ISO/IEC 42001:2023 is a management system standard for artificial intelligence: it does not describe a single model or product but how an organization manages AI. I completed lead auditor training for this standard in 2025. This post is not a certification claim and not a substitute for the standard; it is a question list, distilled from that training and my project management experience, that makes a project lead’s job easier.
First, a distinction: an organization’s certificate versus a working method
ISO/IEC 42001 is a management system standard that organizations can be certified against. I do not hold an organizational certificate; I use the perspective I gained from lead auditor training as a working method at project level. So the list below is the question list of a project lead who says “governance should not be added afterwards”. If your goal is organizational certification, this list is only a good starting point, not a replacement.
1. Purpose and scope
- Which business question or process does the AI system serve?
- Who will use it, in what context, and in which situations must it not be used?
- Are the out-of-scope items written down?
2. Responsibility and roles
- Who is the business owner of the system, and who is the technical owner?
- Whom does one go to when an output is challenged or an error is noticed?
- Who holds the decision rights to expand, stop or roll back?
3. Data
- Where does the data come from, and do we have the right and permission to use it?
- Does it contain personal data and, if so, which rules and safeguards apply?
- Who can access which data, and what are the retention and deletion rules?
- Who monitors data quality and freshness, and how?
4. Risk and impact assessment
- If the system misbehaves, who is affected and how?
- Are risks kept in a register with an owner and a mitigation each?
- Have the points that need human approval been identified?
- What control exists for wrong, biased or fabricated output?
5. Lifecycle and change
- Are design, testing, deployment, maintenance and retirement defined?
- Is there a re-assessment when the model, the prompt or the data changes?
- Are changes recorded?
6. Third parties
- Which external model, service or data provider is used?
- What data goes to that provider, and do the contract and privacy terms cover it?
- What happens if the provider changes or the service stops?
7. Monitoring and improvement
- What do we monitor while the system is live, and how often?
- Can users report problems, and whose desk do the reports land on?
- How do findings turn into the next improvement decision?
How do I use this list in a project?
I use the list as part of planning, not as an audit form. In the first weeks the answers are collected; questions that cannot be answered go into the risk register with an owner and a date. After the pilot the list is reviewed again, and the decision to expand is made by looking at those answers. That way governance becomes a record that feeds decisions rather than a pile of documents added at the end of the project.
Assessing the standard itself and whether your organization needs certification is a separate job; I recommend getting support from an independent expert or an accredited certification body for that. For my own working approach, see the Information Security and ISO Compliance and AI Projects pages.