▶ See the output created with this function right away. Preview the example output of Company A

• ISO/IEC 42001 Built with AI: A 44-Step eiso Implementation Example

• ISO/IEC 42001 (AI management system) is an international standard that has an organization put in place policies, risk management and controls so that it develops, provides and uses AI responsibly.
  Because it uses the same clause structure as ISO 9001, 14001 and 45001 (the harmonized structure, clauses 4 to 10), you can follow the eiso 44-step implementation method as it is.

  For each of the 44 steps, this page shows what AI does and what people decide. There are four tasks that exist only in ISO/IEC 42001 and not in other standards.

  1. Define the organization's AI role (user, who uses AI; developer, who builds it; provider, who supplies it) and create a list (inventory) of the AI systems in use.
  2. Establish a procedure for an AI system impact assessment, which looks at the effect an AI system has on individuals, groups and society, together with an AI risk assessment. The company decides which systems to assess (for example, high-risk systems).
  3. For each of the 38 controls in Annex A (ways of managing AI), record whether it applies and why in the Statement of Applicability (SoA). The Statement of Applicability is a document that records which controls are used and the reasons.
  4. Manage the lifecycle of AI systems (from planning to disposal) and data.
• AI Implementation Approach for a Typical Company
• Model company (fictional)Electronics company: assembles small household appliances, 60 employees, holds ISO 9001 and 14001 certification. It does not build AI but uses it in its work (AI user): a vision inspection AI that detects circuit board soldering defects (supplied externally), a generative AI for office work, and a demand forecasting AI.
  1AI role diagnosisDecide whether the company builds and supplies AI or only uses it in its work. This decision changes the scope and the Statement of Applicability.

  2Preparing materialsCollect the website address, organization chart and headcount, work and service flow charts, main products and customers, existing certifications, and the AI in use and the data it processes.

  3Draft with AIEnter the industry, standard and size, and state the AI role (user type or developer/provider type) in the request. Based on the management system AI transformation materials, the AI prepares drafts of the document structure table, manual table of contents and procedures.
  If you already have documents such as ISO 9001 or 27001, specify the folder and "integrate with existing documents". A single guideline you need separately (for example, a generative AI use guideline) is matched to your format through Individual Document Development.
  Management System DocumentationIndividual Document Development

  4Human review and approvalThe risk level, impact assessment decision, reasons for excluding controls in the Statement of Applicability and the AI policy are decided and approved by the responsible person.

  5Pilot implementation and auditAfter a pilot run with one or two representative AI systems, you go through an internal audit and management review and then apply for certification.
  Training Materials and Lesson PlansICT Management System Operation Guide

  For a representative company, about 6 to 7 months (example): if you reuse existing ISO 9001 documents and use the eiso drafts, the time to prepare documents is reduced from several months to a few weeks. The actual period depends on each company's circumstances, and no certification date is promised.

  The marks in the AI use column of the table are as follows. Find ISO Reference Materials Question-and-answer search of the materials in the library (information collection) Management System Documentation Document drafts matched to industry, size and role; integration with existing documents and gap analysis of the whole folder Standard Revision Response When a standard is revised: documents to revise, documents to newly establish and related forms Individual Document Development One document among manuals, procedures and guidelines, in the exact format of your reference document Training Materials and Lesson Plans Generation of training materials and assessment questions for each audience ICT Management System Operation Ongoing operation of document control, records, corrective action, audits and management review Human Matters for the responsible person to judge and approve

• What type is our company? (example)

  Category	AI user type	AI developer/provider type
  Example	Manufacturing or service companies that use generative AI or software with AI functions in their work	Companies that build AI products or services and supply them to customers (internal use is also covered)
  Scope of application	Introduced AI services and functions, and internal use of AI	The whole life cycle of the company's own AI products and services, and internal use of AI
  Key controls	A.2 Policies, A.3 Roles, A.4 Resources, A.5 Impact assessment, A.9 Use, A.10 Suppliers	In addition to the left: A.6 Life cycle, A.7 Data, A.8 Information for interested parties, A.10 Customers
  Key documents	Generative AI use guideline, AI system inventory, supplier information request form	AI system development and build procedure, AI data management guideline, instructions for use and AI notice

  * Whether each control applies is judged separately in the Statement of Applicability. The table above is an example to set a starting point.

• Input example for Management System Documentation: values to select at each step

• Establishment stage	Writing method	Documents to create	What you receive
  Scope and project organization (Steps 2 to 5)	Write new	Other documents and tables (state in the request)	Scope statement, roles and responsibilities table, project schedule (WBS)
  Situation analysis (Steps 8 to 10)	Write new	Analysis of the context of the organization (issues and interested parties)	Internal and external issues, needs and expectations of interested parties
  AI risk and impact assessment (Steps 11 to 14)	Write new	Draft risk and hazard assessment table	AI risk assessment table, AI system impact assessment items
  Inventory and Statement of Applicability (Steps 11 to 14)	Write new	Other documents and tables (state in the request)	AI system inventory, Statement of Applicability (SoA)
  Documentation (Steps 15 to 28)	Integrate with existing documents (improvement) · Gap analysis of existing documents (whole folder)	All · Draft procedures · Form list and writing guidance	An integrated document that adds the AI policy and procedures to the 9001 documents, and missing documented information

  Input example: AI risk assessment table

  Field	Input
  Writing method · Certification standard	Write new · ISO/IEC 42001 (+ ISO 9001)
  Industry · Number of employees	Assembly of small household appliances · 50 to 299 employees
  Main products and services · Key processes	Electric kettles and hair dryers · Board soldering → assembly → vision inspection → shipment
  Documents to create	Draft risk and hazard assessment table
  Requests	Based on three AI systems (an externally supplied vision inspection AI, an office generative AI and an ERP demand forecasting AI); figures are examples

  * The values you select are exactly those on the Management System Documentation screen. The criteria and decisions (risk acceptance, reasons for excluding controls) are the responsibility of the responsible person.

