ISO 42001 Clauses 4-10 Explained, Clause by Clause

ISO 42001 puts its actual requirements in seven clauses, numbered 4 through 10. Read them once as a list and they look like admin. Read them as a loop, where each clause feeds the next, and they turn into a working system you can build and defend.

The first thing to get straight is what counts. ISO/IEC 42001:2023, the AI management system standard, opens with clauses 1 to 3, which cover the scope of the document, normative references, and terms. Those set the stage but state no requirements. The auditable requirements, the ones you are certified against, live entirely in clauses 4 to 10, alongside the Annex A controls you select.

This guide from the AI Governance Certification Institute (AIGCI) explains each clause in plain terms: what it asks for, the documented information it produces, and how it connects to the clauses around it. Because the clauses are easiest to understand as relationships rather than as a flat list, the connections are the thread that runs through it, and the detail of building the system sits in the implementation guide.

Clauses 4 to 10 at a Glance

Before the detail, the whole structure in one view. Each clause has a focus and produces specific documented information, which is what an auditor asks to see. The table reads top to bottom as the order you build in.

How the Seven Clauses Work as One Loop

The clauses are not seven separate tasks; they are one management cycle, the plan, do, check, act loop that runs through every ISO management system. Seeing the loop is what turns the list into a system.

The relationships read almost as plain sentences. Clauses 4 to 6 plan the system: you set the context, the leadership commits, and you assess the risks. Clauses 7 and 8 do it: you resource the system and operate the controls. Clause 9 checks it, through monitoring and audit, and clause 10 acts on what you find, through correction and improvement. Each clause is the input to the next, so a gap in one shows up as a weakness two clauses later. The point of reading them as relationships rather than as a checklist is that it tells you the order, and the order is the thing a flat list hides.

Clause 4: Context of the Organization

Clause 4 asks you to understand your setting before you build. You identify the internal and external issues that affect your use of AI, the interested parties and what they expect, and then you set the one output that everything downstream depends on: the scope of the AI management system. That scope lives inside the AIMS itself, and defining it precisely, what is in and what is out, is the single most consequential decision in the standard.

In sub-clauses, 4.1 covers the context, 4.2 the interested parties, 4.3 the scope statement, and 4.4 the requirement to establish the management system itself. A vague scope here makes every later clause harder, which is why experienced implementers spend real time on it.

Clause 5: Leadership (Commitment, AI Policy, and Roles)

Clause 5 makes AI governance a leadership responsibility, not a task delegated and forgotten. Top management has to show commitment, set the direction, and make sure the right people are accountable.

It breaks into three parts: 5.1 leadership and commitment, where management owns the system and its resources; 5.2 the AI policy, the short document that states the organization's principles and intent; and 5.3 roles, responsibilities, and authorities, which assigns who is accountable for what. The policy and the roles are both documented information an auditor will expect to see, and both have to be real rather than aspirational.

Clause 6: Planning (Risk, Treatment, Impact, and Objectives)

Clause 6 is the analytical heart of the standard, and it carries the most sub-clauses. It is where you decide what could go wrong and what you will do about it. The planning actions in 6.1 run from a general requirement (6.1.1) into an AI risk assessment (6.1.2), AI risk treatment (6.1.3), and an AI system impact assessment (6.1.4). Guidance such as the NIST AI Risk Management Framework helps you reason through the risk work, and the practical method is laid out on how to run a risk assessment.

Two outputs matter most here. Risk treatment in 6.1.3 produces the Statement of Applicability, the reasoned record of which controls apply and why. The impact assessment in 6.1.4 asks a different question from risk, namely the effect of the AI on people, groups, and society. Clause 6 then adds 6.2, measurable AI objectives, and 6.3, planning any changes to the system in a controlled way rather than by accident.

Clause 7: Support (Competence and Documented Information)

Clause 7 is the resourcing layer, the quiet clause that decides whether the system actually runs. It covers what the management system needs to operate and stay current.

Its five parts are 7.1 resources, 7.2 competence, 7.3 awareness, 7.4 communication, and 7.5 documented information. The last one is the backbone of the others, because 7.5 governs how every record in the standard is created, approved, versioned, and controlled. Competence records under 7.2 and controlled documents under 7.5 are among the first things an auditor samples, since they reveal whether the system is maintained or merely written.

Clause 8: Operation (Operational Risk and Impact Assessment)

Clause 8 is where the plan from clause 6 becomes daily practice. If clause 6 decides what to do, clause 8 is the doing.

