources | Do | Resource decisions and budget | A.4 Resources for AI systems |
| 7.2 | Competence | Do | Competence evidence for people in AIMS roles | A.4 (human resources) |
| 7.3 | Awareness | Do | Awareness records | A.3 (reporting of concerns) |
| 7.4 | Communication | Do | Communication plan | A.8 Information for interested parties |
| 7.5 | Documented information (7.5.1 General, 7.5.2 Creating and updating documented information, 7.5.3 Control of documented information) | Do | Document control rules, versions, retention | A.6 (technical documentation) |
| 8.1 | Operational planning and control | Do | Records that processes ran as planned | A.6, A.7, A.9, A.10 |
| 8.2 | AI risk assessment | Do | Dated reassessments | Annex C (risk sources) |
| 8.3 | AI risk treatment | Do | Treatment results; updated SoA | Controls chosen in 6.1.3 |
| 8.4 | AI system impact assessment | Do | Dated reassessments | A.5 Assessing impacts of AI systems |
| 9.1 | Monitoring, measurement, analysis and evaluation | Check | Monitoring and measurement results | A.6 (operation and monitoring) |
| 9.2 | Internal audit (9.2.1 General, 9.2.2 Internal audit programme) | Check | Audit program, audit reports | None directly |
| 9.3 | Management review (9.3.1 General, 9.3.2 Management review inputs, 9.3.3 Management review results) | Check | Review minutes and decisions | A.2 (review of the AI policy) |
| 10.1 | Continual improvement | Act | Improvement actions | None directly |
| 10.2 | Nonconformity and corrective action | Act | Nonconformity and corrective action log | A.8 (communication of incidents) |
Source: clause and sub-clause titles from ISO/IEC 42001:2023 (official preview, table of contents). Annex A area titles match the nine control areas in the IAPP’s June 2024 summary; the A.2 to A.10 numbering follows published summaries. The PDCA, evidence and Annex A columns are an AI Training Skool mapping, not ISO wording.
ISO/IEC 42001 does not label its clauses with PDCA phases. The column above is the common reading of the shared Annex SL high-level structure for management system standards: plan in clauses 4 to 6, do in 7 and 8, check in 9, act in 10. Read it as orientation, not as a requirement.
Clauses 1 to 3: Scope, the Normative Reference and the Terms
Clauses 1 to 3 of ISO/IEC 42001 set no requirements; they define what the standard covers and the words it uses. Clause 1 says the standard applies to any organization, of any size, type or nature, that provides or uses products or services built on AI systems.
Clause 2 lists one normative reference: ISO/IEC 22989:2022, the AI concepts and terminology standard published in July 2022. Clause 3 adds 26 definitions, from 3.1 organization to 3.26 statement of applicability. Two matter most: 3.24 defines the AI system impact assessment, and 3.26 the Statement of Applicability, the record of all necessary controls and why each is included or excluded.
The introduction adds that the order of requirements “does not reflect their importance or imply the order” of implementation. The clause numbers are not a project plan. For a working sequence, see implementing ISO 42001 from scope to certification readiness.
Clause 4 Context of the Organization: AI Roles, Climate Change and Scope
Clause 4 requires you to define what the AI management system is for, who it serves and where its boundary sits. It differs most from sister standards in 4.1, which asks for your role with respect to each AI system.
4.1 Understanding the Organization and Its Context
Clause 4.1 asks for the external and internal issues that affect the intended results of the AIMS. It then adds two AI-specific requirements. You must consider the intended purpose of the AI systems you develop, provide or use, and “determine its roles with respect to these AI systems”.
The roles listed in a note include AI providers, AI producers, AI customers (including users), AI partners, AI subjects and relevant authorities. The note points to ISO/IEC 22989 for detail and adds that the NIST AI Risk Management Framework, released on 26 January 2023, also describes role types across the AI life cycle. A role decides how far requirements and controls apply, so record it per system, not once for the company.
Clause 4.1 also asks the organization to determine whether climate change is a relevant issue; record the answer with a reason. A note lists external issues such as legal requirements, “including prohibited uses of AI”. For US companies selling into Europe, our overview has a short section on ISO/IEC 42001 and the EU AI Act.
4.2, 4.3 and 4.4: Interested Parties, Scope and the System Itself
Clause 4.2 asks for the relevant interested parties, their relevant requirements and which of those the AIMS will address. A note adds that interested parties can have climate-related requirements. Clause 4.3 sets the scope from the 4.1 issues and the 4.2 requirements, and the scope “shall be available as documented information”. Clause 4.4 requires you to establish, implement, maintain, continually improve and document the AIMS, including the processes it needs and how they interact.
Common gap: a scope that names the company but not the AI systems, so nobody can tell which systems are in or out.
