ISO 42001 · Basic · 12 min lesson

Planning and support - AI risk, AI system impact, objectives, competence and documented information

ISO/IEC 42001:2023 - clauses 6 and 7, with ISO/IEC 23894

What you will learn

Describe the AI risk assessment and risk treatment steps of clauses 6.1.2 and 6.1.3, including the statement of applicability, and how ISO/IEC 23894 supports them.
Explain how the AI system impact assessment of clause 6.1.4 differs from risk assessment and give a medical-device example.
State what clauses 6.2, 6.3 and 7.1 to 7.5 require for AI objectives, planning of changes, resources, competence, awareness, communication and documented information.

Key takeaways

Clause 6.1.2 asks for a repeatable AI risk assessment with defined criteria; clause 6.1.3 treats risks and produces a statement of applicability.
Clause 6.1.4 adds an AI system impact assessment that looks at effects on individuals, groups and society, not only on the company.
ISO/IEC 23894 gives guidance on AI risk management and supports, but does not replace, the requirements of clause 6.
Clause 6.2 AI objectives must be measurable where practicable, monitored, communicated and updated; clause 6.3 plans changes to the AIMS.
Clause 7 needs resources, competence, awareness, communication and controlled documented information, including for data and AI system records.

Free practice question

Quillon Derm AI keeps a risk register that lists only outages, breaches and recalls. A clinic reports lower detection on darker skin, which the register does not mention.

Which clause points to the missing process?

Clause 7.3, because staff awareness is the real issue.

Not quite. Clause 7.3 covers awareness of the policy, not assessment of consequences for patient groups.

Clause 6.1.4, because an AI system impact assessment must consider consequences for individuals and groups.

Correct. Clause 6.1.4 requires assessing consequences for individuals, groups and society, which the register ignores.

Clause 10.1, because the company must simply improve.

Not quite. Clause 10.1 is general improvement and does not identify the missing assessment process.

Clause 4.3, because the scope was written wrongly.

Not quite. Clause 4.3 concerns scope boundaries; the described gap is an absent impact assessment.

Key terms

AI risk assessment: Process under clause 6.1.2 to identify, analyse and evaluate risks linked to AI systems against defined criteria.
AI system impact assessment: Process under clause 6.1.4 to assess consequences of an AI system for individuals, groups and society.
statement of applicability: Document from clause 6.1.3 listing necessary controls, whether implemented, and why any Annex A control is excluded.
AI objective: Measurable result the organisation sets for its AI activity under clause 6.2, consistent with the AI policy.
competence: Demonstrated ability, from education, training or experience, to do the work that affects AIMS performance.
documented information: Information the organisation must control and maintain, such as policies, procedures and records.

Official sources

Go further

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Open the Academy Watch on YouTube

Illustrative example. Educational only, not legal advice.