ISO/IEC 42001:2023 Implementation Training

Opens with a question: what would you show a customer who asks how you govern your AI? It follows XYZ Ltd. through a tender from a Singapore employer, then sets out the three features of AI the standard names, the scope in clause 1, the clauses 4 to 10 and Annex A's thirty-eight controls. It explains who does what in certification, clears away three myths and outlines how this training course is built in three parts.

What you will be able to do

• Explain why AI needs specific management
• Describe what ISO/IEC 42001:2023 covers and who it applies to
• Separate the roles of your organisation, consultants and the certification body

Why it matters

A tender that asks how you govern your AI is answered with a policy, risk assessment and test results, not a page of values.

Practice: Practice: Welcome: why manage AI, and the standard · 3 questions

Shows what goes wrong when a data scientist and a lawyer both say impact assessment and mean different things. Covers where the standard's words come from, the roles of AI provider, producer, partner, customer, subject and relevant authority, and the definitions of risk, control, data quality and Statement of Applicability. It separates the AI risk assessment from the impact assessment, with XYZ Ltd. in London and a BPO in Manila as examples.

What you will be able to do

• Name your role for each AI system you build, sell or use
• Tell the AI risk assessment from the AI system impact assessment
• Keep one glossary that maps your team's words to the standard's

Why it matters

Words that mean different things to different people break a system at the first audit, so agree them before you build anything.

Practice: Practice: The language of AI management · 3 questions

Contrasts writing twenty procedures first with starting from facts, the approach this training course takes. Covers the harmonized structure and the places where AI text changes it, then Annex A, Annex B, Annex C and Annex D and the order in which they are used, including the eleven objectives and seven risk sources of Annex C. Sterling's six phases follow, then an AI system inventory and a gap assessment of clauses 4 to 10, with XYZ Ltd. in London as the example.

What you will be able to do

• Explain what each of the four annexes is for
• Start an AI system inventory with purpose, role and owner
• Run a gap assessment that gives each high gap an owner and a date

Why it matters

Effort goes where the risk is when you start from every AI system you build, sell or use, not from a stack of procedures.

Practice: Practice: The system, the annexes and the gap assessment · 3 questions

Starts with XYZ Ltd. winning its first employer in Hong Kong. Covers the note's five kinds of external issue and three internal ones, the decision on whether climate change is relevant, and the intended purpose of each AI system, including what it is not for and foreseeable misuse. Roles follow for a provider, a customer and a partner, with a bank in Toronto, a hospital in Sydney and a BPO in Manila as examples.

What you will be able to do

• Record the issues that change what the system must do
• Decide whether climate change is relevant and write down the reason
• Write the intended purpose and your role for each AI system

Why it matters

Knowing your context before your AI meets it avoids a paused service when a market's rules or a contract term were never checked.

Practice: Practice: Context: issues, purpose and AI roles · 3 questions

Shows XYZ Ltd. in London listing employers but not the applicants it ranks. Covers how to find interested parties, deciding which of their requirements the system addresses, and where each one lands in a control. It then gives five questions for setting the scope, a scope statement for XYZ Ltd., examples for a bank, a hospital and a BPO that only use AI, and the processes and owners that clause 4.4 needs.

What you will be able to do

• Build a register of interested parties and their requirements
• Write a scope statement with a reason for each exclusion
• Name the processes of the system, their owners and interactions

Why it matters

Listing the people your AI affects, not only those who pay, gives their concerns somewhere to go before they reach your customers.

Practice: Practice: Interested parties, scope and the system · 3 questions

Opens with a failed fairness test the day before a release at XYZ Ltd. in London. Covers the eight ways top management shows leadership and commitment, the four requirements of the AI policy, the three controls in area A.2, and what Annex B suggests the policy contains. Clause 5.3 follows, with the areas control A.3.2 lists, and a bank in Sydney, a hospital and a BPO that only buy AI.

What you will be able to do

• List what top management does to show leadership
• Draft an AI policy that meets the four requirements of clause 5.2
• Assign roles with the authority to act, including holding a release

Why it matters

Principles on a website are not leadership; a named person with the authority to hold a release is what customers can rely on.