• Output preview: Company A example

• This is the output you receive when you enter the following in eiso Management System Documentation. Taking the fictional company Company A (assembly of electric kettles and hair dryers, 60 employees, an AI user type with three AI systems, building ISO/IEC 42001) as an example, it is a result drafted in advance in the same way as the actual function, finding the grounds in AGENT knowledge materials.

  Management System DocumentationDraft AI risk assessment table (ISO/IEC 42001)Fictional company: Company A

  This is what was entered

  Writing method · Certification standard	Write new · ISO/IEC 42001
  Industry · Number of employees	Assembly of small household appliances (electronics) · 50 to 299 employees
  Main products and services · Key processes	Electric kettles and hair dryers · Board soldering → assembly → vision inspection → shipment
  Documents to create	Draft risk and hazard assessment table
  Requests	Based on three AI systems (an externally supplied vision inspection AI, an office generative AI and an ERP demand forecasting AI); figures are examples

  Draft AI risk assessment table: Company A (AI-FM-03)

  • Applicable standard: ISO/IEC 42001: 6.1.2 AI risk assessment, 6.1.3 AI risk treatment, 6.1.4 AI system impact assessment
  • Organization's role: AI user (all three systems are supplied externally and used: the developer/provider role does not apply)
  • Systems assessed: externally supplied vision inspection AI, office generative AI, ERP demand forecasting AI
  • Assessment cycle: once a year, and whenever an AI system, supplier or purpose changes (linked to 6.3 planning of changes) [2]
  • The organization and figures in this table are examples. The criteria and the risk acceptance decision are determined and approved by the AI management owner of Company A (the CEO). [1]

  Criteria (example)

  Level	Likelihood × impact	Treatment principle
  High	15~25	Apply controls before use, approval by the responsible person, quarterly review
  Medium	8~14	Apply controls, half-yearly review
  Low	1~7	Maintain current controls, reassess once a year

  Likelihood and impact are each rated from 1 (very low) to 5 (very high). Impact considers customer safety and product quality, personal information, legal and contractual requirements, and business interruption together.

  AI risk assessment table

  AI System	Risk source	Result	Likelihood	Level	Treatment and related controls (Annex A)
  Vision inspection AI	New defect types not in the training data (variants of solder bridges)	Undetected defects → customer claims and safety problems after shipment	3	High (15)	Revalidation when new models or appearance changes occur, regular testing with good and defective samples, retaining the human final judgment, A.6 (life cycle, verification and validation), A.9 (use)
  Vision inspection AI	Changes in lighting or camera position (after maintenance)	Increase in misjudgments, production delays from over-detection	3	Medium (9)	Checking of reference specimens after maintenance is added to the work standard. A.6 (operation and monitoring)
  Vision inspection AI	The supplier does not announce model updates	Changes in judgment criteria go unnoticed	2	Medium (8)	Contract clause on change notification and provision of verification data: A.10 (external suppliers)
  Office generative AI	Employees enter customer drawings or personal information	Leakage of confidential or personal information, breach of contract	3	High (15)	Guideline on information that must not be entered, only corporate accounts permitted, training and pledges, A.2 (policies), A.9 (responsible use)
  Office generative AI	Untrue answers (invented specifications or figures) used in documents	Incorrect work instructions and replies to customers	3	Medium (12)	A person checks against the original source before use, documents sent externally are reviewed and approved, A.9 (use)
  ERP demand forecasting AI	Training data that does not reflect promotions or seasonal changes	Excess stock or stock-outs, delivery delays	3	Medium (9)	Monthly monitoring of forecast error, the person in charge adjusts when the criterion is exceeded, A.7 (data quality), A.6 (monitoring)
  ERP demand forecasting AI	The basis of the forecast cannot be explained	Unclear responsibility for purchasing decisions	2	Low (6)	Forecast values are for reference; the purchasing manager decides on orders: A.3 (internal organization and roles)
  [Optional] Vision inspection AI	Workers' faces appear in inspection images	Personal information handling issue	2	Low (4)	Adjust the imaging range and set a retention period for images. A.7 (data)
  [Optional] Office generative AI	Output that copies copyrighted material as it is	Copyright dispute	2	Low (6)	Confirm the source of materials made public externally: A.9 (use)
  [Optional] Common	The AI system list is not updated (AI used secretly by departments)	Unmanaged AI risks	3	Medium (9)	Quarterly survey of AI use by department, update of the list (inventory), A.4 (resources)

  * Annex A controls are given at the category level. Compare the detailed control numbers with the original text of ISO/IEC 42001 and enter them in the Statement of Applicability (SoA) (to be confirmed).