It has four parts: 8.1 operational planning and control, which runs the processes the system needs; and 8.2, 8.3, and 8.4, which are the operational counterparts of the clause 6 assessments, performing the AI risk assessment, the risk treatment, and the AI system impact assessment as live activities rather than one-time plans. The key idea is that these are not done once and filed; they run on a schedule and whenever a significant change is proposed, so the system keeps pace with the AI it governs.

Clause 9: Performance Evaluation (Monitoring, Internal Audit, and Management Review)

Clause 9 is the check in the loop. It asks whether the system is actually working, and it produces the evidence a certification audit leans on most heavily.

Three parts carry it: 9.1 monitoring, measurement, analysis, and evaluation, which tracks whether controls and objectives are being met; 9.2 internal audit, your own clause-by-clause check for gaps before an external auditor finds them; and 9.3 management review, where leadership examines the results and decides on action. Together they close the gap between what the documents claim and what is really happening.

Clause 10: Improvement (Continual Improvement and Corrective Action)

Clause 10 is the act in the loop, and it is what keeps a certified system from going stale. It turns findings into change.

It has two parts, and the order is worth stating precisely because many summaries flip it: in ISO/IEC 42001:2023, 10.1 is continual improvement, the standing expectation that the system gets better over time, and 10.2 is nonconformity and corrective action, the process for handling things that go wrong, fixing the immediate issue, finding the root cause, and preventing recurrence. A live corrective action log is strong evidence that the loop is turning rather than sitting still.

Clauses Versus Annex A Controls: The Difference That Trips People Up

The most common confusion with ISO 42001 is treating the clauses and the Annex A controls as the same thing. They are not, and the distinction matters for how you build. Clauses 4 to 10 are the management system requirements, the how of governing AI. the Annex A controls are a reference set of specific safeguards you draw from, the what you might put in place, selected and justified through the Statement of Applicability in clause 6.

Put as a relationship, the clauses require you to manage AI risk, and the Annex A controls are among the means you use to do it. You are certified against the clauses; the controls are the selected measures the clauses make you choose and defend. Reading one as the other is why some organizations build a pile of controls with no management system around them, or a management system with no controls inside it.

Where Clauses 4 to 10 Connect to the Rest of the Standard

The clause numbers will look familiar to anyone who has seen another ISO management system, and that is deliberate. ISO 42001 is built on the harmonized high-level structure that ISO uses across its standards, so its clauses 4 to 10 share their shape, and much of their wording, with standards such as ISO/IEC 27001. An organization that already runs one of those recognizes the rhythm immediately and reuses much of the machinery.

That shared structure is also why the clauses connect outward so cleanly. The same scope, policy, risk, audit, and review pattern repeats, which lets an AI management system sit alongside an existing quality or security system rather than duplicating it. The clauses are the connective tissue; the Annex A controls are what makes the system specifically about AI.

Frequently Asked Questions

What Are the Clauses of ISO 42001?

ISO 42001 has ten clauses. Clauses 1 to 3 cover the scope of the document, normative references, and terms and definitions. Clauses 4 to 10 contain the requirements: context, leadership, planning, support, operation, performance evaluation, and improvement. Those seven are what an organization is audited against, together with the Annex A controls it selects.

Which ISO 42001 Clauses Are Mandatory?

Clauses 4 to 10 are the mandatory, auditable requirements, and none of them can be excluded when an organization claims conformity. Clauses 1 to 3 are not requirements; they frame the document. The Annex A controls are different again: they are selected based on your risks rather than all being mandatory.

What Is the Difference Between the Clauses and the Annex A Controls?

The clauses are the management system requirements, how you govern AI across context, leadership, planning, support, operation, evaluation, and improvement. The Annex A controls are a reference set of specific safeguards you choose from to treat your risks. You are certified against the clauses; the controls are the measures the clauses require you to select and justify in your Statement of Applicability.

Which Clause Covers AI Risk Assessment?

Clause 6.1.2 sets the requirement to assess AI risks, and 6.1.3 covers treating them, while 6.1.4 adds the AI system impact assessment. Clause 8 then performs these same assessments as ongoing operational activities, so risk work appears in both the planning clause and the operation clause by design.

Are Clauses 1 to 3 of ISO 42001 Required?

They are part of the standard but state no auditable requirements, so you are not certified against them. Clause 1 gives the scope of the document, clause 2 lists normative references, and clause 3 defines terms. They are worth reading because the definitions shape how the later clauses are interpreted, but the obligations all sit in clauses 4 to 10.

From the Clauses to a Working System

Understanding the clauses is the foundation, but turning them into a certified AI management system is a skill built through practice and training. You can see every route through the ISO 42001 courses, with the implementer path taught clause by clause in the Lead Implementer certification, so each requirement becomes something you can build, evidence, and defend rather than just recognize.