Skip to main content

Foundation and governance

Set the boundaries of your AI management system and record the context it operates in.

Where it fits: ISO/IEC 42001 clauses 4, 5 and 7.5

Scope and context

Define what the management system covers, who has a stake in it and which policies govern it.

  • Scope across organizational, geographical, functional, data and regulatory dimensions
  • Internal and external issues, each with an impact assessment
  • Stakeholder register with influence and interest analysis
  • Policies and documents with version control

Mostly used by: AI Governance Officer, Head of AI, Compliance Manager

AI system inventory and lifecycle

One register of every AI system you build, buy or use, and where each one is in its life.

Where it fits: ISO/IEC 42001 Annex A.6 · EU AI Act Article 6 and Annex III

AI system lifecycle

Move each system through eight stages, from ideation to decommissioning, with an approval at every transition.

  • Ideation, requirements, design, development, validation, deployment, operations, decommissioned
  • Approval and justification for every stage transition
  • Guided EU AI Act risk classification: unacceptable, high, limited or minimal
  • Complete history of each system's changes and decisions

Mostly used by: AI Engineer, AI Product Manager, AI Governance Officer

Risk and impact assessment

Assess what could go wrong with each AI system, and who it could affect.

Where it fits: ISO/IEC 42001 clauses 6.1 and 8.2–8.4 · Annex A.5

Risk management

Identify, score and treat AI risks across your portfolio, and see where treatment is missing.

  • Risk register with inherent, residual and target risk
  • 5x5 likelihood-by-impact scoring
  • Heat map across the whole portfolio
  • Treatment plans: mitigate, transfer, accept or avoid
  • Review schedules and gap analysis for untreated risks

Mostly used by: Compliance Manager, AI Governance Officer, Head of AI

Impact assessments (AIIA and FRIA)

Guided AI impact and fundamental rights impact assessments, linked to the system they assess.

  • AIIA and FRIA templates with an eight-step guided workflow
  • Individual, societal and fundamental-rights impacts, from privacy to equality
  • Severity (negligible to catastrophic) and likelihood scoring
  • Mitigations linked to controls, with owners and effectiveness criteria
  • Stakeholder consultations recorded with the assessment, and PDF export

Mostly used by: Compliance Manager, AI Governance Officer, AI Product Manager

Controls and audits

Show which controls you apply, the evidence behind them, and what your audits found.

Where it fits: ISO/IEC 42001 clauses 6.1.3, 9.2 and 10.2 · Annex A

Controls library

Pre-configured controls with implementation status, owners and evidence.

  • Controls from ISO/IEC 42001 Annex A, ISO/IEC 27001, NIST CSF and the EU AI Act, plus your own
  • Status, owner and justification for each control
  • Evidence linked to each control
  • Statement of Applicability generated and exported
  • Review schedules and effectiveness monitoring

Mostly used by: AI Governance Officer, Compliance Manager, Auditor

Audit management

Plan, run and follow up internal audits of your AI management system.

  • Multi-year audit programs with risk-based planning
  • Checklist templates for ISO/IEC 42001 or your own criteria
  • Findings: nonconformity, observation or opportunity for improvement
  • Root cause analysis (5 Whys, fishbone, FMEA) and corrective actions with an effectiveness review

Mostly used by: Auditor, AI Governance Officer, Compliance Manager

Objectives, review and reporting

Measure whether the management system works, and show top management the evidence.

Where it fits: ISO/IEC 42001 clauses 6.2, 9.1, 9.3 and 10.1

Objectives and KPIs

Set AI objectives and track the indicators that show progress against them.

  • SMART objectives mapped to ISO/IEC 42001 clauses
  • Custom KPIs, with data connectors for automated collection
  • Dashboards with trends over time

Mostly used by: Head of AI, AI Governance Officer, Executive

Management review and reports

Prepare and record top-management reviews, and report on the system to the people who need it.

  • Management review workflow with structured inputs, decisions and actions
  • Risk, audit, compliance and performance reports
  • Scheduled reports and exports
  • Improvement pipeline for continual improvement

Mostly used by: Head of AI, Executive, AI Governance Officer

Operations and administration

Suppliers, people and the platform itself.

Where it fits: ISO/IEC 42001 clauses 7.2–7.4 · Annex A.10

Suppliers and communication

Manage the third parties in your AI supply chain and plan how the system is communicated.

  • Supplier register with due diligence
  • Supplier assessments: initial, periodic, risk and compliance
  • SLA definitions and monitoring
  • Communication plans and awareness materials

Mostly used by: Compliance Manager, AI Governance Officer, Admin

Training and competence

Plan training and keep the evidence of competence that ISO/IEC 42001 clause 7.2 asks for.

  • Training programs and curricula
  • Competency framework with five proficiency levels
  • Role-based competency profiles and gap analysis
  • Certification tracking

Mostly used by: AI Governance Officer, Head of AI

Administration

Users, organizations and security settings, with an audit log of activity.

  • User lifecycle: invite, edit, activate and suspend
  • Single- or multi-tenant organization setup with data isolation
  • Audit log of user and system activity
  • Password policies, two-factor authentication and session timeouts

Mostly used by: Admin, AI Governance Officer

Start your AI management system today

Begin on the free Community tier, or book a demo and we will walk through AIMS with your AI systems.