Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
ISO 42001:2024 is an international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS) within an organization.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
It is the organization's responsibility to ensure the provision of tailored technical documentation to all relevant parties. This process involves systematically identifying the specific informational needs of diverse stakeholder groups, which may include end-users, business partners, and regulatory bodies. Following this assessment, the documentation must be delivered in a format that is both appropriate for the intended audience and readily accessible.








The organization shall institute and maintain a formal mechanism for reporting. This channel must be made available to internal personnel and appropriate external stakeholders, enabling them to raise issues concerning the organization's responsibilities and actions related to its artificial intelligence systems. This capability for lodging concerns must be operational and accessible throughout the entire AI system lifecycle, from initial development to eventual decommissioning.








The organization is mandated to conduct internal audits on a recurring, planned basis. These evaluations are essential for gathering evidence and providing assurance that the AI management system is operating effectively and being properly sustained. A primary objective of these audits is to confirm that the system's implementation conforms to all relevant criteria, which includes both the organization’s own internal policies and the requirements stipulated within this standard.








An organization is obligated to institute a formal methodology for assessing the ongoing performance and efficacy of its AI management system. This requires defining specific performance indicators and monitoring targets. The process must also outline the validation techniques used for measurement to ensure data integrity and accuracy. A schedule must be established detailing the frequency of these assessments and the subsequent analysis of results. Crucially, all evaluation outcomes must be retained as documented proof, serving as a verifiable record of the system's effectiveness and adherence to established standards.




The organization must establish and maintain a formal, documented methodology for AI risk assessment. This framework shall be structured to produce repeatable and valid results, ensuring consistency over time, and must be aligned with the organization's established AI policies and strategic objectives. The process must systematically identify threats and opportunities that could affect the achievement of AI goals. A thorough analysis is required to evaluate the potential consequences for the organization, individuals, and society, estimate the likelihood of occurrence, and determine the overall risk magnitude. These findings must then be benchmarked against predefined risk criteria to prioritize identified risks for subsequent treatment.




The organization is mandated to establish and formally record a set of guiding principles for the responsible engineering of its artificial intelligence systems. These principles must be integral to every phase of the development lifecycle, from initial design through to deployment and maintenance. To ensure adherence, the organization must embed specific, measurable controls within its development processes to verify that these foundational objectives are consistently achieved.
















The organization must define strategic AI targets for all pertinent functions and levels. These objectives shall be aligned with the overarching AI policy, be measurable whenever feasible, and incorporate all applicable requirements. They must be subject to continuous oversight, communicated throughout the organization, and updated as necessary. To operationalize these goals, a corresponding documented implementation plan is required for each. This plan must specify the necessary actions, required resources, responsible parties, completion deadlines, and the metrics for evaluating the outcomes.




The organization shall establish, implement, and maintain an integrated AI management system, which must be subject to ongoing improvement. To ensure full compliance with this document, the organization must define and manage all constituent processes and their interactions within this system. Furthermore, the entire framework, including its processes and controls, must be formally documented to provide a clear and auditable record of its operation and governance.




To ensure the efficacy of its AI management system, an organization must establish and maintain a comprehensive documentation portfolio. This portfolio is required to encompass all information mandated by this standard, as well as any additional documentation the organization deems critical for effective system operation. The level of detail and overall volume of this documentation must be calibrated to the organization's specific context, considering its size, the complexity of its processes and their interdependencies, and the proficiency of its workforce.












The organization is required to formulate, document, and maintain an official policy to govern the creation and application of artificial intelligence systems. This framework must establish clear principles and controls for both the internal development of AI technologies and their subsequent deployment and use, ensuring all related activities are formally managed and consistently reviewed.








The organization must implement a formal framework for governing its relationships with vendors. A primary objective of this framework is to ensure all third-party engagements align with internal AI principles. Any procurement of services, products, or components intended for use within the organization's artificial intelligence systems must be subjected to a verification process. This process shall confirm that the supplier's offerings are fully compliant with the organization's own documented standards for the responsible and ethical use of AI.




For effective governance of the AI management system, the organization's top management must formally delegate and articulate the duties and powers associated with all relevant positions. This framework of accountability requires the specific assignment of authority for two key outcomes. First, an individual or group must be responsible for maintaining the system's conformance with this standard's requirements. Second, responsibility must be designated for reporting on the AI management system's performance directly to executive leadership, ensuring continuous oversight.




To ensure a robust AI management system, the organization must first determine its operational context by evaluating all internal and external matters relevant to its strategic objectives and their potential effect on the system's performance. This comprehensive review must explicitly include an assessment of climate change's pertinence. The organization is also obligated to specify the designated purpose of any AI system it develops, operates, or offers. Furthermore, it is essential to clearly delineate the organization's own capacity and responsibilities concerning these defined AI system applications.








It is incumbent upon the organization to ensure the AI management system is adequately supported throughout its entire operational lifespan. This obligation involves securing and dedicating the necessary resources for its initial establishment, ongoing implementation, routine maintenance, and any activities related to its continual improvement. The organization must guarantee that these resources are not only allocated but also consistently sustained to maintain system effectiveness and achieve its objectives.








The organization must ensure its AI policy is evaluated on a recurring, planned basis. In addition to these scheduled assessments, reviews shall be initiated on an as-needed basis in response to significant changes. The objective is to continuously validate the policy's relevance, sufficiency, and overall impact, ensuring it remains aligned with the organization's strategic direction and operational environment.








To ensure effectiveness, every management review must be based on a thorough evaluation of several key areas. The organization shall present updates on action items from preceding reviews and analyze any shifts in the operational context, such as evolving stakeholder requirements or internal and external issues impacting the AI management system. A critical component of the review is a detailed assessment of system performance, which must include an analysis of nonconformity trends, the outcomes of monitoring and measurement, and recent audit findings. The agenda must also formally address all identified opportunities for continual improvement.




Explore our comprehensive resources and improve your security with the themes of this framework.
This framework is available in Cyberday. Start working on your compliance now!
Start free trialDiscover specific ways our platform streamlines your compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
