01 · 2016–2021
AI governance accelerates
Rapid deployment and public concern shifted attention from model performance to organisational accountability and lifecycle effects.
ASSURANCE DNA · AI MANAGEMENT SYSTEMS
ISO/IEC 42001
A management system for governing how organisations develop, provide or use AI, including impact, risk, data, lifecycle control, transparency and improvement.
Who remains accountable when an AI-enabled service changes a human, operational or public outcome?
REFERENCEISO/IEC 42001:2023CURRENT STATE · 21 AUG 2026Published as the first international AI management-system standard.BID ENTRYSense · Qualify · Model · Story · Evidence · Comply · Review · Measure
It cannot certify an individual AI output as accurate, fair or lawful. The use case, affected people, data and operating evidence remain decisive. Source-bounded interpretation: no certification, protected text reproduction or award prediction.
LIVING EXPERIMENT · THEATRE
The Three-Chair Accountability Theatre
System owner, affected person and independent challenger occupy three chairs. The stage destabilises when an impact, decision right or evidence route has no chair.
MODEL STATESME · SENSE · APPLYDeterministic teaching model · no award prediction
ORIGIN × EVOLUTION × CURRENT PRACTICE
Why this reference exists—and what changed.
Technology providers, AI deployers, public bodies, regulated services and suppliers incorporating automated decision or content systems.
02 · 2021–2023
Consensus development
ISO/IEC JTC 1/SC 42 developed management-system requirements applicable to AI providers and users.
03 · December 2023
First edition published
ISO/IEC 42001 became the first international AI management-system standard.
04 · 2024–2026
Implementation alongside regulation
Organisations increasingly map AIMS controls alongside sector rules and legislation, while keeping conformity and legal compliance distinct.
An AI management system cannot certify an output as fair, accurate or lawful in every context. The specific use, affected people and monitoring evidence remain decisive.
OFFICIAL SOURCE FRESHNESS MONITOR
SOURCE CHECK PENDING
Monthly official-source reachability and change review.
LAST SOURCE CHECKloading…
What this date means
The check records source reachability and a content fingerprint. It does not silently change the page or claim that an edition changed.
PUBLICLY DESCRIBABLE ANATOMY
Every domain gets a specific bid-management translation.
These are navigational interpretations, not substitute clauses. Use the official publication for normative wording.
- 01
AI management context and scope
Inventory the AI uses inside the proposed service and define which outcomes and people sit inside the AIMS scope.
- Evidence object
- AI use-case and affected-party register
- Decision test
- Would the service still be described accurately if the marketing term “AI” were removed?
- 02
Leadership, policy and accountable roles
Name accountable owners, prohibited uses, approval rights and independent challenge.
- Evidence object
- AI policy and decision-right map
- Decision test
- Who can stop deployment when performance is commercially inconvenient?
- 03
AI risk and impact assessment
Assess intended benefit, reasonably foreseeable misuse, affected-person impact and residual risk.
- Evidence object
- AI impact and risk assessment
- Decision test
- Are disparate effects and non-users considered as well as average model performance?
- 04
Resources, data and competence
Govern competence, data provenance, model information, infrastructure and supplier claims.
- Evidence object
- Data/model lineage and competence evidence
- Decision test
- Can the team reproduce which data, version and evaluation produced a decision?
- 05
Lifecycle, supplier and operational controls
Control design, acquisition, change, deployment, human oversight and retirement.
- Evidence object
- AI lifecycle control plan
- Decision test
- What event forces revalidation, rollback or human intervention?
- 06
Transparency, monitoring, audit and review
Provide intelligible transparency and monitor outcomes, drift, incidents and complaints.
- Evidence object
- Transparency record and monitoring plan
- Decision test
- Can an affected person understand the role AI played and reach a human route?
- 07
Incident, correction and improvement
Correct incidents and systemic weaknesses; update data, model, control or use decision.
- Evidence object
- AI incident and corrective-action record
- Decision test
- Does learning change the operating system rather than only the disclaimer?
BEFORE × INTERVENTION × AFTER
Worked case · AI-assisted triage
A fictional public service proposes a model that ranks incoming cases for human review using historic service data.
Fictional evaluation inputs. No claim is made about a real model or lawful deployment.
What the team can observe
The bid quotes 91% aggregate accuracy but does not define intended use, subgroup performance, appeal, human authority, drift or supplier model change.
What changes in the operating system
The team bounds the use case, evaluates affected groups, documents data and version lineage, designs human override and defines revalidation triggers.
The offer states what the model may and may not do, gives the operator accountable decision rights and exposes seven monitored outcome measures.
PROPORTIONATE IMPLEMENTATION
Scale the control—not the integrity of the decision.
It cannot certify an individual AI output as accurate, fair or lawful. The use case, affected people, data and operating evidence remain decisive.
WORKED CASEISO-42001–01Teaching scenario · no claimed outcome
Keep a use-case register, impact screen, data/source record and human fallback.
Use decision, evaluation note, fallback test
Connect product, data, legal, security, ethics and delivery gates.
Impact assessment, lineage, oversight design
Operate portfolio inventory, approval tiers, monitoring and incident learning.
AIMS audit, monitoring records, management review
SOURCE TRAIL · REVIEWED 21 AUG 2026
Trace each interpretation to its authority.
Publication status can change. Exact conformity questions belong with the current licensed publication and competent assurance.
ISO/IEC
ISO/IEC 42001:2023 official record
Current edition, scope and public benefits
Open primary source ↗UK GovernmentUK Algorithmic Transparency Recording Standard
Public transparency context
Open primary source ↗US NISTNIST AI Risk Management Framework
Public complementary AI risk framework
Open primary source ↗