Establish a defensible management system scope
Identify relevant organisational issues, interested parties and requirements. Define which business activities and AI systems the AIMS covers, including your roles as developer, provider or user. Describe interfaces with suppliers, shared teams and activities outside scope so dependencies remain visible.
ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an AIMS. Build an inventory of scoped use cases and responsibilities. Avoid a scope statement naming an innovation team but ignoring operational departments deploying its outputs.
Connect leadership, objectives and planning
Establish AI policy, assign responsibilities and give decision-makers resources and authority. Set objectives that can be evaluated, such as completing defined validation before release or improving the handling of reported failures. Identify owners, timescales and measures rather than relying on ethical aspirations alone.
Define risk assessment, treatment and system impact assessment processes and how they influence deployment. Determine necessary controls, compare them with Annex A and maintain the required Statement of Applicability. Do not treat every reference control as automatically mandatory or omit necessary controls from other sources.
Operate controls across the relevant lifecycle
Integrate assessments and approvals with procurement, development, testing, release and retirement as applicable to your role. Establish competence, communication and controlled documentation. A buyer of AI-enabled software still needs intended-use boundaries, supplier responsibilities, operating restrictions and change arrangements.
Keep evidence proportionate and traceable: evaluation results, approvals, data decisions, supplier correspondence and monitoring outputs. Record version and configuration where they affect conclusions. Vendor evidence may not cover your application; identify which claims need local testing or operating constraints.
Evaluate performance and correct weaknesses
Plan monitoring, internal audits and management reviews that examine whether the AIMS works. Check approval compliance, assessment quality and treatment effectiveness, not just document completion. Address nonconformity causes and verify corrective action. Feed incidents, complaints and significant changes back into assessment and planning.
Use the existing ISO 42001 support alongside responsible AI governance. Horizon organises risks, controls, owners, evidence and reviews. It does not make risk decisions, validate every output or certify the management system.