Implementation workflow
ISO/IEC 42001 — from foundation to continual improvement
A practical 10-step sequence for implementing an AI management system: build the foundation, assess risk and impact, select controls, implement Annex B-guided controls, then monitor and improve.
AIMS foundation and governance baseline
Understand context, AI roles and scope
Key output: AIMS scope, AI roles, interested parties, legal/context assumptions and process map.
Establish leadership, policy and authority
Key output: AI policy, RACI, approval authority, concern reporting and accountability model.
Set objectives, support and document control
Key output: AI objectives, resources, competence, awareness, communication and controlled documentation.
Risk-based design and control selection
Inventory AI systems and intended uses
Key output: AI system register, tool register, lifecycle stage, approved use and ownership.
Assess AI risks, opportunities and impacts
Key output: Risk criteria, risk/impact assessment, opportunity log and affected-party analysis.
Select controls, SoA and treatment plan
Key output: Statement of Applicability, treatment plan, residual risk decision and evidence plan.
Implement and operate selected controls
Implement lifecycle and data controls
Key output: Requirements, design, V&V, deployment, monitoring, event logs and dataset evidence.
Implement use, transparency and third-party controls
Key output: User information, human oversight, intended-use records and supplier/customer responsibilities.
Assurance and continual improvement loop
Monitor, audit and review effectiveness
Key output: Monitoring evidence, audit findings, management review decisions and updated risk evidence.
Correct, improve and update the AIMS
Key output: CAPA, lessons learned, improved controls and updated scope, policy, risk, SoA and lifecycle records.
Annex B
Annex B control guidance spine
Use Annex B to translate selected Annex A controls into practical implementation actions. Adapt to the organization scope, AI role, risk profile and use case.
Outputs become controlled documented information and audit evidence.
- B.2AI policies
- B.3Internal organization
- B.4AI resources
- B.5Impact assessment
- B.6AI system lifecycle
- B.7Data for AI systems
- B.8Information for interested parties
- B.9Use of AI systems
- B.10Third-party/customer relationships
Event-driven trigger
New AI use case, significant change, incident, monitoring breach, supplier change, or new legal/customer requirement — return to risk, impact, SoA and control implementation steps.
This visual summarizes the implementation workflow using clause/control references only. It does not reproduce ISO/IEC 42001 protected requirement text.
Want to implement this workflow with ready-made templates?
Every output above maps to a Word policy or Excel sheet inside the package.