Clause 5 Leadership: Top Management, the AI Policy and Named Roles
Clause 5 places responsibility for the AIMS on top management. Clause 5.1 asks top management to demonstrate leadership and commitment, for example by integrating AIMS requirements into business processes and providing resources.
Clause 5.2 requires an AI policy that fits the organization’s purpose, gives a framework for setting AI objectives, and commits to meeting applicable requirements and to continual improvement. The policy must be documented, communicated internally and available to interested parties as appropriate. Section-by-section drafting belongs to the AI policy ISO 42001 requires.
Clause 5.3 asks top management to assign and communicate responsibilities and authorities. Two assignments are named in the harmonized text: making sure the AIMS conforms to the standard, and reporting AIMS performance to top management.
Common gap: an AI policy approved by a committee that is not top management, or never communicated beyond the people who wrote it.
Clause 6 Planning: Risk, Impact, Objectives and Changes
Clause 6 is where ISO/IEC 42001 adds the most AI-specific text. It places risk work under 6.1, Actions to address risks and opportunities, in four sub-clauses (6.1.1 to 6.1.4), then covers AI objectives (6.2) and planning of changes (6.3).
6.1.1 to 6.1.4: AI Risk and Impact
Clause 6.1.1 asks you to determine the risks and opportunities the AIMS must address, building on 4.1 and 4.2. Clause 6.1 also calls for AI risk criteria that separate acceptable from non-acceptable risk. Clause 6.1.2 requires a defined AI risk assessment process; published summaries agree that repeated assessments must give consistent, valid and comparable results. ISO/IEC 23894:2023 gives AI risk management guidance to build the method on.
Clause 6.1.3 covers AI risk treatment: choose options, determine the controls needed and compare them with Annex A so nothing necessary is missed. The outputs are a risk treatment plan and the Statement of Applicability, with residual risk accepted by management. The method for that step sits with AI risk treatment decisions that feed the SoA, and the control set itself with the ISO 42001 Annex A control objectives.
Clause 6.1.4 requires a process for assessing the consequences of AI systems for individuals, groups of individuals and societies. Definition 3.24 calls it a “formal, documented process”, so an informal discussion does not count.
6.2 and 6.3: AI Objectives and Planning of Changes
Clause 6.2 asks for AI objectives that are consistent with the AI policy, measurable where practicable, monitored, communicated and updated. For each one you plan what will be done, the resources, who is responsible, when it will be completed and how results are evaluated.
Clause 6.3, Planning of changes, is short and often missed: changes to the AIMS are carried out in a planned manner. ISO/IEC 27001 added the same sub-clause in its 2022 edition. Keep a record of what changed, why and who approved it.
Common gap: a risk register with no written criteria, so two assessors scoring the same system reach different levels.
Why Clauses 8.2 to 8.4 Repeat Clause 6
ISO/IEC 42001 repeats three sub-clause titles: AI risk assessment, AI risk treatment and AI system impact assessment appear in clause 6 and again in clause 8. Clause 6 sets each process up as planning, and clause 8 requires you to perform it in operation, on a schedule and when things change.
| Process | Clause 6 (plan it) | Clause 8 (perform it) | Record that shows the difference |
| AI risk assessment | 6.1.2: define the process and criteria | 8.2: perform it at planned intervals and when significant changes are proposed or occur | Dated reassessments after a change, not only the first assessment |
| AI risk treatment | 6.1.3: choose options and controls; produce the treatment plan and SoA | 8.3: implement the plan and check that it works | Treatment results; SoA updated when controls change |
| AI system impact assessment | 6.1.4: define the process for consequences for people and society | 8.4: perform it at planned intervals and when significant changes occur | Dated reassessments tied to a change in purpose, data or model |
Source: sub-clause titles from ISO/IEC 42001:2023 (official preview, table of contents); timing wording as reproduced in published clause summaries, since the full standard is sold.
A one-off assessment made during the project satisfies the planning clause but leaves clause 8 without evidence, so agree in writing what counts as a significant change. The impact side of that cycle is covered in running an AI system impact assessment.
Clauses 7 and 8.1: Support and Operational Control
Clause 7 supplies what the AIMS runs on, and clause 8.1 makes the planned processes run. Clause 7.1 requires the resources the AIMS needs. Clause 7.2 requires people whose work affects AI performance to be competent, with action taken to close gaps and evidence kept. Clause 7.3 asks that people know the AI policy, their contribution and what happens if they do not conform.
Clause 7.4 asks you to decide what to communicate, when, with whom and how. Clause 7.5 covers documented information: what you must keep (7.5.1), creating and updating it (7.5.2) and controlling it (7.5.3).
