ISO 42001 documentation: what you actually need

A reference on documented information for an AI management system.

Documents you must maintain

• The scope of the AI management system
• The AI policy
• AI objectives
• The organisation's role or roles in relation to AI systems
• The AI risk assessment process and criteria
• The AI risk treatment process
• The AI system impact assessment process
• The statement of applicability, recording which controls apply and justifying exclusions
• Information necessary for the effectiveness of the system

Records you must retain

• The AI system inventory
• Results of AI risk assessment and treatment
• Results of AI system impact assessments
• Evidence of competence
• Records of the AI system lifecycle: objectives, data, design, verification and validation, deployment, operation and retirement
• Data governance records including provenance and quality
• Records of human oversight arrangements and their operation
• Monitoring records for AI systems in operation
• Supplier and third party assessment records
• Records of incidents involving AI systems and their handling
• Internal audit programme and results
• Management review results
• Nonconformities and corrective actions

The AI system inventory

The foundation document. For each AI system:

• What it is and what it does
• Its purpose and the decisions it affects
• Your role in relation to it: developer, provider, user, or a combination
• Whether it was built internally, purchased, or embedded in a purchased product
• The data it was developed with and the data it uses in operation
• Who is affected by its outputs
• The human oversight arrangement
• The owner
• Its lifecycle stage

Include AI embedded in purchased tools. This is the most common gap and the first thing an auditor probes.

The AI system impact assessment

Distinct from the risk assessment and examined more closely.

The risk assessment considers risk to the organisation. The impact assessment considers potential consequences for individuals, for groups, and for society.

For each system it should address, where relevant: fairness and potential for discriminatory outcomes, safety, privacy, transparency and explainability, accessibility, the potential for harm from error, and effects on people who are not your customers.

Record who performed it and on what basis. Auditors ask.

Practical guidance

Keep the inventory current through procurement and project processes, not through periodic surveys. AI enters organisations continuously.

Record human oversight in operable terms. Who, with what information, in what timeframe, with what authority to override. Oversight described as reviewed by a human is not a control description.

Document data provenance for systems you develop, and require it from suppliers for systems you buy.

Post-deployment monitoring provides an important mechanism for detecting changes in AI-system performance, data characteristics, emerging risks, incidents and other unintended outcomes

Record incidents including near misses, where an AI system produced a wrong output that was caught before it caused harm.

Common findings

1. Inventory missing AI embedded in purchased tools
2. Impact assessment written from the organisation's perspective rather than the affected person's
3. Role not determined per system
4. Human oversight declared but not operable in practice
5. Data provenance unknown for systems in use
6. No monitoring after deployment
7. Third party models excluded from scope
8. Statement of applicability with generic exclusion justifications

---

---