  AI system impact assessment items

  Category	Vision inspection AI	Office generative AI	ERP demand forecasting AI
  Individuals	Risk of electric shock and burns if defective products reach consumers (electric kettles and hair dryers)	Exposure of employees' personal information and customer contacts' information	Little direct impact
  Groups	Possibility of judging parts from certain suppliers as defective more often (bias)	Gap in use between employees	Changes in order volumes to suppliers
  Society	Trust in product safety	External spread of incorrect information	Waste of resources through overproduction
  Assessment result (example)	Large impact: retain the human final judgment	Medium impact: use guideline and training	Small impact. Monitoring

  [Optional] Risk treatment plan

  Treatment task	Owner	Deadline (example)	Completion criteria
  Add the revalidation procedure for the vision inspection AI to the work standard	Quality Team Leader	End of November	Revised standard and training records
  Establish the generative AI use guideline and train all employees	Management Support Team Leader	During November	Guideline approved, training completion of 90% or more
  Add a change notification clause to the vision inspection AI supply contract	Purchasing Team Leader	December	Revised contract
  Start monthly reporting of demand forecast error	Production Management Team Leader	From next month	Monthly report

  [Optional] Records to review together before the certification audit

  • Whether the AI system list (inventory) and the subjects of this assessment table are the same
  • Treatment results for high-level risks and approval by the responsible person
  • Whether the impact assessment results match the reasons for selecting controls in the Statement of Applicability (SoA)
  • Whether the treatment results were confirmed using the internal audit nonconformity report form [4]

  Guide to optional items

  Optional item	Organizations and cases where it is useful to include	Basis number
  Personal information in vision inspection images	When workers are also captured in the inspection process	—
  Copyright of generative AI output	When generative AI output is made public externally	—
  Update of the AI system list	Organizations where departments freely introduce AI tools	[3]
  Risk treatment plan	When you want to manage the assessment table and the treatment plan in one document	[2]
  Records to review together before the certification audit	When the first certification audit is approaching	[4]

  ※ Draft for reference: it does not guarantee obtaining certification. Check clauses and requirements against the published text of the standard.

  Document completeness check

  The AI checked the document against a 7-item scoring sheet from the customer's point of view.

  Item	Result	What was checked
  Fulfillment of requirements	Met	The columns of the AI risk assessment table (system, source, result, likelihood, level, control) and the impact assessment items (individuals, groups, society) are covered for all three systems.
  Tailored to our company	Met	It reflects the characteristics of the industry, such as undetected defects by the vision inspection AI leading to product safety issues (electric shock, burns).
  Reflects the latest revision	Met	Written by checking against the "International Standard revision materials" so that nothing differs from the latest edition; check clause details against the published text
  Ready to use	Met	It includes the criteria and the treatment plan (owner, deadline, completion criteria), so you can fill it in and use it straight away.
  Accuracy	Met	Annex A controls are given only at the category level, and the detailed numbers are left for comparison with the original text.
  Consistency	Met	The document number (AI-FM-03) and terms (risk, Statement of Applicability) are consistent.
  Readability	Met	It is summarized briefly, centered on tables.

  ※ This is an AI check result and does not guarantee conformity for certification. Use the document after reviewing and approving it.

  Management system AI transformation materials referred to

  • ISO 42001 Clause 4 context analysis example, interested parties, PESTEL, SWOT v1.1: ISO 42001 documentation › AI context analysis (Clause 4) (revised 2026-10-03)
  • ISO 42001 AIMS lecture materials (revised 2026-08-11)
  • 1-3 Internal audit nonconformity report form [ISO 42001] (revised 2026-07-28)
  • 08.01.9 Electronic waste guideline [ISO 14001] (revised 2026-04-25)
  • 5. Management system establishment plan - example (revised 2026-07-20)
  • 3. Project plan for establishing an integrated management system (revised 2026-07-20)
  • Standardization of Word documents (revised 2026-07-20)
  • ISO 37001 actions by revised clause (revised 2026-01-11)
  • 6.1 Safety risk assessment (revised 2018-07-22)
  • 1 A new paradigm for management system standards: HLS (○○○) (revised 2025-02-01)

  Expand allDownload as Word

  ※ This is an example created with a fictional company, and the quality and content of the example may differ from the actual service results. Actual output varies with the input and the supporting materials. Output created by AI is a draft for reference and does not guarantee obtaining certification. The downloaded file is created inside your browser and is not sent anywhere.

• Building and operating AI AX with documented information functions: the "ICT Management System Operation" model

• The ISO/IEC 42001 example takes ICT Management System Operation, one of eiso's AI AX functions, as its model.
  ICT Management System Operation is written on the basis of the knowledge-based management system AI transformation materials, the same as Management System Documentation and Standard Revision Response. Recently revised materials are used first as grounds.
  It adds the management system platform to creating documents (Management System Documentation), and covers operation after establishment. Documents are created with Management System Documentation, and after establishment you continue with ICT Management System Operation (16 steps).

