AI System Impact Assessment: Where ISO Asks You to Consider Everyone Everywhere All the Time
Welcome back to the series, and to the post I have been quietly putting off since Clause 6. The AI
Standards
Provision of Resources: Your QMS Doesn’t Run on Goodwill and One Overworked QA Person
ISO 13485 §6.1 is two sentences long. Those two sentences quietly demand that top management actually fund the QMS — people, equipment, training, and time. “We’ll see what’s left in the budget” is not what the standard had in mind.
Improvement — Where You Acknowledge, In Writing, That Nothing Is Ever Quite Done
Welcome back to the part of the series I have been quietly looking forward to, in the same resigned way
Management Review: The One Meeting Your QMS Can’t Live Without (And No, the Night Before the Audit Doesn’t Count)
ISO 13485 §5.6 requires top management to review the QMS at planned intervals — and no, the meeting where the CEO drops in for fifteen minutes and says “great work, team” does not count.
Performance Evaluation — Or, How to Prove Your AI Management System Was Doing Anything
Clause 9 is where ISO/IEC 42001:2023 stops asking what you built and starts asking how you know it works. Monitoring, internal audit, and management review — three subclauses, all designed to surface the gap between ‘we have a policy’ and ‘we have evidence.’
Internal Communication: ‘I Sent an Email Once’ Is Not a Process
§5.5.3 looks like the easiest clause in ISO 13485 — a single short paragraph about communication. It’s also the clause most likely to make your production lead say ‘I think there’s a poster in the break room?’ when the auditor asks how the QMS is communicated.
Operation — Where Planning Ends and Something Resembling Execution Begins
Clause 8 is where the AI management system stops being a stack of documents and starts having to run. Art Meta walks you through operational planning and control, the recurring risk assessment, risk treatment, and the genuinely novel AI system impact assessment — the one subclause in ISO 42001 that asks you to think about the humans on the other end.
The Management Representative: Somebody Has to Actually Own This (And Yes, Their Name Has to Be on a Piece of Paper)
Section 5.5.2 is short, simple, and surprisingly easy to fumble. Name a real member of management, give them real authority, and for heaven’s sake put it in writing before the auditor asks.
Artificial Intelligence, ISO 42001, Standards
Support — Resources, Competence, and the Paper Trail You Promised to Maintain
Clause 7 of ISO/IEC 42001:2023 governs the unglamorous machinery of an AI management system — resources, competence, awareness, communication, and documented information. Art Meta walks through what the standard actually asks for, and why this is the clause where most implementations quietly collapse.
ISO 13485, Standards
Responsibility and Authority: If Everyone Owns Quality, Nobody Does
If everyone owns quality, nobody does. ISO 13485 §5.5.1 asks you to define, document, and communicate who is responsible for what — and yes, that means your org chart needs to be more recent than 2019.