How is ISO 42001 Structured?

ISO 42001 follows the ‘Harmonised Structure’ common to many other ISO management system standards, including ISO 27001 and ISO 9001.  While the core requirements are set out in the familiar Clauses 4-10, each clause (with the exception of Clauses 7 and 10) contain elements that reflect the unique considerations of AI management.

The mandatory management system clauses are followed by four annexes:

• Annex A, much like Annex A of ISO 27001, contains a set of reference controls that are not compulsory but can be implemented based on their applicability to your organisation.  It should be noted that, as with ISO 27001,  organisations can define their own set of controls and still achieve certification to ISO 42001.
• Annex B contains the implementation guidance for the controls listed in Annex A, and is, therefore, comparable to ISO 27002 (the supporting standard to ISO 27001).
• Annex C provides guidance on organisational objectives and risk sources
• Annex D outlines guidance on the use of AIMS’ across different domains or sectors.