GAICC ISO-IEC-42001-Foundation Exam Guide: How The AI Management System Requirements Fit Together

What An AI Management System Is And What It Covers

An AI management system (AIMS) is the set of interrelated elements an organisation uses to set AI policies and objectives and the processes to achieve them. It is not a model or tool, but the arrangement of owners, decisions and records that keeps AI activity governed.

An AIMS exists because ordinary controls answer single questions. A test report says whether a model met a threshold on a date, not who notices drift or who answers a person harmed by an output. Five properties defeat conventional controls: opacity, drift, data dependence, autonomy and distributed accountability. Each is an ownership problem before it is technical.

Clause 1 sets the boundary: the standard applies to organisations of any size that develop, provide or use AI-based products or services. Conformity means a working system for governing AI activity, not a certified model, product or legal opinion. It follows the harmonised structure, formerly Annex SL, so clauses 4 to 10 run context, leadership, planning, support, operation, evaluation and improvement, which is why ISO/IEC 27001 teams recognise the shape.

Worked Example

Karvan Water, a fictional utility, buys a leak-detection model. It passes testing, then misses leaks in relined districts, and nobody watches performance after launch. The gap is not model quality but the absent owner and trigger an AIMS supplies.

Sample Question

Objective assessed: distinguish an AIMS contribution from a technical one.

A firm holds a validation report, an architecture diagram and a monthly dashboard, but nobody can say who reviews quality after launch. Which gap does this expose?

1. A validation gap, because the launch report was not repeated.
2. A management system gap, because no owner, trigger or escalation path exists.
3. A documentation gap, because the diagram omits the environment.
4. A measurement gap, because the dashboard tracks the wrong metric.

Correct answer: B. The scenario shows working technical artefacts and an absent governance arrangement, which is what an AIMS supplies.

• A fails because repeating a test still assigns no owner or trigger.
• C fails because missing description is not the stated problem.
• D fails because changing an indicator creates no accountability.

Takeaway. Good technical evidence with no owner points to the management system.

Topic Self-Check

Name one process an AIMS needs for each of the five AI properties. Explain why a better-tested model does not remove the need for an AIMS.

Certification, References, Terms And Annexes

Certification is third-party conformity assessment. A certification body, meeting competence, consistency and impartiality requirements, audits the management system; an accreditation body assesses that body. For AIMS audits, ISO/IEC 42006:2025 adds AI-specific requirements to ISO/IEC 17021-1. Stage 1 examines readiness of the designed system; Stage 2 tests whether processes run and produce results. Personnel certification certifies a person, never an employer.

Clause 2 contains exactly one normative reference, ISO/IEC 22989:2022, so its AI vocabulary applies by reference. ISO 31000 and ISO/IEC 27000 are SOURCE attributions and bibliography entries, not normative references, and ISO 9000 does not appear at all. Clause 3 defines 26 terms, 3.1 to 3.26, as a flat list. Annex A and B are normative; C and D are informative. Annex A holds 38 controls in 9 control clauses with 10 objectives, from A.2.2 to A.10.4, and A.6.1 contains only A.6.1.2 and A.6.1.3.

Worked Example

A fictional training company files no review record for one policy update, then cannot show that anyone considered learner records when it retired a scoring system. The first is a narrow lapse; the second suggests a process that does not exist.

Sample Question

Objective assessed: apply reference and annex facts.

An analyst drafts a summary of the standard's structure. Which statement is correct?

1. Clause 2 lists ISO/IEC 22989, ISO/IEC 23894 and ISO 31000 as normative references.
2. Clause 2 contains one normative reference, and a SOURCE attribution does not make a document normative.
3. A SOURCE attribution to ISO/IEC 27000 makes it normative for Clause 2.
4. Annex C is normative because its risk sources must populate the risk register.

Correct answer: B. Clause 2 has one entry, and attribution credits a source rather than requiring it.

