Operation track If you choose Economic Prosperity (based on ISO 9001) or Social Value (environmental protection and social justice), you are taken to Management System Operation. Your industry is carried over, and the results of each step are passed on to one another in this browser.
Standard to operate ISO/IEC 42001 AI management system ISO/IEC 27001 Information security management system If you select nothing, only ISO/IEC 42001 is operated. If you also select ISO/IEC 27001, the Statement of Applicability is kept separately for each standard and the two are linked through a control mapping table (see "Standards operated together" above).
Operation mode Shown only when two standards are selected. Integrated operation runs the two standards as one flow; independent operation writes each standard separately on its own operation platform (tab above).
Scope (AI role) * Development Design, develop, train and test AI systems and models (in-house development, development commissioned by customers) Supply Provide AI products and services to customers (sale of in-house products, integration or resale of external AI) Use Use external or in-house AI in work and projects (generative AI, vision inspection, predictive models, etc.) Choose this before the operation step. You may choose more than one. The scope you choose applies to all the steps (inventory, risk assessment, SoA, approval, monitoring, change, audit) and is remembered in this browser.
Operation step * 1 AI Context Analysis: interested parties, PESTEL, SWOT (clause 4) 2 AI Policy, Roles and Objectives: AI policy, AI objectives and plans to achieve them (5.2, 6.2) 3 AI Selection: six-axis evaluation and prioritization by task, project and division 4 AI System Inventory: role, scope of use, evaluation type Operation (Clause 8) └ 5 Operational Planning and Control: Annex A 10 control objectives and 38 controls, operating criteria, projects (8.1) └ 6 Verification and Use Approval: V&V, deployment gate, lifecycle, data └ 7 Operational Control: AI program (prompt) operational control register, lifecycle └ 8 AI Risk Assessment: likelihood × severity, treatment plan (8.2) └ 9 AI Risk Treatment: control implementation, Statement of Applicability (SoA), human oversight, compliance obligations (8.3) └ 10 AI System Impact Assessment: seven high-risk areas (8.4) 11 Documented Information Management: creation, approval, distribution, revision, retention (7.5) 12 Monitoring in Use: changes, revision control, incidents 13 Internal Audit: plan, checklist, report (independence) 14 Legal Requirements Identification and Monitoring: AI legal requirements register, semiannual review, compliance judgment 15 Management Review: inputs and outputs (decisions, resources, changes) 16 Nonconformity and Corrective Action: reflecting internal audit results, root cause, effectiveness 17 Improvement: improvement opportunities, improvement tasks, operation for the next year 1 AI Context Analysis: ISO/IEC 42001 clause 4: interested party analysis (4.2) → PESTEL and internal issues (4.1) → SWOT and cross strategies → strategy action plan → review by CEO and CFO → linkage table for 6.1, 6.2 and 9.3 When you enter your industry, the AI researches on the web the external trends of that industry (opportunities and threats), trends in AI adoption and regulation, and the needs and expectations of interested parties. It then analyzes these together with the content and materials you provide (sources and reference dates are shown). Interested parties that you enter under "Interested parties (direct input)" below are used as they are, and only the blanks are supplemented. Analysis method * First choose the analysis method (more than one is possible): only the sections for the methods you choose are written.
Interested party analysis (4.2) Identification of interested parties, needs and expectations (including AI subjects), clause mapping, 4.2 self-diagnosis: what to do first SWOT analysis Strengths, weaknesses, opportunities, threats + cross strategies (SO, ST, WO, WT) PESTEL analysis Political, economic, social, technological, environmental, legal (including AI regulation) + industry structure (Five Forces) 7M analysis Internal analysis from the viewpoints of manpower, machines, materials, methods, measurement, environment and management (funds) Interested party analysis (4.2) is done before the analysis of the organization's context, so it is selected by default together with SWOT. If you select nothing, interested party analysis + SWOT is used. The judgment on the relevance of climate change is always included, regardless of the methods selected.
Upload materials 📁 Select a folder 📄 Upload files (multiple) When you upload a folder or several files, each is placed in a field according to its file name: interested parties → Interested parties (direct input); business plan → Business plan for the current year; management review, performance, analysis, KPI → Management analysis materials for the previous year; strengths, weaknesses, SWOT, audit, survey → Strengths and weaknesses analysis materials; everything else → Situation and data summary.