  Management System DocumentationEnter the industry, standard and size to get a document structure table, manual table of contents, draft procedures and a form list. If you specify the folder of existing documents, you get integrated improvement and gap analysis of the whole folder
  Documentation in this example

  Standard Revision ResponseSpecify the revised standard and the document folder, and the documents to revise and the documents to newly establish are identified on the basis of the "International standard revision materials", giving revised versions, related forms and writing examples
  Standard Revision Response (ISO 14001:2026) Example

  Individual Document DevelopmentOne document among manuals, procedures and guidelines, in the exact format of your reference document. In this example, it is one document you need separately, such as the generative AI use guideline in Step 18
  Individual Document Development (ISO 14001 + Other Standards) Example

  ICT Management System OperationDocumentation + management system platform: ongoing operation of document control, implementation records, nonconformities, internal audit and management review
  Model of the ISO/IEC 42001 example

  Knowledge-based management system AI transformation materialsStandard commentaries · documentation cases · forms · training materials · international standard revision materials · ISO 42001 documentation (context analysis example, AIMS lecture materials, internal audit form)

  With an AI management system, work continues even after the documents are in place. Each time an AI system is newly introduced or changed, the inventory and the risk and impact assessments are reviewed again. AI incidents and nonconformities are recorded and acted on. Only when the results are carried into internal audit and management review can you show that the system is actually in operation. That is why 42001 ties establishment (Management System Documentation) and ongoing operation (ICT Management System Operation) into one flow.

  From establishment to operation: the two stages of the ICT Management System Operation model

  EstablishmentManagement System Documentation44 steps: Steps 1 to 35 (P Plan · D Do)

  • AI role diagnosis, AI system inventory
  • AI risk assessment, impact assessment and draft Statement of Applicability
  • AI policy, drafts of the manual, procedures and forms
  • Pilot implementation and revision

  →

  OperationICT Management System Operation44 steps: Steps 36 to 38 (C Check), correction of audit findings, ongoing operation after certification

  • Documented information control and implementation records
  • Reassess when AI systems change
  • Corrective action for AI incidents and nonconformities
  • Internal audit, management review and performance management

  What is operated on the platform

  Operation area (related clause)	What the platform does (AI)	What people decide	Operation steps
  Context analysis and scope (4.1 to 4.4)	Analysis of interested parties, PESTEL and SWOT; draft scope declaration (development, supply, use)	Confirm the scope	1 AI Context Analysis
  AI policy and objectives (5.2, 6.2)	From the results of context analysis, inventory, risk and impact assessment, internal audit and corrective action: up to three AI objectives focused on effectiveness and efficiency with achievement plans, as a Word document "AI Policy and AI Objectives"	Approve the policy and objectives	2 AI Policy, Roles and Objectives
  AI selection (work, project, department)	Six-axis evaluation (repetition frequency, cost of errors, confidentiality level, AI impact, etc.) and introduction priority (P1 to P3)	Decide on introduction	3 AI System Selection
  AI system inventory and life cycle (8.1, Annex A)	List, use scope LEVEL and assessment type (excluded, simplified, full); updated when changes occur	Approve introduction and retirement	4 AI System Inventory
  AI risk and impact assessment (6.1.2 to 6.1.4, 8.2 to 8.4)	Likelihood × severity (1 to 25) assessment table and treatment plan; for high risks of 13 points or more, an impact assessment covering seven areas	Decide risk level and impact, approve acceptance	5 AI Risk Assessment · 6 AI System Impact Assessment
  Controls, Statement of Applicability and human oversight (6.1.3, Annex A and B)	Statement of Applicability (SoA), human oversight design, list of compliance obligations	Approve the SoA and the exclusion of controls	7 Control Implementation and Statement of Applicability (SoA)
  Verification and approval for use (8.1, A.6 and A.7)	Plan for review, verification and validation, records of approval for use (deployment, release), dataset register	Approve use	8 Verification and Use Approval
  Operational control (7.5, 8.1, A.4, A.6 and A.9)	Company-wide AI operational control register: programs (prompts) are registered by number and version, and risks, controls, review, approval, deployment, monitoring and change history are gathered on one line. You choose divisions such as department, division, project or site (a blank register template is free).	Control of the master copy and approval of updates	9 Operational Control
  Documented information control (7.5)	Reads the folder of manuals, procedures, guidelines and forms created in management system establishment, to give the document list, latest versions, revision history and the related documents that serve as the basis for each step	Approve the current version and clear out old versions	10 Documented Information Control
  Monitoring, change and revision management (9.1, 7.5)	Monitoring table for significant risks, change management records, revision management register, incident response	Approve changes and revisions	11 Monitoring, Change and Revision Control
  Internal audit (9.2)	Audit program and implementation plan (independence), checklists by department (based on the SoA), and an internal audit report from the audit records	Audit conclusions	12 Internal Audit
  Identification and monitoring of legal requirements (4.1, 6.1.3 and 9.1)	Research of official sources (Ministry of Government Legislation and overseas) to register in the AI legal requirements register, half-yearly and ad hoc review (changed laws, checklist judgment), applied to AI work	Judge applicability and compliance	13 Legal Requirements Identification and Monitoring
  Management review (9.3)	Management review inputs and outputs, decision tracking table	Review the AI policy and objectives, decide	14 Management Review
  Corrective action (10.2)	Takes internal audit results and nonconformities to give root cause analysis, corrective action plan, effectiveness check, and a list of assessments and SoA updates	Confirm causes and countermeasures	15 Nonconformity and Corrective Action
  Improvement (10.1)	Improvement opportunities, planning of improvement tasks, checking of effects, and what to feed back into next year's operation	Approve improvement tasks	16 Improvement

  * The knowledge-based management system AI transformation materials are connected to Management System Documentation, integrated management system document development, Standard Revision Response, Individual Document Development and ICT Management System Operation (excluding materials of individual customers and the original text of standards; recently revised materials take priority).
  These functions are available now. ICT Management System Operation (ISO/IEC 42001) is also available in 16 steps at the ICT Management System Operation Guide. Work such as nonconformity root cause analysis and corrective action, internal audit checklists and management review inputs is also done in the 16 steps of ICT Management System Operation Guide (ISO/IEC 42001 is not among the target standards of Management System Operation (Economic Prosperity and Social Value, 20 steps each)).
  If you use the documents created with Management System Documentation, establishment and operation continue in the same flow. Compare clause numbers with the original text of ISO/IEC 42001:2023.