• A fails because only 22989 is listed there.
• C fails because it converts a credit into normative force.
• D fails because Annex C is informative guidance.

Takeaway. Ask where a document appears, then what force that location gives it.

Topic Self-Check

State the Annex A shape as numbers and status. Explain why Annex B can be essential yet cannot source a nonconformity.

Context, Interested Parties, Scope And AI Roles

Clause 4 runs in one direction and each step constrains the next. Clause 4.1 requires external and internal issues affecting the AIMS, including an explicit climate change determination. Clause 4.2 requires interested parties and their requirements, Clause 4.3 a documented scope, and Clause 4.4 the AIMS and its processes. Reverse the order and scope becomes an assertion, which is why auditors read context first.

Role decides which controls carry weight. The Note to Clause 4.1 lists the AI provider, producer, customer including user, partner, subject and relevant authority. One organisation holds several roles across systems, and role changes emphasis, not whether the AIMS applies.

Worked Example

A fictional library licenses a supplier's catalogue assistant, configures it with local data and offers it to borrowers. It is a customer and user, so oversight and supplier alignment dominate; calling itself a producer would send it after design controls it does not need.

Sample Question

Objective assessed: apply the Clause 4 sequence to a described scope.

A draft scope covers one prediction system, supported by a procedure and a risk register, but the file has no issues analysis, no interested party list and no climate determination. Which comment is best?

1. The scope is invalid, because an AIMS must cover every system in use.
2. The scope lacks the determinations that justify it, since issues precede the boundary.
3. The scope is adequate, because a scope and risk register satisfy Clause 4.3.
4. The only gap is the climate determination, the sole Clause 4.1 record needed.

Correct answer: B. The boundary may be fine, but the reasoning behind it is missing.

• A fails because scope breadth is the organisation's decision.
• C fails because Clause 4.1 also applies to the AIMS.
• D fails because issues and requirements are missing too.

Takeaway. A scope is a conclusion drawn from context and interested parties.

Topic Self-Check

Give one internal issue, one external issue and one interested party requirement for a known organisation, naming each clause.

Leadership, Policy, Assigned Authority And Reporting

Clause 5 makes leadership accountable rather than supportive. Clause 5.1 requires top management to take accountability for AIMS effectiveness, fit policy and objectives to strategic direction, integrate the AIMS into business processes, provide resources and support improvement. Clause 5.2 requires an AI policy appropriate to purpose that frames objectives, commits to applicable requirements and continual improvement, and is documented and communicated. Clause 5.3 requires roles, responsibilities and authorities to be assigned and communicated.

Annex A gives that substance. A.2.2 requires a documented AI policy, A.2.3 alignment with other policies so it does not contradict security, privacy or procurement rules, and A.2.4 planned review. A.3.2 covers AI roles and responsibilities, A.3.3 reporting of concerns. The governing body holds ultimate accountability, while top management directs and controls the organisation, and Clause 5 duties attach to top management.

Worked Example

Halvard Freight, a fictional carrier, publishes a policy valuing fairness, transparency and innovation. It commits to no requirement, frames no objectives, ignores the privacy policy it overlaps and carries no review date. It satisfies communication and nothing else.

Sample Question

Objective assessed: evaluate a described policy and leadership arrangement.

A policy commits to requirements and improvement but has not been reviewed in four years, contradicts the data protection policy, names no owner and routes concerns to an unread hotline. Which description fits?

1. Content gaps only, since commitments to requirements suffice.
2. Assignment gaps only, since the policy text itself is adequate.
3. Gaps in review, alignment, assigned roles and a reporting route reaching authority.
4. No significant gaps, because approval and a hotline satisfy the requirements.

Correct answer: C. Each weakness maps to A.2.3, A.2.4, A.3.2, A.3.3 and Clause 5.3.

• A fails because review and alignment are separate requirements.
• B fails because a channel reaching nobody with authority does not satisfy the reporting control.
• D fails because approval is one step in leadership, not all of it.