Clause 8.1 asks you to plan, implement and control the processes needed to meet requirements and carry out the clause 6 actions, including control of planned changes and outsourced processes. For AI that means deployment approvals, supplier checks and monitoring records.
Common gap: competence claimed for impact assessors and risk owners with no record behind it.
Clauses 9 and 10: Evaluation, Internal Audit and Improvement
Clauses 9 and 10 prove the AIMS works and fix it when it does not. Clause 9.1 asks what you monitor and measure, how, when, and when results are analyzed and evaluated. Clause 9.2 requires internal audits at planned intervals, and 9.2.2, Internal audit programme, requires a program that sets frequency, methods, responsibilities and reporting. Audit program design is the subject of the clause 9.2 internal audit under ISO 42001.
Clause 9.3 requires top management to review the AIMS at planned intervals, with set inputs (9.3.2) and results (9.3.3) kept as evidence.
Clause 10.1 asks for continual improvement of the suitability, adequacy and effectiveness of the AIMS. Clause 10.2 asks you to react to a nonconformity, find its cause, act, check the action worked, and keep records. The 2023 order is 10.1 Continual improvement, then 10.2 Nonconformity and corrective action, which some summaries reverse.
Common gap: management review minutes that skip required inputs, such as internal audit results, and corrective actions closed without a check that they worked.
Which ISO 42001 Clauses Require Documented Information?
ISO/IEC 42001 names required documented information in clauses 4 to 10. The table lists the records that published clause summaries identify as required; the free official preview shows clause text only up to 4.4, so confirm the exact wording in the licensed standard. A mature AIMS keeps more.
| Clause | Documented information required |
| 4.3 | AIMS scope |
| 5.2 | AI policy |
| 6.1.2, 6.1.3, 6.1.4 | AI risk assessment, risk treatment and impact assessment processes and results; Statement of Applicability |
| 6.2 | AI objectives |
| 7.2 | Evidence of competence |
| 7.5.1 | Documented information the organization decides it needs |
| 8.1 to 8.4 | Evidence that processes ran as planned; results of assessments and treatment in operation |
| 9.1 | Monitoring and measurement results |
| 9.2.2 | Audit program and audit results |
| 9.3.3 | Management review results |
| 10.2 | Nonconformities, actions taken and their results |
Source: harmonized structure core text (ISO/IEC Directives, Annex SL) applied by ISO/IEC 42001:2023; 4.3 confirmed in the official preview; AI-specific rows from published clause summaries.
How these records are packaged for Stage 1 and Stage 2 is covered in the documents and records behind an ISO 42001 audit. Will you write these records and defend them to an auditor? An ISO 42001 Lead Implementer course covering every clause from 4 to 10 works an AI register, impact assessment, risk register and Statement of Applicability end to end.
Frequently Asked Questions
How Many Clauses Are in ISO 42001?
ISO/IEC 42001:2023 has 10 clauses. Clauses 1 to 3 cover scope, the normative reference to ISO/IEC 22989 and terms and definitions, and they contain no requirements. Clauses 4 to 10 contain the requirements: context, leadership, planning, support, operation, performance evaluation and improvement. Four annexes follow; Annexes A and B are normative and Annexes C and D are informative, according to the official table of contents.
Which Clause in ISO 42001 Deals With Leadership?
Clause 5 deals with leadership. It has three sub-clauses: 5.1 Leadership and commitment, 5.2 AI policy, and 5.3 Roles, responsibilities and authorities. Top management must show commitment to the AI management system, establish an AI policy and assign responsibilities, including who makes sure the system conforms to ISO/IEC 42001 and who reports its performance to top management.
What Is the Focus of Clause 9 in ISO 42001?
Clause 9, Performance evaluation, checks whether the AI management system works. It has three parts: 9.1 Monitoring, measurement, analysis and evaluation; 9.2 Internal audit, including 9.2.2 Internal audit programme; and 9.3 Management review, with 9.3.2 Management review inputs and 9.3.3 Management review results. Each part leaves documented information an external auditor will sample during certification.
Are All ISO 42001 Clauses Mandatory?
Clauses 4 to 10 are mandatory for any organization claiming conformity with ISO/IEC 42001:2023, although a note to clause 4.1 says your AI roles can determine how far requirements apply. Clauses 1 to 3 set no requirements. Annex A controls work differently: each one is included or excluded through risk treatment, and every decision is justified in the Statement of Applicability (definition 3.26).
What Does ISO 42001 Clause 6.1.4 Require?
Clause 6.1.4 requires a process for assessing the potential consequences of AI systems for individuals, groups of individuals and societies. Definition 3.24 of ISO/IEC 42001:2023 calls the AI system impact assessment a formal, documented process for identifying, evaluating and addressing those impacts. Clause 8.4 then requires performing it in operation, including when significant changes occur.
