ISO 42001 AI Management System Checklist Template

The first task records the certification stage and names the two people who sign off the year.

• Open the cycle and name the AIMS owner and top management sponsor — record whether you are seeking certification, and at which stage
• List the internal and external issues that shape our use of AI (4.1) — AI strategy, customer contracts that ask for certification, ethics commitments, and laws such as the EU AI Act
• Record our role for each AI system (4.1) — AI provider, producer, customer or partner in ISO/IEC 22989 terms; many organisations hold more than one
• Identify interested parties and the requirements we will meet (4.2) — customers, users, regulators, suppliers and the people an AI system affects
• Set the AIMS scope and justify each exclusion (4.3) — systems, units and sites in scope; leaving out the riskiest system will be questioned at stage 1

Clauses 5 and 7, with the Annex A areas on policy, internal organisation and resources.

• Approve or refresh the AI policy (5.2, A.2) — suited to the organisation’s purpose, framing the AI objectives and aligned with other policies (A.2.3)
• Assign AIMS roles, responsibilities and authorities (5.3, A.3.2) — who accepts AI risk, signs off impact assessments, releases a model and reports incidents
• Set up a route for reporting concerns about AI systems (A.3.3) — with an owner, a way to escalate and protection for the person who reports
• Document the resources and skills each AI system relies on (7.1–7.3, A.4) — data, tooling, computing and people; keep training records for each role
• Agree communication and document control for the AIMS (7.4, 7.5) — what is said to whom and when; key documents versioned and approved

The last task is an approval: the AIMS owner accepts the residual risks before the controls are rolled out.

• Define the AI risk criteria and assessment method (6.1.2) — likelihood and consequence scales and acceptance thresholds, set before scoring
• Identify, analyse and evaluate the AI risks for each system in scope — data quality, opacity, level of automation, model drift, misuse and dependence on suppliers
• Run an AI system impact assessment for each system (6.1.4, A.5) — consequences for individuals, groups of individuals and society, documented and fed into the risk assessment
• Choose treatment options and the controls they need (6.1.3) — then compare your controls with all 38 in Annex A so nothing necessary is missed
• Produce the Statement of Applicability — each control included or excluded, with the justification and its implementation status
• AIMS owner approves the treatment plan and accepts residual risks — every risk has a named owner; the decision is recorded as Approved or Not approved

Reassess any system that changes significantly, not only at the annual review.

• Set measurable AI objectives with owners and dates (6.2) — what, with what resources, by whom, by when and how results are evaluated
• Plan changes to the AIMS before making them (6.3) — a new AI use, a reorganisation or a new supplier goes through the cycle, not around it
• Apply the life cycle and data controls to each AI system (8.1, A.6, A.7) — verification and validation, deployment, monitoring, event logs, and data quality and provenance
• Tell users and other interested parties what they need to know (A.8, A.9) — user documentation, incident communication and each system’s intended use
• Allocate responsibilities with suppliers and customers (A.10) — third-party models, data and APIs, and what customers are told
• Re-run the risk and impact assessments on significant change (8.2–8.4) — a new model version, new training data, a new purpose or a new group of people affected

The management review is an approval assigned to the top management sponsor named in Phase 1.

• Monitor and measure how the AIMS performs (9.1) — what is measured, when and by whom: objectives, incidents, concerns and control results
• Plan the internal audit programme (9.2.2) — frequency, methods and responsibilities, weighted by risk and by the results of earlier audits
• Audit clauses 4 to 10 and a sample of the applicable controls (9.2.1) — auditors independent of the work, results reported to the managers responsible
• Prepare the management review inputs (9.3.2) — earlier actions, changed issues, nonconformity trends, monitoring and audit results
• Top management holds the management review and records decisions (9.3.3) — on improvements, changes and resources; approval by the top management sponsor

Open actions carry into next year’s checklist, which starts on an annual schedule.

• Log every nonconformity with its source (10.2) — audit findings, incidents, missed objectives, complaints and concerns raised under A.3.3
• Contain it, find the root cause and look for similar cases — a biased output from one model may trace to a data practice shared by several
• Agree corrective actions with owners and due dates — and update the risk register, impact assessment or Statement of Applicability where the cause lies there
• Verify each corrective action worked before closing it — re-test the control and attach the evidence to the finding
• Record improvements and schedule the next cycle (10.1) — carry open actions forward and set dates for next year’s audit and review

Shown only when you are seeking certification; the stage on the first task decides which audit tasks appear.

• Confirm the certification body’s accreditation covers ISO/IEC 42001 — check the scope on the register of ANAB, UKAS or another accreditation body
• Complete an internal audit and management review before stage 2 — certification bodies expect at least one of each covering the scope
• Stage 1: send the documented AIMS and close the gaps it finds — scope, policy, assessment methods, Statement of Applicability and audit records
• Stage 2: support the audit of the AIMS in operation — auditors sample controls and follow the records from risk to evidence
• Surveillance: prepare the evidence for this year’s visit — audit and review records, objectives, incidents, changes and earlier findings
• Recertification: prepare for the full reassessment in year three — reviewing performance across the whole three-year cycle
• Answer findings with a corrective action plan — a major nonconformity holds up the certificate until the certification body has checked the fix