Takeaway. Test a policy by commitments, connections, review date and named owner.

Topic Self-Check

Distinguish governing body from top management, then name four elements of a Clause 5.2 policy.

From Principle To Requirement, And Impact Assessment

A principle states a value; a requirement states what the organisation must do and can evidence. "We will treat people fairly" cannot be audited. "Every system that ranks people is assessed for differential outcomes across affected groups before deployment" can. Fairness, transparency, explainability, robustness and safety are engineering properties, and they conflict: a more explainable model may be less accurate. Fairness cannot be met by one metric, so state the measure chosen and why. Transparency is not explainability: disclosing that AI was used differs from explaining this outcome.

Clause 6.1.4 requires an AI system impact assessment. Its subject is the effect on individuals, groups and society, not the organisation's own objectives, which is why it sits beside risk assessment rather than inside it. Controls A.5.2 to A.5.5 cover the process, records and impacts on people, and ISO/IEC 42005:2025 supplies method. An assessment records the system, intended use, affected parties, impacts and severity, tolerance, treatment, owner and review trigger, and is revisited when system or context changes.

Worked Example

Vellin Care, a fictional home-care provider, records reputational and cost risks for its scheduling system. Nobody asks what compressed travel time does to care workers, or a changed carer to clients. The register is competent on organisational risk, silent on human impact.

Sample Question

Objective assessed: separate a principle from a requirement and identify the missing impact work.

A transport authority holds a benchmark, a financial risk register, a privacy screening and a benefits note. What is still missing for Clause 6.1.4?

1. Nothing, because those documents cover technical, financial, privacy and benefit aspects.
2. An assessment of how changed service patterns affect passengers and areas.
3. Only a societal study, since the privacy screening covers individuals.
4. Only a retest schedule, since the benchmark establishes impact.

Correct answer: B. Those documents address performance, finance, data protection and advocacy, not consequences for people in context.

• A fails because none of them answers the impact question.
• C fails because privacy screening is not an impact assessment of individuals and groups.
• D fails because a benchmark cannot establish impact.

Takeaway. Ask who is affected, then where that reasoning is recorded and revisited.

Topic Self-Check

Convert a principle into a requirement with owner, trigger and record. Explain what a change of intended use does to an assessment.

Applying Clauses 4 To 6.1.4 And Recognising Nonconformity

Application means building the chain rather than reciting it. Context and interested parties justify a scope; role locates the organisation in the value chain; policy frames objectives; assigned authority makes someone answerable; impact assessment addresses effects on people. To find a nonconformity, work forward and stop at the first break, because an upstream break usually explains a strange result downstream.

Worked Example

Ternwell Growers, a fictional cooperative, has a board-signed policy and a named AI lead, but no interested party list, a scope reading "all AI" and one impact assessment done because a customer asked. The policy is sound; Clause 4.2 and 4.3 work comes first.

Sample Question

Objective assessed: identify which requirement a described failure breaches.

A port operator has an approved policy and a named head of AI assurance empowered to stop deployments. Its scope covers one berth system, with no interested party analysis, no impact assessment and no reconciliation with the safety system assigning conflicting authority. Which statement identifies the failures?

1. Leadership failure only, because the AI role conflicts with the safety system.
2. Impact assessment failure only, since that is the single gap addressed.
3. Failures in interested party analysis and scope, in policy alignment, and in impact assessment.
4. No failure, because a policy, a scope and a named owner are sufficient.

Correct answer: C. Three breaks are visible, mapping to Clause 4.2 with 4.3, to A.2.3, and to Clause 6.1.4 with the A.5 controls.

• A fails because the role does hold authority, so the conflict is an alignment failure.
• B fails because it ignores the upstream causes.
• D fails because sound policy does not replace analysis, alignment or assessment.

Takeaway. Diagnose from the earliest break in the chain.

Topic Self-Check

Write the scope statement you would recommend for the port operator, then grade each break.