ISO/IEC 42001
Clause 7.2 — Competence
Clause 7.2 asks four things in order: what competence the work actually needs, whether the people doing it have it, what action closes a gap, and whether that action worked. The last is the one almost nobody evidences. Awareness is a different clause, and a course completion is a record of attendance rather than of competence.
§ 1 — Who it binds
Whose competence, and for what work
Audited organisationCertification body
Any organisation operating an AI management system to ISO/IEC 42001, for every person whose work under its control bears on how that system performs — contracted staff included, and a supplier’s personnel where the organisation depends on them. A certification body assessing an AIMS meets a parallel requirement for its own assessors, which is stated in ISO/IEC 42006 rather than here.
§ 2 — In practice
Determined, evidenced, then tested
The clause reaches persons doing work under the organisation’s control whose work bears on how the management system performs, which is a wider population than the AI team and a narrower one than everybody. A procurement officer settling the terms on which a model is bought, a claims handler operating the oversight step, a supplier’s engineer running the pipeline under contract — all three bear on it, and none of them appears on a typical matrix. Meanwhile the awareness duty sitting beside this one at clause 7.3 is a separate obligation with a separate population, and the confusion between the two is why so many organisations answer a competence question with a training completion rate.
Competence rests on education, training or experience — three routes, and the third is what AI work most often actually runs on, since the people who can tell a validation split from a deployment population usually learned it by doing. That sharpens the evidencing problem rather than easing it: experience becomes evidence only when someone has written down what it demonstrated. A defensible matrix therefore states, per role, what the holder must be able to do — judge whether a threshold was set or inherited, read a supplier’s evaluation report sceptically, decide when an impact assessment needs redoing — because a criterion phrased as a subject area is met by having heard of it. The same reasoning governs who may audit the system, where an independence question is attached to the same determination.
Where competence is lacking the clause asks for action, and then for an evaluation of whether the action was effective. Two steps, and the second leaves no trace: a course is commissioned, the gap is declared closed, and what changed in anybody’s work goes unrecorded. Effectiveness is not a feeling — it is a later assessment against the criterion the gap was found on, or work product reviewed by somebody able to judge it. The body assessing the management system carries a parallel duty about its own people, since ISO/IEC 42006 states requirements for the competence of certification personnel. That is why this is one of the few places in the standard where the same question is put to both sides of an assessment.
§ 3 — What a weak answer looks like
A completion rate is not a competence file
The completion rate reported as competence. Ninety-four per cent of staff finished the AI module, the figure reaches the governance forum every quarter, and no document anywhere states what any role in the management system was required to be able to do. The tell is that the same slide would work unchanged for an information-security module or a fire-safety one, because it measures a training programme rather than the work. This clause asks about the work first and the people second.
§ 4 — What discharges it
What the competence file has to hold
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
A competence determination made before people are assigned
What each AIMS role must be able to do, written as demonstrable actions rather than as technologies somebody should be familiar with. Written after the team was chosen, it records who was available rather than what was needed.
02
Per-person evidence against the stated criteria
Education, training or experience mapped criterion by criterion, with what the experience demonstrated and who judged it. Attendance at a session evidences that the session took place.
03
An effectiveness evaluation for every action taken to close a gap
A later assessment against the criterion the shortfall was found on, dated after the action. A completion certificate closes an administrative loop and answers nothing this clause puts.
04
A reassessment interval with evidence it was applied
Capability here decays against a moving subject: a matrix set two model generations ago describes work nobody now does. The artefact is the date of the last reassessment, not the policy saying one happens.
§ 5 — Worked example
Worked example — a certified team and an unwritten role
A medical devices manufacturer operating an AIMS staffs its AI governance function with three people: a quality manager who has held ISO 13485 responsibilities for a decade, a regulatory affairs specialist, and a data scientist recruited internally from the modelling team. All three completed a two-day AI governance course before the management system went live. The competence file holds their CVs, the three certificates, and a role description for each post.
What is missing, given that the file looks complete?
The step before all of it. Nothing states what these three posts must be able to do, so the CVs and certificates stand as evidence against no criterion, and the file cannot answer the question an assessor will ask first: how do you know these are the right people? Two things follow from that absence. The data scientist recruited from the modelling team is both the strongest capability in the room and an independence problem, because part of what the management system oversees is work that person did — and with no role criteria, nothing existed that would have surfaced the tension. And the two-day course was an action taken before any shortfall had been identified, so the effectiveness evaluation the clause wants has nothing to be evaluated against. Writing the criteria is a morning’s work, and it changes what every other document in the file means.
§ 6 — Elsewhere
The same question on the assessing side
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
ISO 19011 clause 7 asks an audit function to determine, set criteria for, and evaluate the competence its engagements need. Clause 7.2 puts those three steps on the organisation operating the system rather than on the function reviewing it.
ISO/IEC 42006 states requirements for bodies certifying AI management systems, including the competence of the personnel they deploy. It is the reason this duty reaches two parties rather than one.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 7 — When it applies
Which editions these are
31 December 2023
BSI published BS ISO/IEC 42001:2023, its adoption of the first edition, on this date. An edition date only: the standard is voluntary and nothing is due on it.
31 March 2026
BS EN ISO/IEC 42001:2026, the European and UK adoption, published on this date with no technical differences recorded by BSI. Also an edition date, not a compliance deadline.
§ 8 — provenance
The provision itself
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
- ISO/IEC 42001:2023 — clause 7.2 Competence, with clause 7.3 Awareness alongside it, from the official Contents in the free document preview. No requirement text is reproduced.
- BSI Knowledge product record for BS ISO/IEC 42001:2023 — published 31 December 2023, status Current.
- BSI Knowledge product record for BS EN ISO/IEC 42001:2026 — published 31 March 2026, described by BSI as carrying no technical differences.
- NIST-hosted crosswalk attributed to Microsoft, which maps GOVERN 2.1, GOVERN 2.2 and GOVERN 3.2 onto clause 7.2. A contributed document written against the FDIS, not NIST guidance.
§ 9 — Also read
Also read
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.