ISO 42001:2023 controls

AI introduces new types of risk that extend beyond traditional information security. These include issues around accountability, fairness, transparency and decisionmaking.

ISO 42001 controls are designed to:

• identify and manage AIrelated risks
• introduce governance and oversight across AI systems
• align AI use with regulatory and ethical expectations
• ensure consistency and auditability

Controls are not applied generically. They must reflect how AI is used within the organisation.

‍

Control structure

ISO 42001 controls build on existing ISO management system principles while introducing AIspecific focus areas.

These typically include:

• Governance and oversight – defining accountability and responsibility
• Risk and impact management – identifying and assessing AI risks
• Transparency and explainability – ensuring AI decisions can be understood
• Data and system control – managing data quality, integrity and usage
• Monitoring and review – ensuring systems are assessed and improved

This ensures AI is governed as part of the wider organisation, not treated as a separate technical function.

‍

Selecting and applying controls

Organisations must assess their use of AI and determine which controls are required to manage associated risks.

Controls should be:

• aligned to actual AI use cases
• proportionate to risk
• clearly defined and owned

This approach ensures governance reflects the organisation rather than forcing a generic model.

‍

Applying controls in practice

A common challenge is translating AI governance requirements into practical processes.

Organisations often face:

• unclear ownership of AI systems and outputs
• limited understanding of AI risks
• difficulty evidencing how decisions are made
• disconnect between policy and real use

Controls must be embedded into processes, responsibilities and oversight activities to ensure they are effective.