  Operating principles

  1. Operating data belongs to the company. The platform is designed to be separate from the certification audit work of certification bodies and not to be used in audits without the company's consent.
  2. The platform handles notifications, drafts and aggregation; risk acceptance, impact decisions, the Statement of Applicability and the AI policy are decided and approved by the responsible person.
  3. Output created by AI is a draft for reference and does not guarantee certification. In eiso, AGENT does not artificially write or review the documents of individual companies (implementation consulting and training are provided separately from eiso: see Management System Establishment and Training Inquiries).
  ICT Management System Operation Guide Management System Documentation Individual Document Development Standard Revision Response
• eiso + AI establishment in 44 steps
• A Act39. Certification application to 44. Project closure

  C Check36. Internal audit to 38. Management review

  D Do15. Identifying the necessary documents to 35. Implementation

  P Plan1. Selecting the management system to 14. Review of risk and impact assessment and Statement of Applicability
• Main content of each eiso step

• P. Plan - main steps and content

  No.	Process	Work content (related clause)	AI use · Output
  1	Select the relevant management system	Select ISO/IEC 42001 and decide whether to integrate it with the ISO 9001, 14001 and 45001 you already operate. Because the clause structure (Harmonized Structure) is the same, Clauses 4 to 10 can be used together.	Find ISO Reference Materials Find the related grounds for existing standards and for common and additional requirements
  2	Decide the AI role and select the scope	Decide whether the company develops and supplies AI or only uses it, and decide the AI systems and sites in scope. (4.1, 4.3)	Management System Documentation Draft scope statement Human The Statement of Applicability is not finalized until the role is decided
  3	Select project organization members	Select them to include people from operations, IT and data, information security, and personal information and legal affairs.	As far as possible, section chief level or above, giving priority to those with experience in introducing and operating AI
  4	Organization structure	Decide the top management, the AI risk management owner, the AI management system practitioner and the administrator, and set the owner for each AI system and the reporting route for concerns. Roles and responsibilities (RACI, a table setting out who executes and who approves) and approval authority must match the approved organization chart and appointments. (5.1, 5.3, A.3)	Management System Documentation Draft roles and responsibilities table - Prepare the project organization chart - Do not leave blanks such as "to be confirmed" in documents
  5	Work allocation	Allocate work by process, by AI system and by project step.	Management System Documentation Draft WBS and schedule based on the 44 steps
  6	Kick-off meeting	Explain to everyone the direction of the AI policy, responsible AI principles, risks and opportunities, and the means of achieving objectives. (5.2, 7.3)	Training Materials and Lesson Plans Draft explanatory materials
  7	Obtain the relevant standards	Obtain and distribute ISO/IEC 42001 and related standards (ISO/IEC 22989 terminology, 23894 AI risk management, 42005 AI impact assessment) and applicable laws and regulations (the AI Framework Act, the Personal Information Protection Act, etc.).	Find ISO Reference Materials Clause commentary: compare with the original text - List of legal requirements and compliance obligations
  8	Current status survey	Survey the documents and records in use together with in-house AI systems, generative AI services in use, data processed and suppliers. Also look for AI used without approval (shadow AI). (4.1, A.4)	Management System Documentation Compile the results of the survey by department into a list - AI system inventory, documented information list
  9	Identify the necessary processes	Define the AI life cycle (planning → design → data → development → verification and testing → deployment → operation → change → retirement) and the data management process, and integrate them with existing processes. For the user type, the focus is introduction, use and retirement. AI tasks (introduction and development cases) are managed through one entry point from registration → review and approval → deployment → operation → completion. (4.4, A.6, A.7)	Process mapping - turtle diagram Management System Documentation Draft inputs, outputs and controls for each step - AI task registration entry point
  10	Identify interested parties and issues	Determine AI-related internal and external issues (laws and regulations, technological change, social expectations) and the requirements of interested parties (customers, end users, employees, suppliers, regulators, vulnerable groups). (4.1, 4.2)	Management System Documentation List of candidates by industry Human Select and confirm
  11	Identify AI risks	Set risk criteria (likelihood × severity) and, for each AI system, identify technical risks (malfunction, hallucination (inventing facts that do not exist), performance degradation), data risks (personal information, bias, quality), ethical and social, legal, and supply chain risks. (6.1.1, 6.1.2)	Management System Documentation Presents risk candidates - AI risk assessment table - AI system impact assessment report Human Decide the risk level and judgment
  12	Risk assessment and AI system impact assessment	Calculate the risk level and register significant risks; for AI systems that meet the criteria set by the company (for example, systems with high risk), assess the impact on individuals, groups and society. (6.1.2, 6.1.4, A.5)
  13	Treatment plan and Statement of Applicability	Decide the treatment options and decide whether to accept the risks that remain after treatment (residual risk). For each of the 38 Annex A controls, record in the Statement of Applicability whether it is applied, partially applied or not applied, with the reason. Set AI objectives. (6.1.3, 6.2)	Management System Documentation Risk-to-control mapping table, draft reasons for exclusion - Statement of Applicability (SoA)
  14	Overall review of the risk assessment	Experts review and supplement the risk assessment, impact assessment and Statement of Applicability, and the approver gives approval.	Human The AI draft is not finalized as it is. Reviewed three times: conformity with the standard, the viewpoint of the project owner, and the actual operating situation

