ISO 42001 self-assessment (AI governance)

The scope of the AI management system is defined: which AI systems the company develops, provides or uses, and in which role (provider, user, producer). 4.3

There is an AI policy approved by management, aligned with other policies (security, privacy, quality) and reviewed periodically. A.2.2

Each AI system has defined owners: who approves it, who operates it and who answers if it fails. A.3.2

Employees and third parties have a channel to report concerns about AI behavior, and those reports are handled. A.3.3

Internal audits of the AI management system are performed and management reviews the results. 9.2

There is a documented method to assess AI risks (bias, errors, security, privacy) with acceptance criteria. 6.1.2

Identified risks have a defined treatment and a statement of applicability of the Annex A controls. 6.1.3

Before an AI system goes live, its impact on affected individuals and groups is assessed and documented. A.5.2

There are measurable AI objectives (accuracy, fairness, availability, complaints) and they are tracked. 6.2

The resources of each AI system are documented: data, tooling, infrastructure and people with the required competence. A.4.2

The requirements of each AI system (what it must and must not do, limits) are defined before building or buying it. A.6.2.2

Models are verified and validated before going to production against defined criteria (accuracy, bias and security tests). A.6.2.4

AI systems in production are monitored (drift, errors, misuse) and event logs are kept. A.6.2.6

It is known which data is used to train, tune or feed each AI system, and under what authorization (privacy law if personal). A.7.2

There are data quality criteria (completeness, representativeness, errors) and they are checked. A.7.4

Data provenance is recorded: where it came from, when it was obtained and how it was transformed. A.7.5

Users receive clear information about the AI system: what it does, its limits and when a person steps in. A.8.2

There is a procedure to communicate AI incidents to users, customers and authorities when required. A.8.4

There are rules for responsible AI use inside the company (approved tools, forbidden data, human review). A.9.2

Each AI system is used only for its intended purpose, and a change of use goes through a new assessment. A.9.4

AI suppliers (models, APIs, platforms) are assessed and their contracts cover data, security and responsibilities. A.10.3

When the company provides AI to its customers, it communicates their responsibilities and the intended use. A.10.4