ISO/IEC 42001:2023

Clause-to-Process Mapping

Every normative clause mapped to the processes that implement the required documented information, workflows, and evidence.

Hub processes (AIMS evidence engine): 1 Context & Leadership • 2 Planning • 3 Operation • 4 Support • 5 Evaluation & Improvement
Section 4 — Context of the organization
Clause Title Primary process(s) Supporting
4 Context of the organization iso42001_aims core
4.1 Understanding the organization and its context iso42001_context (Tab 1) regulatory_register, component_register, aims
4.2 Understanding the needs and expectations of interested parties iso42001_context (Tab 2) regulatory_register, aims
4.3 Determining the scope of the AIMS iso42001_context (Tab 3) component_register, aims
4.4 AI management system iso42001_aims core + all processes
Section 5 — Leadership
Clause Title Primary process(s) Supporting
5Leadershipiso42001_aims—
5.1Leadership and commitmentiso42001_aims (governance gates)strategic_goals
5.2AI policyiso42001_aimsdocumented_info, record_register
5.3Roles, responsibilities and authoritiesiso42001_aimsaccountability
Section 6 — Planning
Clause Title Primary process(s) Supporting
6Planningiso42001_aimscore
6.1Actions to address risks and opportunitiesiso42001_riskaims, monitoring
6.1.2AI risk assessmentiso42001_risk—
6.1.3AI risk treatment (SoA)iso42001_risklifecycle
6.1.4AI system impact assessmentiso42001_risklifecycle
6.2AI objectives and planningiso42001_aims, monitoringstrategic_goals, context
6.3Planning of changesiso42001_changeaims, lifecycle
Section 7 — Support
Clause Title Primary process(s) Supporting
7.1Resourceslifecycle, component_registeraims
7.2Competenceiso42001_documented_inforecord_register
7.3–7.4Awareness & Communicationiso42001_aimsdocumented_info, supplier, monitoring
7.5Documented informationiso42001_documented_inforecord_register, change
Section 8 — Operation
Clause Title Primary process(s) Supporting
8.1–8.4Operational planning & control, risk assessment/treatment during operation, impact assessmentiso42001_lifecyclerisk, change, supplier, product_realization
8.1.4.5Supplier / third-party controliso42001_supplier—
A.6AI system life cycle (design & development)iso42001_product_realizationlifecycle
Section 9 — Performance evaluation
Clause Title Primary process(s) Supporting
9.1Monitoring, measurement, analysis and evaluationiso42001_monitoringrisk, strategic_goals
9.2Internal auditiso42001_auditassurance_core
9.3Management reviewiso42001_management_reviewimprovement, change
Section 10 — Improvement
Clause Title Primary process(s) Supporting
10.1Continual improvementiso42001_improvementrisk
10.2Nonconformity and corrective action (CAPA)iso42001_improvementaudit, monitoring
Annex A — Reference controls (selected)
A.6 — AI system life cycle
Primary: product_realization
A.7 — Data for AI systems
Primary: data_management
A.10 — Third-party relationships
Primary: supplier
A.1–A.5, A.2–A.3 (policies, organization)
Primary: aims + risk
The full Annex A catalog and Statement of Applicability are maintained inside the risk process and surfaced on the AIMS hub.
See full process descriptions →