Business plan for the current year
Management analysis materials for the previous year
Strengths and weaknesses analysis materials
Basic information Interested parties (direct input)
If left blank, a general list of interested parties (8 to 12 items, marked "(General)", to be confirmed by the organization) suited to your industry, AI systems and AI role is used. What you enter is used as it is, and only the blanks are filled in and marked "(Supplemented)".
AIMS scope (draft) Company website 2 AI Policy, Roles and Objectives: AI policy and AI objectives (focused on effectiveness and efficiency, three or fewer) → Word document "AI Policy and AI Objectives" It is written on the basis of the results of 1 AI Context Analysis, 4 AI System Inventory, 8 AI Risk Assessment, 10 AI System Impact Assessment, 13 Internal Audit and 16 Nonconformity and Corrective Action (results stored in this browser are passed on automatically). Existing AI policy and objectives 📄 Upload policy and objectives files ↧ Import the stored step 2 result 11 Documented Information Management: list, latest versions, revision control and reference documents by process for the document folder created in Management System Establishment This step does not write new documents. Place the manuals, procedures, instructions and forms created in Management System Establishment (Management System Document Writing, Integrated Document Writing, Individual Document Writing) in a designated folder on your computer (recommended: AI Management System\00_Documents) and specify that folder below. Existing document list 📄 Upload document list files ↧ Import the stored step 11 result 3 AI Selection: understand the work → AI six-axis evaluation → use of existing AI (extend as is → reuse a derivative → develop new) → adoption priority → schedule When you specify below a folder or files containing the task assignment table, organization chart, project list and process map, all tasks within the scope are gathered by the unit you choose (project, department, division, process) and evaluated on six axes. For each priority task, AI already in operation is looked for first, and the order of application and the schedule are set as: extend as is → reuse a derivative → develop new. Leave nothing out: please also upload not only the tasks written in the task assignment table, but also customary tasks that are not in any document yet are always done (organizing meeting minutes and reports, handling emails and inquiries, collecting and compiling data, cross-checking papers, preparing checklists, etc.). If you also specify files containing the names of forms, records and registers, meeting bodies and reporting cycles, the AI finds customary tasks and marks them "Customary", and reconciles the number of tasks per unit so that you can see nothing has been missed. Selection threshold 50 points 60 points 70 points 80 points Each task is given a selection score (out of 100) using the scoring below. Only tasks that are at or above the threshold and are P1 or P2 are selected and passed to 4 AI System Inventory (P3 and "Not applicable" are put on hold regardless of the score, and tasks within 5 points below the threshold are marked "Borderline").
Criterion Category and points Frequency of repetition Once a week or more
25 pts
Monthly
15 pts
Irregular
5 pts
Difficulty of judgment Structured
20 pts
Semi-structured
12 pts
Expert judgment required
4 pts
Expected effect (hours saved per month) 20 hours or more
15 pts
5 to 20 hours
10 pts
Under 5 hours
4 pts
Cost of errors Minor
15 pts
Rework
10 pts
Regulation, contract or certification
3 pts
Confidentiality level A
15 pts
B
10 pts
C
2 pts
Use of existing AI Extend as is
10 pts
Reuse a derivative
6 pts
Develop new
0 pts
Start date Planning period 3 months 6 months 12 months Capacity to proceed Existing AI selection table (update) 📄 Upload the selection table file (Excel) ↧ Import the stored step 3 result The Excel "AI Selection Table" is kept on your computer (AI Management System\03_AI Selection\unit name) for each department, division, project or process unit, and used at all times. When the organization is reorganized, task assignments change, a new project starts, customary work changes, or new AI is adopted, or every half year, upload the file of that unit here to update it.
Review of registered AI for reuse: before building anew, start from the AI already registered in the company If you enter the step 7 operational control register (the one stored in this browser or a register file), then for each AI newly needed, similar registered AI is searched for and recommended in this order: (1) extend as is (only the deployment targets increase), (2) reuse a derivative (modified for use; only the changed parts are evaluated), (3) develop new. If the confidentiality level, the subjects or automated decisions differ, a formal reassessment is recorded even when the AI is similar. Registered AI register 📄 Upload register files ↧ Import the stored register (step 7) AI selection result (step 3 Excel) 📄 Upload the selection table file (Excel) ↧ Import the stored step 3 result Extending as is continues the original AI, reusing a derivative covers only the changed parts, and developing new covers everything.
