Series · ISO/IEC 42001

Preparing for an AIMS

A twelve part series on what to do before anyone mentions policies, controls or certification. Published on LinkedIn, collected here, and gathered into a single document when the series finishes.

The series so far

• Part 1

  Do you know what AI you are already using in your organisation?

  There is the AI purchased on purpose, the AI that arrived as a new feature on an existing platform, and the AI individuals brought in themselves. An inventory is the first step, and the one step that delivers value even if nothing else follows. You cannot govern what you cannot see.

  Read part 1 on LinkedIn
• Part 2

  Understanding your organisational context

  Clause 4.1 asks why AI matters to this organisation specifically: whether you develop it, provide it, use it or all three, what regulators and customers expect, and what you are actually trying to achieve. An AIMS designed without context is just a template, and a template will not survive an audit or a real incident.

  Read part 2 on LinkedIn
• Part 3

  Who cares how you use AI?

  Most organisations list customers, regulators and shareholders, then move on. The AI version of the exercise reaches further: the people your AI makes decisions about, the staff expected to override it, your suppliers’ suppliers, and the sector regulators already publishing AI expectations. This is where the reason for each control comes from.

  Read part 3 on LinkedIn
• Part 4

  What does your AIMS actually cover?

  Scope too broad and you drown in documentation. Too narrow and you have certified part of the picture while the exposure sits outside it. Exclusions need a real justification: a vendor-managed tool with no personal data and no decision impact holds up, a gut feel decision doesn’t.

  Read part 4 on LinkedIn

Still to come