iso-42001-soalisted

# ISO/IEC 42001 — AIMS and Statement of Applicability ISO/IEC 42001:2023 is a management system standard. If the organisation already runs ISO 27001 or 9001, most of clauses 4–10 is familiar machinery — context, leadership, planning, support, operation, evaluation, improvement — and can be extended rather than rebuilt. Say this early; teams routinely budget for a greenfield build they do not need. What is genuinely new is **Annex A**, the AI-specific control set, and the requirement to consider impacts **on individuals and society**, not only on the organisation. That second point is the substantive difference from 27001 and the one most likely to be skipped: a risk assessment that only considers risk *to the business* does not meet this standard. Control detail in [`references/annex-a.md`](references/annex-a.md). ## Scope Get this right first — it constrains everything, and a scope written too wide is the most expensive certification mistake available. Establish which organisational units, which AI systems, which lifecycle stages, and which roles (developer, provider, deployer, user) are in scope. Note that an organisation often holds several roles simultaneously for different systems, and the applicable controls differ by role. ## Clause conformity (4–10) Assess in order; later clauses depend on earlier ones. **4 Context** — internal and external issues, interested parties and their requirements, scope, and the AIMS itself. Interested parties for AI extend beyond cu