ISO 42001 implementation clause by clause - audit evidence captured continuously, not reconstructed.

ISO 42001 is structured around the standard ISO management-system template (clauses 4-10) plus Annex A operational controls. The work falls into roughly six operational areas:

• Clause 4.3 - Scope. Define the boundaries of the AI management system: which AI systems, which business units, which lifecycle stages. Most programmes underscope (only customer-facing AI) and have to expand later when auditors press on internal AI use.

  
  

• Clause 6.1.3 - Risk treatment. AI-specific risk assessment + treatment plans, with documented decisions about which risks to mitigate, accept, transfer, or avoid. Closely paired with clause 6.1.2 risk assessment and Annex A.5 controls.

  
  

• Clause 7 - Support (resources, competence, awareness, communication, documented information). The operational backbone - who's responsible, what they're trained on, how AI-related communications flow, how documentation is controlled.

  
  

• Clause 8.3 - Operational planning and control. How AI development, deployment, and monitoring actually run - change control, configuration management, versioning, deployment gates.

  
  

• Clause 9 - Performance evaluation (monitoring, internal audit, management review). Continuous monitoring of AI system performance against AIMS objectives, internal audits on a defined cadence, management reviews that close the loop.

  
  

• Annex A - Operational controls catalogue. The granular control set - A.5 risk management, A.6 risk treatment, A.7 impact assessment, A.8 third-party use, A.9 data quality, others. The controls map to specific operational practices.