ISO/IEC 42001 Artifacts

ISO/IEC 42001 sets out what an organisation must have in place to run an Artificial Intelligence Management System (AIMS): the governance covering the AI systems it builds or uses, and the ownership, scope and review that keep that governance honest. This is everything an AIMS needs under the names the standard gives them.

Some of these are management-system objects the standard adds; others are artifacts it shares with Gemara under a different name. AI Risk is the Risk catalogue, AI Policy is Policy. Two terms can also land on one artifact: Interested Party and Affected Party are both roles in the Party Register.

How the artifacts connect

Context frames the scope, the AI systems in scope are assessed for impact and then risk, the Statement of Applicability selects the controls policy imports, and reviews and incidents raise corrective action.

ISO/IEC 42001 artifacts by layer

1DefineWhat good looks like

Organisation ContextStakeholder RequirementAIMS ScopeManagement Objective

2AssessWhat could go wrong and what would stop it

Applicability ProfileAI Control

3DecideWhat we accept and what we require

AI RiskRisk AssessmentImpact AssessmentAI Policy

4OperateThe activity and resources being governed

AI SystemDatasetTool ResourceIncident

5EvaluateWhether the requirements are met

Management Review

6EnforceWhat happens when they are not

Corrective Action

7AssureEvidence the whole thing works

Audit ProgrammeReporting Obligation

Cross-cuttingReferenced from every band

Interested PartyAffected PartyCompetence RecordCommunication RequirementSupplier AssuranceGovernance Contract

Clause-by-clause and Annex A coverage are in the ISO/IEC 42001 analysis, and the structure is encoded as Gemara guidance in the guidance catalog.

For the ISMS view of the same set, see ISO/IEC 27001.