When teams begin using AI, an organization needs to know where it is used, what data it handles, and who is accountable for adopting its outputs. Start with an AI use inventory and decision ownership, then plan testing, oversight, and change controls according to impact.
Who may need this and when
Organizations developing, providing, or using AI products and services can review system scope as applications grow, customers request governance evidence, or AI enters an important process. Using an external model still requires the organization to understand its own purpose and responsibilities.
Common business challenges
Different departments may use the same tool for different decisions but rely on one simple test result. A model update may change outputs or data handling without returning to the original approval process. Pre-launch accuracy alone cannot address ongoing impacts or human intervention.
Approach and applicable requirements
ISO/IEC 42001:2023 is the first-edition AI management system requirements standard for organizations providing or using AI products and services. It addresses risks, opportunities, and continual improvement. A management-system assessment does not guarantee the accuracy of an individual model or every output. See the ISO overview.
Possible project scope, subject to agreement:
- Purpose, roles, and policy: inventory applications and record intended use, user departments, data, providers, and approval responsibilities.
- Risk and impact assessment: distinguish organizational risks from potential impacts on affected people; record limitations, owners, and missing information.
- Lifecycle and human oversight: review data sources, testing, deployment, monitoring, suspension, and retirement; define controls and conditions for human intervention and reassess after model or purpose changes.
Support and work stages
- Inventory formal deployments and everyday departmental uses; clarify organizational roles and intended boundaries.
- Select assessment and control methods based on use and impact, assigning actions to business, IT, or external partners.
- Test oversight and change processes using an application, reviewing evidence for testing, approval, human review, and anomaly handling.
- Review ongoing governance by consolidating monitoring, incidents, and audit findings for management decisions on resources, limitations, and improvements.
Possible deliverables include an AI inventory, role and scope description, risk and impact assessments, control and oversight arrangements, and change-improvement records. Confirm who reviews an application's output and when it must be suspended or reapproved.
Information to prepare
- AI uses, departments, models or providers, and organizational roles.
- Data sources, access rights, and process summaries.
- Risk, impact, control, and human-oversight information.
- Testing, version, monitoring, incident, and change records.
Start with an information index and de-identified examples. Share project data only after purpose, access, and retention are agreed.
Schedule and fees
Effort depends on the number of applications, organizational roles, impacts, and existing information. Model development, technical evaluation, system changes, and legal advice require separate scope. Third-party certification also requires separate scheme confirmation.
Frequently asked questions
Does this apply if we only use external AI tools?
Organizations still manage their own purposes, data, and accountability for adopted outputs; model development is not the only criterion.
Is an AI use policy a complete management system?
A usage policy can be a starting point. A system also needs to address scope requirements, implementation, internal review, and improvement.
Does a certificate prove every AI answer is correct?
No. System assessment is not a guarantee for each output; actual use still needs appropriate testing and human judgment.
Can risk and impact assessments use the same label?
They can share information but should distinguish organizational risks from consequences for affected people; simply renaming a form is insufficient.
Do we need to review a model change?
Assess whether purpose, data, behavior, or controls are affected and arrange necessary testing and approval.
Does finishing the plan mean we will receive a certificate?
A third party assesses the operating system under its scheme. Service delivery, certification scope, and customer acceptance must be confirmed separately.
Related services
List one important AI use, its input data, who acts on its output, and the current review method. Contact Captain International.