• 11) to 14) Flow of AI risk assessment, impact assessment and Statement of Applicability

  AI system
  inventory

  →

  Identify risks
  AI proposes candidates

  →

  Calculate risk level
  Likelihood × severity

  →

  If high risk,
  impact assessment

  →

  Select treatment and controls
  Compare with Annex A

  →

  Statement of Applicability

  →

  Approval by the responsible person
  Deployment gate

  Risk level (1 to 25)	Grade	Treatment direction	Approved by
  1~6	Low	Maintain current controls (accept)	Practitioner
  7~12	Medium	Consider mitigation measures	Practitioner
  13~19	High	Mitigation measures required + AI system impact assessment	Risk owner
  20~25	Critical	Hold deployment, reassess after mitigation	Top management

  * The grade ranges and approvers are examples for explanation. Set them according to the company's risk criteria.
  * The impact assessment looks at safety, fairness (bias), transparency and explainability (whether it can be explained why the AI judged as it did), personal information, security, human oversight, and social and environmental impact. It assesses the size and scope of the impact and whether it can be reversed, and nothing is deployed without approval. This approval procedure is called the deployment gate.
  * The risk assessment is carried out again at new introduction or development, periodically during operation, and when the model, data or purpose changes, after an incident, and when laws are revised.

• D. Do - main steps and content

  No.	Process	Work content (related clause)	AI use · Output
  15	Identify the necessary documents	Determine the documented information that 42001 requires (documents and records to be controlled: AI policy, scope, AI objectives, risk assessment and treatment, impact assessment, Statement of Applicability, roles and responsibilities) and the procedures and guidelines. (7.5)	Find ISO Reference Materials Find the related grounds for the documents required by each clause - Requirements (Clauses 4 to 10, Annex A) to documents matrix - Supplements the output of No. 8
  16	Identify the necessary records	Determine the AI system records (inventory, data source and quality, verification and test results, deployment approval, operation logs, incidents, training completion) and forms. (A.6, A.7)	↑
  17	Decide the necessary documents	Decide the necessary documents (manual, policy, scope and Statement of Applicability, procedures, guidelines, forms) according to the scope and the AI role. Parts that overlap with the 9001, 14001 and 45001 documents are integrated.	Management System Documentation Document structure table and draft procedures created by entering company information (industry, AI systems, key indicators); the company fills in the company-specific values - For existing 9001, 14001 and 27001 documents, specify the folder and "integrate with existing documents" Individual Document Development One document you need separately, such as a generative AI use guideline, document type "Guideline", with an existing guideline as the reference document
  18	Write company-specific descriptions	Rewrite the descriptions that each company must write anew in the draft to reflect the company's circumstances. Do not copy sentences from other companies' cases as they are.	Management System Documentation Gap analysis of the whole folder: marks where draft sentences were left as they are and where company-specific descriptions are missing - Preparation for the audit's check of "organizational uniqueness"
  19	Move the identified documents	Move the finalized documents to "Company XX Management System Documents", and upload existing in-house rules (information security, personal information, AI use guidelines) in Word or Excel.	Upload to eiso
  20	Establish the document numbering system	Decide a document numbering system covering quality, environment, occupational health and safety, and AI (for example, manual MN, policy PL, procedure PR, guideline GD, form FM).	Supplements the output of No. 8
  21	Assign document numbers	Assign a document number to every document.	↑
  22	Reflect the company name and logo	Put the company name and logo (CI) on every document.	-
  23	Select operating record forms	Select forms such as the AI risk assessment table, AI system impact assessment report, change request form, AI training completion certificate, legal requirements list, supplier information request form and AI system inventory.	Refer to the eiso template folder - A writing example for each form
  24	Select management system forms	Among the internal audit, corrective action and management review forms, select those to be used together with the existing management systems.	Integrated use
  25	Move the identified forms	Move the identified forms to the "Operating records" folder.	-
  26	Assign form numbers	Decide the form numbering system and assign a number to every form.	-
  27	Review and supplement the document system	Compare the documents with the 42001 requirements and Annex A controls to confirm that no clause or control is missing.	Management System Documentation Gap analysis of the whole folder: requirements (Clauses 4 to 10, Annex A) to documents comparison table, missing documented information
  28	Review by process for implementation	Comprehensively review the inputs, outputs and controls at each stage of the AI life cycle and the deployment gate (no deployment before approval of verification and impact assessment).	Supplements the outputs of Nos. 8 and 9
  29	Correct problems and approve	Correct the problems in each process and obtain the approver's approval. Parts written by AI are approved by the same criteria.	Human Approval
  30	Implementation training	Train on the AI policy, procedures by role and the generative AI use guideline (information that must not be entered, approved services). (7.2, 7.3)	Training Materials and Lesson Plans Training materials and assessment questions tailored to audience and time - AI training completion certificate
  31	Pilot implementation	Operate risk assessment → impact assessment → controls → monitoring for a set period with one or two representative AI systems.	-
  32	Support for pilot implementation	Project promoters in each department visit the site to support implementation and recording methods.	-
  33	Consolidate problems	Collect the problems that arose during the pilot period.	Management System Document Preparation Classification and summary of problems
  34	Drafting and approving the revisions	Revise the documents and forms and obtain approval from the approving authority.	Management System Document Preparation Integration with existing documents: revision drafts reflecting the problems found in the pilot implementation (marked (Revised) and (Added))
  35	Implementation	Set an official implementation date, operate, and monitor performance indicators, AI incidents and changes. When commercial generative AI is used, define what will be verified (harmfulness, inclusion of personal information or confidential information, possibility of leakage, compliance with internal standards), how often, and by whom. Then sample part of the usage records, verify them and keep the results. (8.1, 9.1, A.9)	Monitoring, performance management and AI incident management - Use the number of verifications, detections and actions as performance indicators