4 AI System Inventory: list in one place the AI systems and projects in use or planned for the tasks selected in step 3 (input to 8 Risk Assessment, 10 Impact Assessment and 6 Statement of Applicability) First review the evaluation criteria below. The scope-of-use LEVEL (1 to 4), the evaluation type (formal, simplified, excluded) and the scope are decided by these criteria. If your internal rules differ, enter them under "What to change to your own criteria" and those criteria are used. Register each system with its purpose, AI role, supplier, model, input data, the subjects affected by the output and the scope of use. Download the result as the Excel "AI System Inventory" and use it as the input for steps 8, 6 and 7. LEVEL Scope of use: determination criteria Approving party LEVEL 1 Individual: used by one person only within their own PC, no connection to real data Confirmation by the person concerned LEVEL 2 Department: used together at department level (shared DB or folder required) Confirmation by the department in charge of AI LEVEL 3 Site: used at site level, or connected to real data of core systems (ERP, MES, etc.) Approval by the department in charge of AI LEVEL 4 Company-wide: used company-wide, provided to external customers or the public, or deployed company-wide with core system connection Approval by the department in charge of AI + management
Formal evaluation: if any one of the following applies: (1) directly exposed to external customers or end consumers, (2) large-scale processing of personal information, or automated decision-making about people such as recruitment or personnel evaluation, (3) LEVEL 3 or 4, (4) connection to real data of core systems Simplified evaluation: other LEVEL 2 (formal if personal information is processed or real data is connected; even if simplified, it switches to formal when the risk is 13 points or more) Excluded: LEVEL 1 (cannot be excluded if any of (1), (2) or (4) applies) · even if excluded, it stays in the inventory and the common controls apply Scope: included if within the scope (site, organization, AI role); AI operated independently by sites or affiliates planned for later expansion is excluded (record the reason) If the two criteria differ, the stricter one applies: when in doubt, formal I have reviewed the evaluation criteria (required) * What to change to your own criteria Statement of Applicability (SoA) 📄 Upload the Statement of Applicability file (Excel) ↧ Import the draft (step 4) ↧ Import the final version (step 9) The Statement of Applicability is the central document of the AI management system. The draft (first applicability judgment before risk assessment) is made from 4 Inventory, 8 Risk Assessment chooses controls based on that draft, and in 9 AI Risk Treatment all 38 controls are finalized (approved by top management). Steps 5 to 7 and 11 to 17 update the implementation status and evidence. Steps 8 to 10 automatically import the draft, and from step 6 the final version, when the field is empty.
AI system inventory (step 4) 📄 Upload the inventory file (Excel) ↧ Import the stored step 4 result 8 Risk Assessment assesses all AI whose evaluation type is formal or simplified and whose scope is included; 10 Impact Assessment takes the impact assessment candidates in the inventory; 7 Statement of Applicability takes over the AI role and scope.
9 AI Risk Treatment and Statement of Applicability: (1) suggest controls suited to the risks → your company selects controls → (2) Statement of Applicability from the selected controls The controls in Annex A (38 controls) and Annex B (implementation guidance) are the means of responding to the significant risks of steps 8 and 6. First click "(1) Suggest controls" to receive control measures for each risk and a control selection table (suggestion: applicable or excluded). In the selection table below, choose applicable or excluded for each control, then click "(2) Write the Statement of Applicability". Suggestions follow the scope (development, supply, use) chosen above, and the final decision is made by your company. Writing stage Control selection table (your company's decision) ↧ Fill in from the result of (1) Selection to submit 📄 Upload the revised selection table (Excel) 6 Verification and validation, approval for use: implement the AI for each task in the inventory, then review, verify and validate it → the approver authorizes use (no use before approval) Set review, verification and validation criteria for each AI (number, Rev, revision control) and judge it from test results. After confirming that the controls in the Step 9 approved version are implemented, top management approves the use of AI with significant risks or subject to impact assessment, and a person responsible to whom top management has delegated authority approves the use of all other AI. A lifecycle-stage control record and a register of training and operational datasets are also prepared. Delegated approval owner Existing V&V criteria for each AI (revision control) 📄 Upload criteria file ↧ Import saved Step 6 results 9 Operational management: company-wide AI operations management register (Excel) Register the approved AI programs in use (instructions, prompts, custom GPTs, automations, API integrations, in-house models) in a single register, and manage each program on one line through registration → risk assessment → control method → review → approval → deployment → monitoring → change history. An updated version is created from the Steps 4 to 6 and 8 to 10 results (shared between steps in this browser) and the register file you currently use; download the result with "Download as Excel". ⬇ Download the blank register template (Excel) free of charge No login or payment is required. It includes drop-down lists and risk and grade formulas. Register division Choose how to divide the register. The "Division criterion" and "Division name" columns of the register and the summary sheet are grouped by this criterion.
