Clause 6.1.2
Risk assessment
What could go wrong for the organisation, whether regulatory, reputational, operational, security or financial, and how likely and severe would it be?
The standard
What ISO/IEC 42001 is
Published in December 2023, ISO/IEC 42001:2023 is the world's first certifiable AI Management System standard. It takes a risk-based approach to AI Governance and follows the same High-Level Structure as the management systems you may already run, so it builds on what you have.
4–10
It builds on your existing registers
If you hold ISO 9001 or ISO/IEC 27001, you already have a risk register, document control, an internal audit programme and a management review. 42001 extends them to AI rather than duplicating them.
It treats AI risk on its own terms
It adds what no other standard covers: the AI System Impact Assessment, data quality and bias management, controls across the model lifecycle, and explainability requirements. Current risks are structured, and future ones are looked for deliberately.
One structure, shared across the family
- ISO 9001Quality management
- ISO/IEC 27001Information security
- ISO/IEC 27701Privacy information
- ISO/IEC 42001AI Management System
Shared
4–10
High-Level Structure clauses
Five ways AI creates new or amplified risk
Your ISO 9001, 27001 and 27701 controls still apply to AI, but these five areas need extra attention.
- Reliability – AI predicts rather than calculates, so it can be confidently wrong, handle one task well yet fail at a similar one and lose accuracy over time unless monitored.
- Fairness – Most AI learns from past data rather than rules people have written, so gaps or historic bias in that data can lead it to treat some people unfairly.
- Security – Beyond familiar cyber threats, AI can be poisoned through its training data, tricked by crafted prompts or inputs, or probed to reveal the model or personal data it learned from.
- Accountability – AI cannot always explain its reasoning, especially when bought in, and people may trust fluent answers or let AI agents act unchecked, yet your organisation remains responsible for the outcome.
- Impact – AI repeats each judgement at speed and scale, so a single flaw can harm many people at once, and it brings wider costs from deepfakes to energy use.
Clause 6.1.4 / Annex B
AI System Impact Assessment
What is the real-world footprint on the people it affects: human rights, fairness, safety, privacy, and environmental and societal effects? Both are required. Risk is the forecast. Impact is the footprint.
Why certify
Why ISO/IEC 42001?
Boards sign this off for 4 reasons. Each one turns into evidence you can hand to whoever is asking.
-
01
Risk reduction
Proportionate controls for the risks AI creates, such as bias, privacy, security and safety, so failures are less frequent, less severe and cheaper when they do happen.
-
02
Shareholder trust
A certificate from an accredited body is a statement your board, investors and insurers can rely on. Governed AI reads as a lower risk profile, because it is one.
-
03
Procurement
Customers, partners and procurement teams increasingly ask how you govern AI. A certificate from an accredited body answers in one document.
-
04
Legal compliance
Already law in the EU under the AI Act, and developing in the UK through existing regulators. A management system means the rules land on a structure that is ready for them.