ISO 42001

Leadership approves a documented AI policy that sets the organisation's direction and commitments for developing, providing or using AI.

The organisation checks where its other policies (security, privacy, quality, procurement) touch AI and makes them consistent with the AI policy.

The AI policy is reviewed at planned intervals, and when significant change happens, so it stays suitable and effective.

Responsibilities for AI across its life cycle (ownership, risk, oversight, operation) are defined and given to named people.

Staff and others can report concerns about AI systems, including anonymously, and those reports are handled and protected from retaliation.

The data, tools, computing and people each AI system relies on are identified and documented.

Information about the data used by each AI system (sources, categories, provenance and quality) is documented.

The software tools, libraries, models and platforms used for AI work are identified and documented.

The computing, storage and hosting resources each AI system needs are documented, including where they run.

The people involved with AI systems have the competence they need, and their skills are recorded.

There is a defined way to assess the possible consequences of an AI system for people, groups and society, used across its life cycle.

The results of AI impact assessments are documented and kept for a defined period.

The organisation assesses how an AI system could affect individuals or groups (fairness, rights, safety, privacy) and acts on what it finds.

The organisation considers the wider effects an AI system could have on society, such as on the environment, the economy or public trust.

The organisation sets and documents objectives for responsible development (for example fairness, transparency, robustness) and builds them into its development work.

Processes for designing and developing AI systems responsibly are defined and followed, including gates and approvals.

Requirements for new AI systems, or significant changes, are specified and documented, including intended purpose and constraints.

The design and development of each AI system is documented, including model choices, training approach and trade-offs.

Verification and validation measures, with acceptance criteria, are defined and applied before an AI system is used and after changes.

Deployment of an AI system follows a documented plan, with checks that the requirements are met before it goes live.

The organisation defines what is needed to run an AI system, monitors its performance and behaviour, and handles failures and drift.

Technical documentation needed by users, operators and assessors is produced and kept current for each AI system.

The organisation decides which events an AI system should log, and keeps those logs for the stages where they are needed.

Processes for managing the data used to develop and enhance AI systems are defined, documented and followed.

How data for AI is obtained is documented, including the source, rights to use it and any conditions.

Quality requirements for AI data are defined, and data is checked against them.

The origin and history of data used by AI systems is recorded across its life cycle.

Methods used to prepare data (cleaning, labelling, transformation) are defined and documented.

Users of an AI system receive the information they need to use it properly, including its purpose and limits.

Interested parties outside the organisation have a way to report adverse effects of an AI system.

There is a plan for communicating AI incidents to users and others affected.

The organisation identifies what information about AI systems it must report to interested parties (such as regulators) and provides it.

Processes for using AI systems responsibly are defined and documented.

Objectives that guide responsible use of AI systems are identified and documented.

AI systems are used according to their intended use and documentation, and use outside that is detected.

Responsibilities across the AI life cycle are shared out between the organisation, its partners, suppliers and customers.

Suppliers of AI products, services and models are chosen and managed so they fit the organisation's approach to responsible AI.

When providing AI to customers, the organisation considers their expectations and needs for responsible AI.