ISO 42001, issued by ISO/IEC in October 2023, is the first international standard for AI management systems. Organizations preparing for certification or pre-audit review commonly have a clear AI policy but little evidence that it operates. Auditors focus on that gap, which can be addressed before review.
Organizations familiar with ISO 27001 or ISO 9001 will recognize the standard's broad documentation structure. AI management adds obligations without direct equivalents in general security standards. The sections below identify those obligations and the evidence gaps that commonly accompany them.
Clause 4: Context and Scope
Clause 4 asks the organization to establish the internal and external context of its AI management system. Its documented output is a scope statement identifying covered AI systems, organizational units, intended purposes, and risk profiles for each system in scope.
The recurring issue is incomplete scope, rather than absent paperwork. Organizations record systems they know about and have approved. When inventory depends on self-reporting instead of active discovery, operating tools are omitted. A scope statement limited to sanctioned tools is not a defensible account of the AI footprint. Auditors ask how scope was determined and what discovery method produced it.
Clause 5: Leadership
Clause 5 requires top management to show commitment to the AI management system. Required records include a management-signed AI policy, defined governance roles and responsibilities, and evidence of management review. The policy should fit the organization's purpose and risk profile, rather than copy a generic template.
The common weakness is the difference between a policy and an operating record. A policy exists, but there may be no management review minutes, tracked objectives, or evidence that leaders considered the AI risk assessment. Auditors need records of active oversight, not only a statement of intent.
Clause 6: Planning
Clause 6 covers risks, opportunities, and AI management objectives. The evidence set includes an AI risk assessment for every in-scope system, measurable objectives, and records explaining risk treatment decisions.
The risk assessment is usually Clause 6's largest documentation task. ISO 42001 permits organizations to choose their methodology, but the work must be systematic, recorded, and tied to actual systems and use cases. Abstract discussion of AI risk, without named tools, uses, and possible harms, does not show that the real AI landscape was assessed.
Clause 8: Operation
Clause 8 addresses operational planning and control, producing much of the evidence volume. Each in-scope system needs procedures covering its lifecycle: design or procurement, deployment, monitoring, and decommissioning.
Clause 8.4 focuses on AI lifecycle records, including design specifications, training data records for internally developed models, testing and validation results, and deployment controls. For procured systems, Clause 8.6 supplier records should show how the supplier was assessed, which contract terms govern AI use, and how performance is monitored over time.
Incident handling also belongs in Clause 8. ISO 42001 has no separate incident response clause, but operational procedures should explain what happens when an AI system behaves unexpectedly, produces harmful output, or creates a compliance event. Without an AI-specific response procedure or even minor incident records, auditors may question whether monitoring is taking place.
Clause 9: Performance Evaluation
Clause 9 requires evaluation of the AI management system. Records should include an internal audit program and completed audits, a management review showing that top management assessed performance, and monitoring data for AI objectives.
Management review records are often weak. The meeting occurs, but its minutes do not capture the topics considered, decisions reached, or assigned follow-up. A dated and signed blank template may prove a meeting record exists, but not that meaningful deliberation occurred.
Clause 10: Improvement and Annex A Controls
Clause 10 requires action on nonconformities and ongoing improvement of the AI management system. Evidence includes identified nonconformities, corrective actions taken, and records showing whether those actions worked.
ISO 42001 Annex A contains 38 control areas in six categories: organizational controls, people controls, physical controls, technological controls, AI system impact assessment, and AI system life cycle. Annex A is not normatively required like Clauses 4 through 10, but certification candidates are expected to maintain a Statement of Applicability showing applicable and implemented controls, with reasons for exclusions. An incomplete or unchecked Statement of Applicability is a frequent pre-audit finding.
Policy-Evidence Gap
Across organizations preparing for ISO 42001, the recurring pattern is strong policy documentation and sparse operating evidence. Policies are written, risk methods described, and roles assigned. Missing or limited records show whether policies were communicated, actual systems assessed, controls operated, and management reviews produced decisions.
Policy documentation remains necessary. A clear, properly scoped AI policy establishes the foundation, but ISO 42001 certification examines whether the management system operates, not only whether it is described. In a well-prepared package, documentation is roughly one part policy structure to three parts operational records. If policy outweighs evidence, direct preparation effort toward records demonstrating actual operation.