ISO 42001 requirements
The standard asks for an AI management system. Its requirements sit in Clauses 4 to 10, the same structure ISO uses across its management system standards.
ISO 42001 requires an AI management system: a documented, governed way of running the AI you develop and use, with the requirements in Clauses 4 to 10 and a set of reference controls in Annex A.
ISO/IEC 42001 is a management system standard, so it asks about how you govern AI across the organisation rather than about any single model (ISO/IEC 42001:2023). Because it shares the harmonised structure used by other ISO management system standards, an organisation with a working ISO 27001 system recognises most of its shape. This page names the clauses; it does not reproduce the standard's text, which is copyright.
What does ISO 42001 require?
It requires you to establish, run and improve an AI management system, with the requirements set out in Clauses 4 to 10 (ISO's ISO 42001 explainer). In plain terms: understand your context and the interested parties, show leadership and set policy, plan for AI risks and objectives, resource and support the work, operate the controls, evaluate how it is performing, and improve it.
The clauses and their names are:
- Clause 4 Context of the organisation
- Clause 5 Leadership
- Clause 6 Planning
- Clause 7 Support
- Clause 8 Operation
- Clause 9 Performance evaluation
- Clause 10 Improvement
What does an AI management system cover?
The scope you set, and within it the leadership, planning, support, operation, performance evaluation and improvement of how you govern AI. It is a whole-organisation system, so it reaches the roles, decisions and records around AI rather than the internals of a model.
Annex A adds a set of reference controls to consider, organised by theme. We name the annex and its role only, at a high level, and do not reproduce the control text.
How do Clauses 4 to 10 fit together?
They form the plan, do, check, improve cycle that runs through every ISO management system standard. Clauses 4 and 5 set the context and leadership, Clause 6 plans the risks and objectives, Clause 7 provides the support, Clause 8 operates the controls, Clause 9 evaluates performance, and Clause 10 drives improvement.
Reading them as a cycle rather than a checklist is the point: the system is meant to keep running and to change as your AI use changes, which is also what an audit looks for.
What do the requirements mean for a first implementation?
Treat the clauses as the structure to build against. Settle the scope, name who owns the AI management system, do the risk and impact work under Clause 6, get the operational controls into real use under Clause 8, and set the review cycle under Clauses 9 and 10.
The readiness check maps your current practice onto ten themes drawn from the clauses, so you can see where you already meet a requirement and where the gaps are. The blank gap sheet covers the same ground offline.