Existing AI operations management register 📄 Upload register file ↧ Import the stored register (step 7) 13 Internal audit: prepare a plan, checklists and a report from source materials and reference documents Source materials are designated in one place, "Designate source materials", just below. Reference documents (previous audit reports, your own forms such as plans, checklists and nonconformity reports, and internal standards) are followed in their format and numbering. Auditors are assigned so that they do not audit their own department, and controls excluded as not applicable in the SoA are removed from the checklist. To be prepared Internal audit plan (annual program and per-audit execution plan) Annual program, per-audit execution plan, timetable by department, auditor independence Checklist by department For each department: clauses, Annex A controls, points to verify, audit methods and examples of evidence (Excel) Internal audit report Prepared from the findings in the internal audit register; findings go to 16 Nonconformity and corrective action Management review inputs Summary for the meeting, aligned with the 9.3 input items Audit schedule Auditor information Reference document 📁 Designate folder 📄 Upload files (multiple) Upload previous audit reports, your own forms, checklist templates, internal standards and similar as a folder or files, and their format and numbering will be followed (read only within your browser).
13 Identification and monitoring of legal requirements: research official sources (Ministry of Government Legislation and overseas), prepare an AI legal requirements register, and review it every half year or as needed for application to AI work Before writing, the AI researches the web for the Korea Law Information Center (law.go.kr), the Citizen Participation Legislation Center, the competent ministries and, for the regions you select, official overseas sources (such as EUR-Lex), and shows the source and date checked. The register is kept in this browser and becomes the baseline for the next half-year review; it feeds into 5 Risk assessment, 6 Impact assessment, 9 SoA, 8 Approval for use and 12 Management review. Designate records of implementation and evidence, as a folder or files, in "Designate implementation records and evidence" just below. Type of review Initial identification and registration in the AI legal requirements register First time: research the applicable legal requirements and register them in the register by clause and obligation Half-year review (amendment research and compliance evaluation) January and July: research amendments and new requirements for the baseline register, then evaluate with a checklist and prepare an action plan Ad hoc review (legal amendments and news) When news of a legal amendment arrives: impact judgement, changed rows of the register and an action plan Review of new AI introduction Before introduction: applicable legal requirements, checklist items and required actions Business regions Official sources for the selected regions are researched ("Other countries" is searched without restriction). The Republic of Korea is always included.
