ISO/IEC 42001:2023 AI Management System standard
Forty-one findings, all closed correctly, and nobody ever read them sideways. Here’s how audit reports, trend analysis under §8.4, and management review turn a pile of closed findings into a signal — and why FDA can now read the whole chain.
For twenty years you could cram for an FDA inspection, because the evidence of the cramming was invisible. The QMSR dropped the §820.180(c) exemptions and FDA retired QSIT — so your internal audit program isn’t just what prepares you for the inspection, it’s one of the things being inspected. Here’s what audit-ready on an ordinary Tuesday actually looks like.
Auditor independence isn’t an accusation — it’s an admission that nobody can proofread their own handwriting. Here’s what ISO 13485 §8.2.4 and ISO 19011 actually require of who audits what, why competence is the half that quietly does more damage, and four things to do when you’re a quality team of two.
The regulations already cover AI tools in your quality system — you just have to read them with fresh eyes. Here’s what ISO 13485 clause 4.1.6, FDA’s CSA guidance, and ISO/IEC 42001 actually require, and a practical, risk-tiered approach to qualifying AI use without over-validating everything.
Suppliers are quietly using AI tools to draft procedures and protocols from customer drawings and specifications. Here’s what that puts at risk — confidentiality, export compliance, and product quality — and the controls both customers and suppliers should have in place.
Annex A.2 is the control that asks your organisation to do something it has spent two years carefully avoiding: write down, in an approved and reviewable document, what it actually thinks about AI. Art Meta walks A.2.2, A.2.3, and A.2.4 — the AI policy, its alignment with everything else, and the obligation to keep reading it.
Annex A of ISO/IEC 42001:2023 is where ten clauses of philosophy finally collapse into a list — 38 controls, 9 sections, one mandatory Statement of Applicability. Art Meta walks the structure, what is genuinely new, and why your audit will live or die by a spreadsheet.
Welcome back to the series, and to the post I have been quietly putting off since Clause 6. The AI
Welcome back to the part of the series I have been quietly looking forward to, in the same resigned way
Clause 9 is where ISO/IEC 42001:2023 stops asking what you built and starts asking how you know it works. Monitoring, internal audit, and management review — three subclauses, all designed to surface the gap between ‘we have a policy’ and ‘we have evidence.’