iso42001-ai-management

ISO 42001 AI Management System

Tools and guidance for ISO/IEC 42001:2023 — the first international standard for AI Management Systems (AIMS).

Table of Contents

• [Tools](#tools)
• [AIMS Readiness Checker](#aims-readiness-checker)
• [AI Impact Assessor](#ai-impact-assessor)
• [Reference Guides](#reference-guides)
• [Workflows](#workflows)
• [Standard Overview](#standard-overview)

Tools

AIMS Readiness Checker

Assesses organizational readiness against all ISO 42001 clauses and Annex A controls. Scores each clause on a 0-100 scale and identifies gaps for certification preparation.

# Assess readiness from a JSON profile
python scripts/aims_readiness_checker.py --input org_profile.json

# Generate a blank input template
python scripts/aims_readiness_checker.py --template > org_profile.json

# JSON output for automation
python scripts/aims_readiness_checker.py --input org_profile.json --json

# Export report to file
python scripts/aims_readiness_checker.py --input org_profile.json --output report.json

Assessment Areas:

| Clause | Area | Key Checks | |--------|------|-----------| | Clause 4 | Context | Scope defined, interested parties, AIMS boundaries | | Clause 5 | Leadership | AI policy, governance structure, management commitment | | Clause 6 | Planning | Risk assessment methodology, AI objectives, impact assessments | | Clause 7 | Support | Resources, competence, awareness, documentation | | Clause 8 | Operation | AI lifecycle, data management, risk treatment, third-party controls | | Clause 9 | Performance | Monitoring, internal audit, management review | | Clause 10 | Improvement | Corrective actions, continual improvement, incident management | | Annex A | Controls | A.2-A.10 control implementation status |

Output:

• Overall readiness score (0-100)
• Per-clause scores with maturity level (Initial/Developing/Defined/Managed/Optimized)
• Annex A control implementation status (Implemented/Partial/Not Implemented/Not Applicable)
• Gap analysis with prioritized recommendations
• Certification readiness assessment (Ready/Near Ready/Significant Gaps)

AI Impact Assessor

Generates comprehensive AI impact assessments evaluating fairness, transparency, safety, privacy, and security dimensions. Maps impacts to interested parties and provides risk treatment recommendations.

# Assess an AI system from a JSON description
python scripts/ai_impact_assessor.py --input ai_system.json

# Generate a blank input template
python scripts/ai_impact_assessor.py --template > ai_system.json

# Export assessment report
python scripts/ai_impact_assessor.py --input ai_system.json --output assessment.json

# Generate markdown report
python scripts/ai_impact_assessor.py --input ai_system.json --format markdown --output assessment.md

Assessment Dimensions:

| Dimension | Evaluates | Key Factors | |-----------|----------|-------------| | Fairness | Bias, discrimination, equity | Training data diversity, protected attributes, outcome parity | | Transparency | Explainability, interpretability | Model complexity, decision documentation, user disclosure | | Safety | Reliability, robustness, harm prevention | Failure modes, edge cases, human oversight, fallback mechanisms | | Privacy | Data protection, consent, minimization | PI processing, consent mechanisms, data retention, anonymization | | Security | Adversarial resilience, access control | Attack vectors, model integrity, access management, audit logging | | Accountability | Governance, responsibility, auditability | Decision ownership, audit trails, escalation procedures |

Features:

• Risk scoring per dimension (Low/Medium/High/Critical)
• Interested party impact mapping (users, affected individuals, society, regulators)
• Risk treatment options (Avoid, Mitigate, Transfer, Accept)
• Regulatory mapping (EU AI Act risk tier, ISO 42001 Annex A controls)
• Residual risk calculation after treatment
• Markdown and JSON report generation

Reference Guides

ISO 42001 Clause Guide

references/iso42001-clause-guide.md

Comprehensive clause-by-clause guidance:

• All clauses (4-10) with requirements and implementation steps
• Annex A controls (A.2-A.10) detailed with evidence requirements
• Audit questions per clause for internal audit preparation
• Common nonconformity findings and how to avoid them
• Required documented information per clause
• Cross-references to ISO 27001, ISO 9001, and EU AI Act

AI Lifecycle Management

references/ai-lifecycle-management.md

End-to-end AI system lifecycle guidance:

• Lifecycle stages: design, development, testing, deployment, monitoring, retirement
• Design and development controls (requirements, architecture, coding standards)
• Testing and validation requirements (functional, bias, robustness, performance)
• Deployment procedures (staging, canary, rollback, approval gates)
• Monitoring and maintenance (drift detection, performance degradation, retraining)
• Retirement and decommissioning (data disposal, model archival, stakeholder notification)
• Data management across lifecycle (quality, provenance, bias assessment, lineage)
• Model versioning and change management (version control, change impact, approval workflows)

Workflows

Workflow 1: ISO 42001 Readiness Assessment

Step 1: Define AIMS scope
        → Identify AI systems in scope
        → Determine organizational boundaries
        → Document interested parties and requirements

Step 2: Generate assessment template
        → python scripts/aims_readiness_checker.py --template > org_profile.json
        → Fill in organizational details and current state

Step 3: Run readiness assessment
        → python scripts/aims_readiness_checker.py --input org_profile.json

Step 4: Review results
        → Address critical gaps (Clauses 5, 6, 8 typically weakest)
        → Prioritize Annex A controls by risk
        → Develop remediation roadmap

Step 5: Conduct AI impact assessments
        → python scripts/ai_impact_assessor.py --template > ai_system.json
        → Assess each in-scope AI system
        → python scripts/ai_impact_assessor.py --input ai_system.json

Step 6: Plan implementation
        → See references/iso42001-clause-guide.md for requirements
        → See references/ai-lifecycle-management.md for operational controls

Workflow 2: AI System Impact Assessment

Step 1: Identify AI system for assessment
        → Document system purpose, inputs, outputs, and decisions
        → Identify affected individuals and groups

Step 2: Generate assessment template
        → python scripts/ai_impact_assessor.py --template > ai_system.json
        → Complete all sections (model details, data sources, deployment context)

Step 3: Conduct assessment
        → python scripts/ai_impact_assessor.py --input ai_system.json --format markdown --output report.md

Step 4: Review dimension scores
        → Fairness: check for bias in training data and outcomes
        → Transparency: verify explainability mechanisms
        → Safety: validate failure modes and human oversight
        → Privacy: confirm data protection measures
        → Security: assess adversarial resilience

Step 5: Implement risk treatments
        → Apply recommended mitigations per dimension
        → Document residual risk acceptance decisions
        → Assign treatment owners and timelines

Step 6: Monitor and review
        → Schedule periodic reassessment (quarterly minimum)
        → Track treatment implementation progress
        → Update assessment when system changes materially

Workflow 3: AIMS Certification Preparation

Step 1: Gap analysis
        → python scripts/aims_readiness_checker.py --input org_profile.json
        → Target overall score of 80+ for certification readiness

Step 2: Document AIMS
        → AI policy (Clause 5.2)
        → AIMS scope (Clause 4.3)
        → Risk assessment methodology (Clause 6.1)
        → Statement