ISO 42001 mandatory documents (AI management system)

ISO/IEC 42001:2023 requires as documented information, among others: the AI management system scope (4.3), the AI policy (5.2), the AI risk assessment and treatment processes and results (6.1.2, 6.1.3, 8.2 and 8.3), the Statement of Applicability (6.1.3), the AI system impact assessment (6.1.4 and 8.4), the AI objectives (6.2) and records of competence, monitoring, internal audit, management review and corrective actions.

Required documents by clause

Document	Clause	Purpose
AI management system scope	4.3	Defines which systems, processes and AI roles are covered
AI policy	5.2	Top management commitments and framework for objectives
AI risk assessment process	6.1.2	Criteria to identify, analyse and evaluate risks
AI risk treatment process	6.1.3	How controls are chosen and residual risks approved
Statement of Applicability	6.1.3	Necessary Annex A controls, justification and implementation status
AI system impact assessment process	6.1.4	How consequences for individuals, groups and society are assessed
AI objectives	6.2	Measurable targets and plans to achieve them
Evidence of competence	7.2	Training and experience of people working with AI systems
Operational information	8.1	What is needed to trust that processes run as planned
Risk assessment results	8.2	Up-to-date risk register
Risk treatment results	8.3	Treatment plan and progress
Impact assessment results	8.4	Impact assessments for each system
Monitoring and measurement results	9.1	Indicators and their analysis
Internal audit programme and results	9.2	Plan, reports and findings
Management review results	9.3	Top management decisions and actions
Nonconformities and corrective actions	10.2	What went wrong, cause, action and result

Clause 7.5.1 adds the documented information the organization itself considers necessary for the system to be effective, and several Annex A controls ask for documented decisions about the life cycle, data and information given to users.

Records auditors usually ask for beyond the list

AI system inventory with purpose, the organization's role and affected people.
Register of AI suppliers and the responsibilities agreed with them.
Evidence of staff training and AI literacy.
Log of incidents or concerns reported about AI systems.
Version control and approvals of the system's documents.

Common mistakes

Copying the ISO 27001 Statement of Applicability: ISO 42001 has its own Annex A with 38 controls.
Assessing risks to the organization but forgetting the impact assessment on people affected by the system.
Having an AI policy without measurable objectives or indicators to follow it.
Not recording the organization's role for each system (for example, provider or user).
Documents without an owner or review date.

How to organize the documentation

A practical structure separates governance documents (scope, policy, roles), planning (risk methodology, risk register, impact assessment, Statement of Applicability, objectives), operation (life cycle, data and supplier procedures) and evaluation and improvement (indicators, audit, management review and corrective actions). If the organization already has ISO 27001, shared management documents can be extended instead of duplicated.

Get the free sample See the ISO 42001 documentation toolkit

Frequently asked questions

How many mandatory documents does ISO 42001 have?

There is no fixed number: the standard asks for documented information in several clauses (scope, policy, risks, impact, Statement of Applicability, objectives and operation, evaluation and improvement records). Each organization also adds what it considers necessary.

Is the impact assessment mandatory?

Yes. Clause 6.1.4 requires an AI system impact assessment process and clause 8.4 requires keeping its results.

Can I reuse ISO 27001 documents?

Yes, for the shared parts of the management system (document control, internal audit, management review, corrective actions). AI-specific documents must be prepared separately.

What format must the documents be in?

The standard does not require a format. They can be text documents, spreadsheets or records in a tool, as long as they are controlled, available and protected.

Related guides

Updated: 2026-10-20