Clauses 4 and 5 — context, roles, and the AI policy

Lesson 2 of 5 in ISO/IEC 42001 Clause by Clause: Building the AI Management System.

Every AIMS that fails, fails first at clause 4 — usually months before anyone notices. Context is where you decide what the system is for and what it covers, and both decisions are easy to get wrong.

4.1 Understanding the organization and its context. You must determine the external issues (regulation, market expectations, the state of AI technology, societal concerns) and internal issues (strategy, culture, capabilities, existing systems) relevant to your AI ambitions. 42001 adds two determinations with no 27001 ancestor. First, the standard asks whether climate change is a relevant issue — reflecting ISO’s London Declaration commitment, and genuinely material for organisations training large models. Second, and far more consequential: the organisation must determine its role or roles with respect to AI systems — provider, producer/developer, user, or a combination, in 22989’s vocabulary. Everything else calibrates to this answer: a pure user of vendor AI tools needs heavyweight procurement and oversight controls; a developer needs lifecycle and data controls a user never touches.

4.2 Interested parties. Who has a stake, and what do they require? Customers, regulators, employees, and — distinctive to AI — the AI subjects your systems score, rank, and affect, who never signed a contract with you but whose interests the impact assessment must represent.

4.3 Scope. Which parts of the organisation, which AI systems, which activities the AIMS covers — written down, available as documented information. Scope is a certification boundary: what you exclude, the auditor never checks, but the market can read your certificate’s scope statement and judge the exclusions.

Clause 5 — Leadership. The Harmonized Structure is blunt: top management — the people who direct and control the organisation at the highest level — must own the AIMS. Not sponsor it from a distance: demonstrate commitment by ensuring the policy and objectives exist and fit strategy, integrating AIMS requirements into business processes (not a parallel bureaucracy), providing resources, communicating why it matters, and steering the loop to its intended outcomes.

5.2 The AI policy is the constitution of your AIMS. The standard requires that it be appropriate to the organisation’s purpose, provide the framework for setting AI objectives, and carry commitments to meeting applicable requirements and to continual improvement — available as documented information, communicated internally, and available to interested parties as appropriate. A policy that could be swapped with a competitor’s by changing the logo fails the appropriate to purpose test in spirit, and auditors increasingly say so.

5.3 Roles, responsibilities and authorities. Someone must be assigned to ensure the AIMS conforms to the standard, and someone must report its performance to top management. Names and authority, not vibes: the classic failure is an “AI governance lead” with responsibility for everything and authority over nothing.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.