Practice: Practice: Leadership, AI policy and roles · 3 questions

Opens with two teams at XYZ Ltd. in London who rate the same career-break risk differently. Covers what clause 6.1.1 asks for, the three things risks and opportunities are determined from, the four jobs of AI risk criteria and the difference between risk appetite and criteria. Sterling's recommended four-level consequence scale has one column for the organisation and one for people, with three risk levels, who may accept each, and the planning of actions.

What you will be able to do

• Set AI risk criteria that name who may accept each level
• Rate consequences for the organisation and for people, and take the higher
• Plan actions for risks and opportunities and keep the record

Why it matters

Two assessors given the same risk reach the same level when the criteria are agreed first, so the risks that matter most stand out.

Practice: Practice: Risks, opportunities and AI risk criteria · 3 questions

Starts with a BPO in Manila whose register listed only system outage for its call-summary AI. Covers the five things the process must do, the objectives and seven risk sources in Annex C, and how to write a risk as cause, event and two consequences. Consequences are assessed for the organisation, individuals and societies, then likelihood, level and prioritisation follow, using XYZ Ltd.'s screening platform, a hospital in Sydney and a bank in Toronto.

What you will be able to do

• Write a risk as a cause, an event and consequences for us and for people
• Walk the objectives and risk sources of Annex C for each AI system
• Evaluate and prioritise risks against your criteria

Why it matters

The risk that hurts you is usually the one nobody wrote down, so a systematic walk through each AI system finds it first.

Practice: Practice: AI risk assessment and risk sources · 3 questions

Starts with a bank in Dubai that rated a risk high and then filed the register without a decision. Covers the seven parts of clause 6.1.3, the four options of avoid, modify, share and retain, and why Annex A is a check against omission and not a menu. XYZ Ltd. treats its four main risks, including human oversight and a risk shared with a supplier. A five-column treatment plan and approval of residual risk by designated management follow.

What you will be able to do

• Choose avoid, modify, share or retain for each assessed risk
• Compare your controls with Annex A and add your own where needed
• Build a treatment plan with owner, date, resources and a check

Why it matters

An assessed risk with no decision is still untreated, and a plan with owners and checks shows that each control really works.

Practice: Practice: AI risk treatment and the plan · 3 questions

This part of the training course begins with a due-diligence tender from a New York employer to XYZ Ltd. in London. Shows how Annex A is laid out, then takes each control in areas A.2 to A.5 with the same three questions: what it requires, how to put it in place, and what evidence shows it works. Covers the AI policy, roles, reporting concerns, resource records for data, tooling, computing and people, and impact assessment results, with a BPO in Manila as a practice case.

What you will be able to do

• Explain what the controls in areas A.2 to A.5 require
• Document the data, tooling, computing and people of an AI system
• Record the results of impact assessments on individuals and societies

Why it matters

A customer's first questions about your AI policy, accountability, resources and impacts can be answered in a day, from records.

Practice: Practice: Annex A, part 1: policies to impacts · 3 questions

Begins with a ranking model released at XYZ Ltd. in London after one overall accuracy test. Covers the objectives and processes for responsible development, then requirements, design documentation, verification and validation, deployment, operation and monitoring, technical documentation and event logs. A.7 follows with data management, acquisition, quality, provenance and preparation. A hospital in Sydney and a bank in Toronto show how an organisation that only uses AI applies them.

What you will be able to do

• Set release criteria before testing and test results by group
• Monitor a system in operation for drift and keep event logs
• Document the acquisition, quality, provenance and preparation of data

Why it matters

A model is ready when it meets criteria set before testing, and a trail kept as the work happens shows a customer why.

Practice: Practice: Annex A, part 2: life cycle and data · 3 questions

Starts with XYZ Ltd. in London as an AI customer whose support assistant told an applicant that their data had been deleted when it had not. Covers information for users, external reporting, incident communication and reporting duties in A.8, then processes and objectives for responsible use, human oversight and intended use in A.9. A.10 covers allocating responsibilities, suppliers and customers, with a bank in Singapore, a hospital in Toronto and a BPO in Manila.

What you will be able to do

• Tell users when they deal with AI and give outsiders a way to report
• Hold suppliers to your approach with documentation and notice of model change
• Allocate responsibilities between you, partners, suppliers and customers

Why it matters

People can only trust an AI system they know about, and a supplier's word alone is not evidence once its model changes.

