ISO 42001 · Basic · 12 min lesson

Operation, performance, improvement and Annexes - running, auditing and certifying an AIMS

ISO/IEC 42001:2023 - clauses 8 to 10, Annexes A and B, certification, EU AI Act and medical devices

What you will learn

Describe what clause 8 requires for operational control, AI risk assessment, treatment and impact assessment, and how the AI system lifecycle, data and third party controls of Annex A support it.
Explain the structure and purpose of Annex A controls and Annex B guidance, and what clauses 9.1 to 9.3 and 10.1 to 10.2 require for monitoring, internal audit, management review and nonconformity.
Explain how certification works and how it relates to the EU AI Act, MDR and FDA requirements as of 2026.

Key takeaways

Clause 8 puts the plans of clause 6 into practice: operational control, repeated risk assessment, treatment and impact assessment.
Annex A holds reference controls in nine topic groups, covering policies, roles, resources, impact assessment, lifecycle, data, information, use and third parties; Annex B gives implementation guidance.
Clauses 9.1 to 9.3 require monitoring, a planned internal audit programme and a management review; clauses 10.1 and 10.2 require improvement and corrective action.
Certification is by an accredited body in stages with surveillance; the certificate covers only the stated scope.
As of 2026 ISO/IEC 42001 gives no presumption of EU AI Act conformity, and it does not replace MDR or FDA requirements; verify the current legal position.

Free practice question

Meridian Rhythm Software retrains its model monthly but repeats the impact assessment only at the annual review. Last month the retraining data included a new hospital group.

What does clause 8.4 imply?

Nothing, since annual review is sufficient.

Not quite. Clause 8.4 with 6.1.4 includes change-driven assessment, so annual timing alone is inadequate.

Perform the impact assessment on significant change, not only annually, and keep the results.

Correct. Clause 8.4 requires impact assessment according to the defined process, and clause 6.1.4 triggers it on significant change.

Delete earlier assessments to avoid confusion.

Not quite. Clause 8.4 requires results to be kept as documented information. Checking the matching clause of ISO/IEC 42001 confirms this reading.

Do the assessment after patients complain.

Not quite. Waiting for complaints makes it reactive; clause 8.4 expects planned and change-based assessment.

Key terms

Annex A: Normative list of reference controls, organised in topic groups, that the organisation compares with its own controls under clause 6.1.3.
Annex B: Implementation guidance for the Annex A controls.
AI system lifecycle: The stages of an AI system from design and development through verification, deployment, operation, monitoring and retirement.
internal audit: Planned, impartial audit of the AIMS by the organisation itself, required by clause 9.2.
management review: Planned review of the AIMS by top management, required by clause 9.3.
nonconformity: Failure to meet a requirement, followed by correction and corrective action under clause 10.2.

Official sources

Go further

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Open the Academy Watch on YouTube

Illustrative example. Educational only, not legal advice.