Map AI use and scope
Identify the AI activities for which your organisation is a provider, developer or user. Define the management-system boundary, intended uses, affected parties and accountable owners.
ISO 42001 readiness
Make AI oversight visible.
Identify who owns the risks of your AI systems, how decisions are recorded and which evidence supports your AI management system.
Who can approve an AI pilot?
A service desk wants an AI assistant to summarise customer tickets. Record the intended use before agreeing whether the pilot should run.
Illustrative AI decision record
- Use and impact
- The service owner identifies the data the supplier would receive and who could be affected by an incorrect summary.
- Oversight
- Record the authorised approver and the checks staff will make before using a summary.
- Review point
- Set a date to review pilot results. Bring a comparable decision and the inventory of AI uses to the assessment.
Engagement scope
Define the management system
Assign accountability
Identify decision owners, interested parties, oversight arrangements and the information needed to evaluate risk and impact.
Prepare for independent assessment
Bring policies, impact and risk assessments, oversight decisions and management reviews. Certification concerns the scoped AI management system; it does not certify the safety of an individual model or determine legal compliance.
Where does your organisation develop, buy or use AI?
Discuss AI governance ↗