• 17) ISO/IEC 42001 documentation system (example)

  Step	Document type	Content
  Step 1	Manual	AI management system manual: sets the policy and the direction for implementing requirements according to Chapters 1 to 10 of the Harmonized Structure
  	Policy and statements	AI policy, scope, Statement of Applicability (Annex A controls)
  Step 2	Procedures	AI risk assessment and treatment (6.1.2, 6.1.3), AI system impact assessment (6.1.4), AI system life cycle and operation (8), monitoring and measurement (9.1), internal audit (9.2), management review (9.3), nonconformity and corrective action (10.2), control of documented information (7.5), etc.: defined to suit the company's role in AI
  Step 3	Guidelines	Practical guidelines the company needs, such as the use of generative AI and AI data management
  Step 4	Forms and records	AI risk assessment form, AI system impact assessment report, AI system list (inventory), list of legal requirements, training records, etc.

  Note: The document structure differs according to the company's role in AI and its size, and is tailored to the company through Management System Document Preparation. A user-type company that does not develop AI can shorten the life cycle procedures into procedures for introduction and use. Record the basis for the judgment in the Statement of Applicability.

• C. Check / A. Act: main steps and content

  No.	Process	Work content (related clause)	AI use · Output
  36	Internal Audit	After operating for a certain period, audit the implementation of the ISO/IEC 42001 clauses and the controls in the Statement of Applicability by sampling. (9.2)	ICT Management System Operation Audit checklists by clause and control, confirmation sheets by department Training Materials and Lesson Plans Internal auditor training materials
  37	Corrective action for problems	Take corrective action on nonconformities and reflect it in the documents and records. (10.2)	ICT Management System Operation Draft cause analysis, schedule for effectiveness verification Human Confirmation of causes and countermeasures, corrective action report
  38	Management Review	Review the AI policy, taking as inputs the achievement of AI objectives, the results of risk and impact assessments, AI incidents, the opinions of interested parties, changes in laws and technology, and audit results (not only internal audits but also customer and supplier audits and certification audits). (9.3, A.2.4)	ICT Management System Operation Summary of input materials - Management review report
  39	Certification application	Select a certification body that can certify to ISO/IEC 42001 and apply. Please confirm that it is an accredited third-party certification body (within the scope of accreditation by an accreditation body such as KAB).	Selecting a certification body - certification application - certification contract
  40	Stage 1 audit	Undergo the Stage 1 audit by a third-party certification body to identify problems with conformity and readiness.	-
  41	Corrective action for findings	Take corrective action on the findings and revise the documents and forms.	-
  42	Stage 2 audit	Undergo the Stage 2 audit to confirm whether the system is actually implemented (implementation) and effective (effectiveness). The audit checks whether the AI system records match actual operation.	-
  43	Corrective action for findings	Take corrective action on the findings and revise the documents and forms.	-
  44	Project closure	Close the project and use the project team members as internal auditors and AI system assessors. When introducing new AI, changing models, data or intended use, or when laws are revised, repeat Steps 11 to 14. (10.1, 6.3)	Continual improvement Response to Standard Revisions When a standard operated together is revised, the documents to be revised or newly established and the related forms

• Annex A controls and documents and records

• Control	Control objective	Summary	Examples of documents and records
  A.2	Policies related to AI	Establish the AI policy, align it with other policies and review it regularly	AI policy, management review
  A.3	Internal organization	Define AI roles and responsibilities and enable concerns to be reported	Manual (roles and responsibilities), reporting procedure
  A.4	Resources for AI systems	Identify and document data, tools, systems, computing and human resources	AI system inventory
  A.5	AI System Impact Assessment	Assess and record impacts on individuals, groups and society	Impact assessment procedure, impact assessment report
  A.6	AI system life cycle	Manage requirements, design and development, verification and validation, deployment, operation and monitoring, technical documentation and event records	Development, construction and technical support procedure, deployment approval records
  A.7	Data for AI systems	Define how data is acquired, its quality, provenance and preparation	AI data management guidelines
  A.8	Information for interested parties	Define the provision of information to users, means of external reporting and incident notification	Instructions for use and AI notice, incident management procedure
  A.9	Use of AI systems	Define procedures and objectives for responsible use and use systems only for their intended purpose	Generative AI use guidelines
  A.10	Third-party and customer relationships	Allocate responsibilities with suppliers, customers and partners and manage suppliers	Supplier and customer relationship management procedure, supplier information request form

  Note: The summaries of the control objectives are shortened for ease of understanding. Please confirm the wording and numbering of the controls by checking them against the original text of ISO/IEC 42001:2023.

