Skip to main content
Arelis AI

AIMS workflows

AI governance workflows, step by step

Seven workflows that turn ISO/IEC 42001 and EU AI Act requirements into work your teams can do and an auditor can follow, each with owners, approvals and a record.

Start free (opens in a new tab)Book a demo

Core workflows

From first registration to management review

Each workflow runs inside AIMS, linked to the AI systems, risks and controls it touches.

AI system lifecycle

Take an AI system from idea to retirement, with a decision recorded at every stage.

ISO/IEC 42001 Annex A.6

  • Every stage transition needs an approval and a justification
  • Stages can be skipped or revisited, with a recorded reason
  • The full history stays with the system

  1. Ideation

    Register the system, document the business case and identify stakeholders.

  2. Requirements

    Gather requirements, identify applicable regulations and run a preliminary risk assessment.

  3. Design

    Classify the system under the EU AI Act, run the AI impact assessment and define controls.

  4. Development

    Build, test and document the system, implementing the planned controls.

  5. Validation

    Validate the system, verify control effectiveness and complete a FRIA where one is required.

  6. Deployment

    Deploy, switch on monitoring and train users.

  7. Operations

    Monitor performance, manage incidents and changes, and review periodically.

  8. Decommissioning

    Archive data, record lessons learned and close related risks and controls.

EU AI Act risk classification

Decide which EU AI Act risk tier applies to a system, and keep the reasoning behind it.

EU AI Act Article 6 and Annex III

  • Earlier classifications are kept; the latest approved one applies
  • Reclassify when the system changes significantly
  • Annex III areas covered include biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice

  1. Start a classification

    Open the AI system and start a new classification.

  2. Answer the questionnaire

    Guided questions based on Article 6 and Annex III, each with a justification.

  3. Review the result

    See the proposed tier (unacceptable, high, limited or minimal), the reasoning and the requirements that follow.

  4. Submit for review

    Save a draft or send it to a reviewer.

  5. Approve

    The approved classification becomes the active one for the system.

  6. Export

    Generate a PDF report for the system's documentation.

AI impact assessment (AIIA)

Assess how an AI system affects individuals, groups and society, and plan what to do about it.

ISO/IEC 42001 clauses 6.1.4 and 8.4 · Annex A.5

  • Save at any step; progress is tracked
  • Several people can contribute to one assessment
  • AIIA and FRIA templates keep assessments consistent

  1. Define the scope

    Set the scope, objectives, team and timeline.

  2. Identify stakeholders

    List who is affected and assess their vulnerability.

  3. Identify impacts

    Choose the individual, societal and fundamental-rights impacts that apply.

  4. Assess severity

    Rate severity, likelihood and timeframe for each impact, with a rationale.

  5. Analyze affected groups

    Describe the affected populations and their size.

  6. Plan mitigation

    Define measures, link them to controls, and assign owners and deadlines.

  7. Define monitoring

    Set indicators, thresholds, frequency and owners.

  8. Document consultations

    Record stakeholder feedback and how it changed the assessment.

  9. Review, approve and export

    Complete the internal review, approve and export a PDF for the record.

Risk management

Identify, assess and treat the risks your AI systems create, and keep the assessment current.

ISO/IEC 42001 clauses 6.1, 8.2 and 8.3

  • Risks link to AI systems, controls and objectives
  • The heat map and gap analysis show untreated risks

  1. Identify

    Record the risk, its category and source, link affected AI systems and assign an owner.

  2. Assess

    Score inherent likelihood and impact from 1 to 5; the score sets the risk level.

  3. Plan treatment

    Mitigate, transfer, accept or avoid, with actions, controls and a timeline.

  4. Implement

    Carry out the actions and collect evidence.

  5. Reassess

    Score the residual risk and compare it with the target.

  6. Monitor

    Review on a schedule and adjust the treatment.

  7. Close

    Close the risk with a rationale and an approval when it no longer applies.

Internal audit

Plan, carry out and follow up audits of your AI management system.

ISO/IEC 42001 clause 9.2

  • An audit calendar for planning across the year
  • Findings link directly to corrective actions

  1. Plan

    Build an annual or multi-year program with scope, criteria, dates and auditors.

  2. Prepare

    Choose or adapt a checklist template for the audit scope.

  3. Execute

    Work through the checklist and gather evidence.

  4. Record findings

    Log nonconformities, observations and opportunities for improvement as you go.

  5. Report

    Produce the audit report for auditees and management.

  6. Follow up and close

    Raise corrective actions, verify them and close the audit.

Corrective action

Deal with nonconformities and stop them from happening again.

ISO/IEC 42001 clause 10.2

  • Reminders for overdue actions
  • Escalation by priority
  • An audit trail throughout

  1. Raise

    Open a corrective action for an audit finding or another nonconformity.

  2. Contain

    Record the immediate containment.

  3. Find the root cause

    Use 5 Whys, a fishbone diagram or FMEA.

  4. Plan and approve

    Define actions, owners and deadlines, and get them approved.

  5. Implement and verify

    Carry out the actions with evidence, then check they were done as planned.

  6. Review effectiveness

    Confirm the nonconformity has not recurred, then close the action.

Management review

Give top management what it needs to review the AI management system, and record what it decides.

ISO/IEC 42001 clause 9.3

  • Structured inputs and outputs
  • Records kept as audit evidence

  1. Plan

    Schedule the review and invite top management.

  2. Collect inputs

    Status of earlier actions, changes in context and stakeholder needs, performance and audit results, and improvement opportunities.

  3. Hold the review

    Record decisions on improvements and on any changes to the management system.

  4. Document

    Keep minutes and decisions as evidence.

  5. Follow up

    Track actions to completion and carry them into the next review.

By sector

Where the EU AI Act asks the most

Sectors where AI systems are often high-risk under the AI Act, and the workflows to start with.

  • Financial services

    Creditworthiness assessment and credit scoring of individuals, and risk assessment and pricing in life and health insurance, are listed as high-risk in Annex III.

    Start with: EU AI Act risk classification, AI impact assessment

  • Healthcare and life sciences

    AI that is a medical device, or a safety component of one, falls under EU product legislation listed in Annex I and can be high-risk under Article 6(1).

    Start with: AI system lifecycle, Risk management

  • Employment and HR

    AI used to recruit, select, promote or evaluate people is listed as high-risk in Annex III, point 4.

    Start with: EU AI Act risk classification, AI impact assessment

  • Public sector

    AI that assesses eligibility for public benefits and services is listed in Annex III, and public bodies deploying high-risk AI listed there must carry out a fundamental rights impact assessment first (Article 27).

    Start with: AI impact assessment, Management review

A summary, not legal advice. Whether a system is high-risk depends on its intended purpose and on the exceptions in Article 6(3) of the AI Act.

Keep exploring

More about AIMS

Run your first workflow this week

Register an AI system and classify it on the free Community tier, or book a demo to see the workflows with your own systems.

Start free (opens in a new tab)Book a demo