Practice: Practice: Annex A, part 3: users, use, partners · 3 questions

Opens with a contract renewal at XYZ Ltd. in London where a reviewer from New York cannot tell which controls address unfair rankings. Covers the definition in clause 3.26 and the requirement in item f), the two valid reasons to exclude a control, and why Annex B guidance needs no justification. A five-step build, sample lines for the screening platform, one control included for one system and excluded for another, a bank in Toronto and a four-point check follow.

What you will be able to do

• Build the statement from the risk register, not from Annex A
• Write a reason for every control you include or exclude
• Check that each line traces to a risk, with a version and an owner

Why it matters

A statement where each control traces to a risk lets you answer a customer's procurement team in a day.

Practice: Practice: The Statement of Applicability · 3 questions

Starts with XYZ Ltd. in London finding, before launch, that its screening platform could rank carers returning to work lower. Covers the definition in clause 3.24, how the impact assessment differs from the risk assessment, and the individuals, groups and societies affected. It shows when to assess, the questions and impact areas from the Annex B guidance, the five elements of the process and what to record, with a BPO in Manila, a hospital in Sydney and a retailer in Dubai.

What you will be able to do

• Identify the individuals, groups and societies an AI system affects
• Assess intended use and foreseeable misuse, and record positive impacts too
• Feed impact findings into the risk register

Why it matters

Harm to people is found while the design can still change, before it reaches the applicants a system decides about.

Practice: Practice: AI system impact assessment · 3 questions

Starts with XYZ Ltd. in London rewriting the vague objective be fair to applicants as a measured one owned by the head of data science. Covers the definition of an objective in clause 3.6, the seven conditions of clause 6.2, the five planning questions and Annex C as a source of objectives. Objectives are tied to the rest of clause 6, set at company and team level, and shown for a hospital in Hong Kong. Clause 6.3 and a five-question change plan close the module.

What you will be able to do

• Write AI objectives as measurable results with an owner and a date
• Answer the five planning questions for each objective
• Plan a change to the management system with a short change plan

Why it matters

An objective you cannot check is a wish, and a measured one shows whether the AI management system is working.

Practice: Practice: AI objectives and planning of changes · 3 questions

Begins with one engineer at XYZ Ltd. in London who alone knows how to retrain the ranking model. Covers determining and providing resources, the resource controls of Annex A area four, and human resources. Then competence, with a matrix that pairs each skill with evidence, training for people who provide human oversight, awareness of the AI policy, and a communication plan. A bank in Mumbai and a BPO in Manila show organisations that buy and use AI.

What you will be able to do

• Document the resources of each AI system, whoever provides them
• Pair each needed competence with evidence that it exists
• Plan what to communicate, when, with whom and how

Why it matters

Skills and steps that outlast any one person keep your AI running on schedule when a key engineer leaves.

Practice: Practice: Resources, competence, awareness, communication · 3 questions

Starts with an old fairness test procedure in an e-mail thread that let a release through at XYZ Ltd. in London. Covers the definition in clause 3.10, clauses 7.5.1, 7.5.2 and 7.5.3, and where the standard asks for documented information. It shows a document header that names the model versions covered, control of documents from outside such as supplier terms, retention of impact assessments and logs, and a hospital in Toronto with outdated printed instructions.

What you will be able to do

• Identify, describe and approve documented information for AI work
• Control versions, access and retention, including external documents
• Separate what the standard requires from what you choose to keep

Why it matters

One current version, available where and when it is needed, stops a release going out under a procedure that was already replaced.

Practice: Practice: Documented information · 3 questions

Opens with a retrained model that went live at XYZ Ltd. in London with no test against agreed criteria. Covers the requirements of clause 8.1, criteria for each process and four life cycle controls that run in operation, a release gate, monitoring for drift, repairs, updates and support, and a rollback plan. Planned and unintended changes and externally provided services follow, with a bank in Singapore that uses a bought credit-scoring model.

What you will be able to do

• Set checkable criteria for each AI process and control to them
• Run a release gate and monitor live outputs, not only uptime
• Control planned changes and review unintended ones

Why it matters

A weak model version is caught before any customer sees it when releases go live only against criteria and a named sign-off.