• Points to check from a case of a manufacturing company's implementation

• Based on a case of a user-type manufacturing company that uses AI in its business and implemented ISO/IEC 42001, we have summarized points that similar companies should prepare for in advance. Even if the company as a whole is a user-type company, each department uses AI in a different way, so the controls each department needs to address differ.

  Department	Key controls	Evidence to check (examples)
  Department responsible for AI	A.2 Policy, A.3 Roles and reporting of concerns, A.4 Resources, A.5 Impact assessment, A.6.2.5 to A.6.2.6 Deployment and monitoring, A.8.4 to A.8.5, A.10.2 to A.10.3	Policy approval and distribution, roles and responsibilities (RACI), records of registration, approval and monitoring of AI projects, evaluation of external AI service providers
  Human resources	A.5.4 Impact on individuals and groups, A.9 Responsible use, A.4.6 Human resources	Evaluation of fairness and bias in AI used for recruitment and evaluation, and human review of final decisions
  Legal and compliance	A.2.3 Alignment with other policies, A.7.5 Data provenance, A.8.3 External reporting, A.10	Legality of copyright and personal information in data used for AI, contractual responsibilities for external AI services
  Planning	A.2.2 Policy deployment, A.5.2 Impact assessment process, A.9.3 Objectives for use	Reflection of the AI policy in departmental objectives, starting impact assessment at the planning stage of new AI projects
  Finance and accounting	A.9.4 Intended use, A.7.4 Data quality, A.6.2.8 Event records	Human approval of automated decisions, data accuracy and integrity, retention of processing history (audit trail)
  Development	If AI is developed or tuned in-house, A.6 and A.7 apply in full; if it is only used, A.9 applies	Requirements, verification, technical documentation and logs / control of the use of coding assistant AI
  Research and design	A.7.3 Data acquisition, A.7.5 Data provenance, A.9	Provenance, intellectual property and legality of materials entered into generative AI and of its outputs
  Sales	A.10.4 Customers, A.8.2 Information for users, A.5.4 Impact on individuals	Notice of AI use to customers, quality of customer and sales data

  Note: The controls actually audited follow the company's Statement of Applicability. The above is an example for a user-type manufacturing company.

• Points to prepare in advance

  1. Reconfirm the role in AI for each department. Even if the company is a user-type company, if a department builds or tunes AI directly, all the life cycle (A.6) and data (A.7) controls apply to that department.
  2. Track AI projects to the end. If a registration desk is set up, the entry (registration, review, approval) is managed well, but the exit, such as registering the completion of a project after implementation, is easily missed. Regularly reconcile the registration status with the actual projects.
  3. Do not stop at monitoring the use of generative AI; verify it. Define the verification items (harmfulness, inclusion of personal information or confidential information, possibility of leakage, compliance with internal standards), the sampling frequency and the person in charge, record the results and reflect them in the performance indicators. Usage records (logs) serve as the basis.
  4. Do not leave blanks in documents. AI drafts easily leave placeholders such as "to be confirmed", and approval authority may be written differently from document to document. Align the approved organization chart, appointments, RACI (roles and responsibilities chart) and authorities in one pass.
  5. Widen the inputs to management review. Treat not only internal audits but also the results of customer and supplier audits and certification audits as inputs.
  6. Keep a requirements-to-documents correspondence table. Organizing, as an annex to the manual, where each requirement of Chapters 4 to 10 and Annex A is addressed in which document makes audits and operation easier.
  7. Review documents created by AI three times. Review them in this order: conformity to the standard, the viewpoint of the person responsible for implementation, and reflection of actual operating status, and keep the result as a review report.
• Principles to observe when using AI
• 1. AI drafts; people decide. The responsible person decides and approves the risk level, the impact assessment judgment, the reasons for exclusion in the Statement of Applicability and the AI policy.
  2. Confirm the basis. Check clause numbers and figures against the original text of the standard, and leave content for which no basis can be found as "to be confirmed".
  3. Rewrite it in the company's own words. If sentences from another company's case are copied as they are, it is difficult to have the organization's uniqueness (content specific to the company) accepted in an audit.
  4. Some information must not be entered. Do not enter personal information, trade secrets or contractually confidential information into external AI. Name the services approved by the company in the generative AI use guidelines, and do not use AI that has not been approved (shadow AI).
  5. AI used for the build is also subject to management. Add it to the AI system inventory and manage it under the generative AI use guidelines (A.9). Building an AI management system with AI becomes your company's first implementation case.
  6. Document preparation support and certification audits are separate. AI drafts or consulting do not guarantee certification, and certification audits are carried out through an independent procedure to ensure impartiality (ISO/IEC 17021-1).

• Note: For fees, see eiso Pricing; for inquiries about introduction, please contact Management System Establishment and Training Inquiries or AGENT Co., Ltd (eiso@eiso.co.kr).

  eiso Pricing Management System Establishment and Training Inquiries

  References: eiso 44-step establishment method (based on an ISO 45001 establishment case), AGENT Co., Ltd's "Management System Establishment Methodology", and a case of a user-type manufacturing company implementing ISO/IEC 42001 (company name not disclosed). Please confirm the standard clauses by checking them against the original text of ISO/IEC 42001:2023.