The organization should define and implement a process for treating identified AI risks. This process involves selecting appropriate risk treatment options and identifying the necessary controls to manage these risks. The controls should be carefully considered against those listed in Annex A of ISO 42001:2024, and any additional controls required beyond Annex A should also be identified.
A Statement of Applicability (SoA) should be created, documenting all selected controls and providing justification for their inclusion or exclusion. Reasons for exclusion could include the risk assessment determining they are not necessary or external requirements allowing for exceptions.
Based on the chosen treatment options and identified controls, an AI risk treatment plan should be formulated. This plan, along with the acceptance of any remaining AI risks, must be approved by the responsible management.
The organization should maintain documented information of its AI risk treatment process, the Statement of Applicability, and the AI risk treatment plan. These documents should be shared within the organization and made accessible to relevant interested parties as appropriate. The selected controls should align with the AI management system's objectives.
.svg)
