ISO 42001 -Artificial Intelligence Management System (AIMS) — Part 3— Clause 7 & 8

May 3, 2025

Hello everyone! Welcome back to part 3 of our multi-part blog series exploring ISO 42001:2023, the Artificial Intelligence Management System (AIMS) standard. Today, we’re diving into Clause 7: Support and Clause 8: Operations. If you haven’t had a chance yet, catch up on the earlier parts here is Part 1 — Introduction and Clause 4, and Part 2 — Clause 5 & 6.

After a more intense Part 2, this installment will be relatively straightforward as we build upon the groundwork laid in the previous clauses. So, let’s jump right in! In this section, we will examine how this clause distinguishes itself from other ISO clauses, and we’ll also explore practical examples using our AI-powered medical diagnosis support system.

Clause 7 — Support

Clause 7.1- Resources — ISO 42001 Distinctions:

At a high level, this clause focuses on providing the appropriate level of resources. The detailed controls required are outlined in A.4 — Resources for AI system and include supplying computing resources, supporting AI-specific activities such as model training, testing, and validation, ensuring ongoing monitoring of AI systems in production, and allocating resources for managing training data quality and representativeness.

For our AI-powered medical diagnosis support system, this can translate into resources for specialized GPUs for model training, infrastructure, expert human resources, etc.

7.2 Competence

This ISO 42001 clause specifically references control A.4.6 — Human resources for controls and emphasizes the critical importance of domain expertise relevant to the AI application areas.

In our AI-powered company, this means actively hiring AI experts and implementing specialized training programs. These programs would equip radiologists with the necessary understanding of the AI’s capabilities and limitations, and enable data scientists to grasp clinical contexts and patient safety implications.

7.3 Awareness — Key Differences

This clause aligns with the awareness requirements of other management standards. The key distinction here is the specific requirement for general awareness of the AI management system’s policies and objectives, understanding of individual contributions to its effectiveness, and the potential consequences of not adhering to its requirements. Typically, awareness training is integrated into new hire onboarding and reinforced at regular intervals (often annually).

7.4 Communication — Key Differences

Similar to the communication requirements found in all ISO standards, this clause mandates defining what information needs to be communicated, when, with whom, and through which channels regarding the management system. For our AI-powered medical diagnosis support system, this might look like:

Communication Plan Example

7.5 Documented Information

The requirements for this clause are consistent with other ISO standards. It necessitates the documentation of the management system and its associated processes. The table below provides a comprehensive overview of the mandatory documented information for each clause of ISO 42001. These represent the essential documents and records required for compliance with the standard, excluding the additional requirements from Annex A controls.

List of ISO 42001 documented information

Clause 8 — Operations

Think of this as the “Do” stage in the Plan-Do-Check-Act (PDCA) cycle. It details how to implement and control AI-related processes to achieve the intended outcomes of the AIMS. Essentially, this clause focuses on putting the AI Management System (AIMS) into action. It works in close conjunction with Clause 6 (Planning) and builds upon the foundational elements established in the earlier clauses. Careful attention is necessary to ensure that the implementation seamlessly integrates with existing business processes for the AIMS to be truly successful. The most efficient approach involves an integrated implementation of all relevant standards and frameworks, extending beyond just ISO standards to include frameworks like PCI-DSS or HIPAA, where applicable.

Clause 8.1 — Operational Planning and Control

8.1 Operational Planning and Control

This sub-clause centers on establishing the necessary processes for the effective operation of the AIMS. It requires the organization to:

  • Plan, implement, and control the processes needed to meet the requirements defined in Clause 6 (Planning)
  • Establish operating criteria for these processes. This means defining how the processes will be carried out to ensure they are effective and consistent with the AI policy and objectives.
  • Control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects.
  • Ensure that outsourced processes are controlled. If the organization relies on external providers for any AI-related activities, it must ensure these processes are managed and controlled to meet the requirements of the AIMS.

8.2 AI Risk Assessment

Building upon the risk management principles established in Clause 6, this sub-clause focuses specifically on assessing risks related to AI systems. The organization needs to conduct AI risk assessments at planned intervals or when significant changes occur. This ensures that risks are regularly reviewed and updated to reflect the evolving nature of AI and the organization’s context. Clause 8.2 underscores the importance of a systematic and ongoing process for identifying and understanding the specific risks associated with the development, deployment, and use of AI systems.

8.3 AI Risk Treatment

Once AI risks have been thoroughly assessed, Clause 8.3 mandates that the organization determine and implement specific actions to effectively address those risks, strictly following the risk treatment process meticulously defined in Clause 6.1.3 AI Risk Treatment. This is where the risk treatment plan is put into action. Furthermore, this sub-clause emphasizes the critical importance of regularly reviewing the effectiveness of these implemented plans and making necessary updates if they are not achieving the desired outcomes, thereby reinforcing the crucial continual improvement aspect inherent in the management standard.

For our AI-powered medical diagnosis support system, risk assessment and treatment might look like:

Risk Assessment and Treatment Example

8.4 AI System Impact Assessment

This sub-clause focuses on actively implementing (i.e., conducting) the AI system impact assessment at regular intervals, precisely as defined in 6.1.4 — AI System Impact Assessment. Clause 8.4 highlights the essential need to look beyond immediate risks and carefully consider the broader, potentially far-reaching consequences of AI systems, thereby ensuring their responsible and ethical deployment.

For our AI-powered medical diagnosis support system, system impact assessment might look like:

AI System Impact Assessment Example

In summary, Clause 8 of ISO 42001 serves as the operational heart of the AIMS.

Hopefully, you’re now getting a solid grasp of ISO 42001! We’re nearing the end of our journey through the clauses. In our next blog post, we will delve into the final two clauses: Clause 9 — Performance evaluation and Clause 10 — Continual improvement, and then finally the Annex A controls. Stay tuned!

References

Disclaimer

The content provided in this blog series is for informational purposes only and does not constitute legal, regulatory, or professional advice. While every effort has been made to ensure accuracy, readers are encouraged to consult the official ISO 42001 standard and relevant regulatory or industry experts for specific guidance. The views expressed are those of the author and do not necessarily reflect the opinions of any affiliated organizations.