Practice: Practice: Operational planning and control · 3 questions

Starts with a model retrained for a new client in Toronto and released without repeating either assessment at XYZ Ltd. in London. Covers when to repeat each assessment, what counts as a significant change, and a list of review triggers. It also covers putting the risk treatment plan to work and verifying that it is effective, using a human oversight control that proved ineffective, a hospital in Singapore, and a bank in Mumbai whose vendor releases a new model version.

What you will be able to do

• List the triggers that make you repeat the assessments
• Verify that a risk treatment is effective and revalidate it if not
• Keep the results of every assessment and treatment, not only the last

Why it matters

An AI system changes, so its assessments must change with it, and a change is assessed before it reaches people.

Practice: Practice: Assessments in operation: intervals and change · 3 questions

Starts with a support assistant at XYZ Ltd. in London that kept giving an old refund answer for six weeks. Covers the four decisions of clause 9.1, the difference between monitoring and measurement, and the two meanings of performance. It lists what to monitor in operation, how to set acceptable values, a monitoring plan for the screening platform and valid methods. A bank in Hong Kong and a hospital in Sydney show how customers monitor bought AI.

What you will be able to do

• Decide what to monitor and measure, and when to evaluate the results
• Agree acceptable values so that a result can be judged
• Evaluate trends and give each out-of-range result an owner and a date

Why it matters

Problems are found by your own monitoring before a customer or the people the AI affects find them.

Practice: Practice: Monitoring, measurement, analysis and evaluation · 3 questions

Compares a bank in Dubai whose audits covered IT security only with one that audits supplier oversight. Covers the purpose of an internal audit, the programme, objectives, criteria and scope, impartial and competent auditors, and an annual programme for XYZ Ltd. in London. Then the management review: its five inputs, the results it must produce, and a sample record where each decision has an owner and a date. A hospital in New York and a BPO in Manila are further examples.

What you will be able to do

• Plan an audit programme from the importance of processes and past results
• Prepare management review inputs, including AI-specific information
• Record review decisions with an owner and a date

Why it matters

Audit to learn, review to decide: together they show whether the system works, not only whether it is written down.

Practice: Practice: Internal audit and management review · 3 questions

Returns to XYZ Ltd. in London, where a client reports applicants with time out of work ranked near the bottom. Covers continual improvement and an improvement register, where nonconformities come from, and the steps of clause 10.2: react, find the cause, check where else it could occur, act and review effectiveness. It shows what reacting means for an AI system, six places to look for causes, a one-page nonconformity report, and a BPO in Mumbai.

What you will be able to do

• React to a nonconformity by containing and correcting it
• Find the cause and check where else it could occur
• Close a case only after reviewing that the corrective action worked

Why it matters

Correction fixes one shortlist, while corrective action removes the cause, so the same problem stops returning for other clients.

Practice: Practice: Improvement and corrective action · 3 questions

Starts with a BPO in Manila that bought sixty documents written for another company and could not show its last risk assessment. Sets out the two kinds of documented information in clause 7.5.1 and the four phrases the standard uses. Walks the required list clause by clause, then what the Annex A controls in your Statement of Applicability add, optional items such as an AI system inventory, a documented information list for XYZ Ltd. in London, and control of outside documents.

What you will be able to do

• Build a documented information list traced to clauses and controls
• Separate what is required from what you choose to keep
• Give each item an owner and a place where it is kept

Why it matters

Documenting what the standard and your own system need, no more and no less, lets you show what was done and when.

Practice: Practice: The documented information you need · 3 questions

Starts with a New York client asking XYZ Ltd. in London for an AI management system certificate before renewal. Covers starting with top management, a project leader, a core team and an inventory, then the gap assessment and Sterling's six phases tied back to the modules. It shows a dated road map, how to keep it moving, building on ISO/IEC 27001 and ISO 9001, eight readiness checks, the two-stage certification audit, pitfalls, and what follows the video modules of this training course.

What you will be able to do

• Draft a dated road map with phases, outputs, owners and dates
• Run an eight-point readiness check before the certification audit
• Build on management systems you already run

Why it matters

Certification follows a system that is already running, so a client's request for a certificate can be planned for rather than rushed.

Practice: Practice: Your road map and certification readiness · 3 questions