ISO/IEC 42001
Who it binds
The 2 roles that carry a duty under ISO/IEC 42001, and the provisions that fall on each. A duty follows the capacity you are acting in, which is not always the one you think of yourself as occupying.
§ 1 — How to read this
One organisation frequently occupies more than one of these roles at once, and the duties are owed separately for each. The roles below are kept distinct because the instruments keep them distinct: where two look alike, the sentence explaining the difference is the reason both are listed. Counts are of obligations in this collection only.
§ 2 — By role
The duty, by capacity
Audited organisations
9 obligations
The organisation being audited — the party that must produce the evidence, whoever built the system.
- Annex A and Annex B — Reference control objectives and controls · Implementation guidance for AI controls
- Clause 4.1 — Understanding the organization and its context
- Clause 4.3 — Determining the scope of the AI management system
- Clause 5.2 — AI policy
- Clause 5.3 — Roles, responsibilities and authorities
- Clause 6.1.2 — AI risk assessment
- Clause 7.2 — Competence
- Clause 8.4 — AI system impact assessment
- Clause 9.2, with 9.2.1 and 9.2.2 — Internal audit · General · Internal audit programme
Certification bodies
One obligation
A body auditing and certifying a management system, bound by the competence and impartiality requirements that let its certificate mean anything.
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.