Annex A.2 is the control that asks your organisation to do something it has spent two years carefully avoiding: write down, in an approved and reviewable document, what it actually thinks about AI. Art Meta walks A.2.2, A.2.3, and A.2.4 — the AI policy, its alignment with everything else, and the obligation to keep reading it.
Annex A of ISO/IEC 42001:2023 is where ten clauses of philosophy finally collapse into a list — 38 controls, 9 sections, one mandatory Statement of Applicability. Art Meta walks the structure, what is genuinely new, and why your audit will live or die by a spreadsheet.
Welcome back to the series, and to the post I have been quietly putting off since Clause 6. The AI
Welcome back to the part of the series I have been quietly looking forward to, in the same resigned way
Clause 9 is where ISO/IEC 42001:2023 stops asking what you built and starts asking how you know it works. Monitoring, internal audit, and management review — three subclauses, all designed to surface the gap between ‘we have a policy’ and ‘we have evidence.’
Clause 8 is where the AI management system stops being a stack of documents and starts having to run. Art Meta walks you through operational planning and control, the recurring risk assessment, risk treatment, and the genuinely novel AI system impact assessment — the one subclause in ISO 42001 that asks you to think about the humans on the other end.
Clause 7 of ISO/IEC 42001:2023 governs the unglamorous machinery of an AI management system — resources, competence, awareness, communication, and documented information. Art Meta walks through what the standard actually asks for, and why this is the clause where most implementations quietly collapse.
Clause 6 of ISO/IEC 42001:2023 asks you to plan actions against risks and opportunities, then set measurable AI objectives and figure out how to achieve them. Art Meta walks you through what that actually means — and why AI risks are not quite like the ones you’ve been managing since ISO 27001.
Clause 5 of ISO 42001 asks top management to demonstrate leadership and commitment to the AI management system. Art Meta walks through what that actually requires — policy, roles, and the fine tradition of recycled Annex SL language.
Welcome back. You’ve made it to Clause 4, which means you have survived the Scope (Clause 1), the Normative References