Applicable matters Sector-specific regulation Review reference date and period covered Baseline register 📄 Upload register file ↧ Import saved register (Step 14) ↧ Import Step 9 compliance obligations Subject of ad hoc review New AI system 16 Nonconformity and corrective action: take the 13 Internal audit results, correct nonconformities and prevent recurrence Internal audit results ↧ Import Step 13 results 15 Management review: prepare input guidance, a checklist, meeting facilitation and a results report from input materials (folder or files), internal audit and legal monitoring results (9.3) Management review input materials are designated, as a folder or files, in one place, "Designate management review input materials", just below. Missing 9.3.2 input items are checked and flagged as "incomplete", and the outputs are gathered in three tracks: (1) corrective action, (2) reflection in next year's business plan, (3) education and training. Top management chairs and approves the review. To be prepared Input guidance and preparation check Materials to prepare and preparation status for each 9.3.2 input item (incomplete items flagged) Management review checklist Prepared (Y/N), content checked, evidence and decisions needed (Excel) Meeting facilitation (organizing discussion notes) Opening → input review → discussion → decisions → closing, with discussion notes organized Management review results report (meeting records required) Prepared only from meeting records: overview, summary of inputs, discussion, decisions (three tracks), follow-up actions and conclusion Meeting information Internal audit results ↧ Import Step 13 results Legal monitoring results ↧ Import Step 14 results Meeting records 📄 Upload meeting record files 17 Improvement: find improvement opportunities from management review decisions, corrective action results and AI objective performance, and run them as improvement projects (10.1) Judge by suitability, adequacy and effectiveness, and proceed through the list of improvement opportunities → improvement project register (owner, deadline, resources, indicator: current → target) → effectiveness check → standardization and horizontal deployment of good practice → report to the next management review. Elimination of the causes of nonconformities is handled in 16 Nonconformity and corrective action. Supporting materials (KPI results, improvement suggestions, observations) can also be designated under "Designate materials" below. Management review results ↧ Import Step 15 results Corrective action results ↧ Import Step 16 results AI objective (KPI) performance Basis for impact assessment (1) Import risk assessment results : Impact assessment of items scoring 13 or higher, based on the results prepared in 8 AI risk assessment and kept in this browser (or a pasted risk assessment table). (2) Upload a folder or files : Designate, under "Designate materials" below, a folder or files on your computer containing the risk assessment table and AI system materials (purpose, data, model, test results, stakeholder opinions) for the impact assessment. An impact assessment is started only for items with a risk assessment risk level of 13 or higher (high risk 13 to 19, critical 20 to 25). Items below 13 are answered as "not subject to impact assessment". For uses involving safety, recruitment, evaluation, large-scale processing of personal information or exposure to external customers, a review of the score is recommended.
Risk assessment results ↧ Import Step 8 results Unit of selection By project By department By division By process The table is grouped by this unit. For each project, department, division or process, you can see which AI is used and where that AI stands in the management cycle (selection → risk assessment → controls → approval for use → operations management register → monitoring → change and revision control).
Industry For 1 AI context analysis, please be sure to enter your industry. Opportunities and threats in the industry, AI trends and interested parties are researched on the web.
Tasks and projects that use (or plan to use) AI AI systems and tools Designate the basic data on your computer: designate the folder or files for this step When you designate the basic data accumulated on your computer for this step (AI list, evaluation results, test records, monitoring logs, current forms), eiso processes, analyzes and consolidates it. Files are read only within your browser and only the text is placed in the box below; they are not sent to the server and not stored. Designate materials 📁 Designate folder 📄 Designate files (multiple) Names to mask
DOCX, XLSX, PPTX, HWPX, PDF and TXT. Files are read only within your browser and only the text is used (not stored, not used for AI training).
Materials on your computer Reference materials for risk assessment 📄 Upload reference files (multiple) If you upload the risk assessment procedure, assessment criteria, generative AI usage guidelines, statement of applicability, previous assessment registers, and legal and contract materials, they are used as the criteria and basis of the assessment (the AI items to assess are drawn from the work allocation, projects and organization chart in "Designate materials" above). Files are read only within your browser and are not stored.
Summary of context and data May be left blank if you have designated materials on your computer.
For 1 AI context analysis, may be left blank if basic information or the materials above are provided.
Requests Company Workspace (Not used) Manage workspaces » If you select a Company Workspace in 12 Monitoring in use, 13 Internal audit, 15 Management review, 16 Nonconformity and corrective action and 17 Improvement, the company's operational data (objectives and indicator register, incidents, and the internal audit, management review and corrective action registers) is attached to the AI request as figures calculated by the server and a short summary. It is the same data as in the corresponding steps of Management System Operation (15, 17, 18, 19 and 21), and it is used only for AI writing requests and not for training. In 2 AI policy, roles and responsibilities and objectives, "Include objective-setting materials" attaches past objective performance, significant risks, management review decisions and data sources (the same materials as Management System Operation 4 Objective setting). Results can be kept with that company by "Save to workspace", and are imported into objectives, indicators and action plan items in objective and performance monitoring.
