ISO/IEC 42001 FAQ Risk Controls

Follow the Clause 6.1.3 sequence for each assessed risk: select a treatment option; determine every necessary control; compare that set with Annex A to check for omissions; consider relevant Annex A controls and Annex B implementation guidance; add different or additional controls where needed; produce the statement of applicability; formulate the treatment plan; and obtain designated-management approval of the plan and residual AI risk.

Annex A is normative as a reference control set within ISO/IEC 42001, but not every listed control applies to every organisation or system. Annex B is normative implementation guidance, although the organisation does not have to document or justify the inclusion or exclusion of that guidance in the statement of applicability. The risk assessment, chosen treatment, objectives, and applicable external requirements determine the actual control set; a team may need controls beyond Annex A.

Use system-specific examples to test the reasoning. A supplied AI service can require supplier documentation, intended-use instructions, logging, monitoring, and incident routes. A model trained internally can also require data acquisition, quality, provenance, preparation, verification, release, and change controls. An AI tool affecting people can require impact assessment, accessible user information, adverse-impact reporting, and meaningful human oversight. These examples are not a universal checklist.

The statement of applicability must contain the necessary controls and justify their inclusion and exclusion. An exclusion can be justified when the control is not necessary under the risk assessment and is not required by applicable external requirements, including where an external requirement provides an exception. The statement is not permission to omit a control that the selected treatment or an external requirement makes necessary.

Evidence should show design, implementation, operation, and effectiveness: the risk assessment, treatment decision, statement of applicability, control description, scope, owner, procedure or technical configuration, implementation record, sampled transactions or logs, monitoring method and result, exceptions, residual-risk approval, findings, corrective actions, and review date.

A reviewer should be able to trace from an AI objective and assessed risk to the selected control, its implementation, current operating samples, effectiveness result, exception handling, and residual-risk decision. A policy, screenshot, vendor claim, or control title by itself rarely shows the full chain.

Match the evidence to the control. Supplier controls can use due-diligence records, contract requirements, documentation received, change notices, service reviews, and correction requests. Data controls can use acquisition approvals, provenance, quality criteria and results, lineage, and preparation records. Human-oversight controls can use competence evidence, interface tests, sampled interventions, escalations, and workload measures.

Control owners design, implement, operate, and monitor controls within their authority. Risk owners evaluate the remaining exposure. The designated management authority approves the risk-treatment plan and accepts residual AI risk. AIMS governance can check coverage and consistency, while top management addresses resources or risk decisions outside delegated authority.

Security, privacy, safety, supplier, legal, product, and business owners should approve matters within their authority. Acceptance of residual AI risk under the AIMS cannot waive a binding legal, contractual, or sector requirement.

Review controls through planned monitoring and whenever risks, impacts, intended purpose, users, affected populations, data, model or system design, suppliers, deployment context, incidents, performance, or applicable requirements change. Review before a significant planned change and after an unintended change or control failure.

When a treatment option is ineffective, ISO/IEC 42001 requires review and revalidation through the treatment process and an updated plan. Determine whether to redesign, add, replace, or withdraw controls; reassess the risk and impact; update the statement of applicability; obtain approval; and verify the revised treatment.

After a nonconformity, control and correct it, deal with consequences, examine causes and similar potential failures where applicable, implement corrective action, and review effectiveness. Keep the remaining risk open until the relevant approval authority accepts it against current criteria.