Context & scope
Understand the organisation, interested parties, roles in the AI ecosystem and the boundaries of the AIMS.
ISO/IEC 42001:2023 · Artificial Intelligence Management System
Make AI governance operational.
Bring AI-related scope, responsibilities, risks, policies, suppliers, evidence and improvement actions into a governed workspace while building an Artificial Intelligence Management System.
STORM provides documented governance building blocks. Its current technical description does not list a ready-made ISO/IEC 42001 assessment, AI model registry, AI impact-assessment engine or AI-specific performance monitoring.
AIMS operating cycleHuman accountability active
AIMSResponsible AI governance
PlanContext · risk · objectives
DoControls · lifecycle · suppliers
CheckMonitor · audit · review
ActCorrect · learn · improve
2023 editionthe current published first edition
AIMSa management system for responsible AI
All organisationsfor developers, providers and users of AI
Certifiable systemcertification is independently assessed
The management-system requirements
Govern AI as a system, not a collection of experiments.
ISO/IEC 42001 uses the familiar management-system structure and adds AI-specific risk, impact and lifecycle considerations. The licensed standard remains the authoritative source for the requirements.
Leadership & policy
Set direction, approve an AI policy and assign clear responsibilities and authorities.
Planning
Address AI-related risks and opportunities, select objectives and plan controlled change.
Support
Provide resources, competence, awareness, communication and controlled documented information.
Operation
Operate the AIMS, assess and treat AI risks and evaluate impacts arising from AI systems.
Performance evaluation
Monitor performance, conduct internal audits and complete management reviews.
Improvement
Manage nonconformities, corrective actions and continual improvement of the AIMS.
Evidence boundary
Use what is documented. Configure what is not.
This distinction keeps the page useful without implying product functionality that is absent from the supplied STORM technical description.
Documented STORM building blocks
- Asset, service, data, software, people and supplier records
- Custom risk, control, treatment, ownership and evidence records
- Controlled policies, procedures, approvals and acknowledgements
- Supplier assessments, actions and management-review records
Must be confirmed or configured
- Licensed ISO/IEC 42001 requirement content and mappings
- Dedicated AI-system or model inventory fields
- AI system impact-assessment methodology and workflow
- Bias, drift, explainability or model-performance monitoring
Where STORM can support an AIMS
A governance layer for the work around responsible AI.
STORM can organise foundational records and workflows needed by an AIMS implementation. AI-specific requirements, taxonomies and assessment content must be defined and validated for the organisation.
Map the operating context
Use records for services, data, software, infrastructure, people and suppliers as inputs when defining which AI-enabled activities and dependencies belong in scope.
Cartography · dependenciesRegister organisation-defined AI risks
Capture custom risks with likelihood, impact, controls, treatment strategy, owners, review dates, mitigation plans and supporting attachments.
Risk registry · treatmentControl AI governance documents
Maintain policies, procedures and guidance with versions, owners, approvals, reviews, acknowledgements, reminders and a complete document history.
Policy Center · audit trailBring AI suppliers into oversight
Record suppliers, assess business impact and security posture, collect evidence and track remediation using organisation-defined questionnaires where appropriate.
TPRM · supplier evidenceMake ownership visible
Assign mitigation and corrective actions, target dates, reviews and attachments so governance decisions have accountable follow-through.
Owners · dates · evidenceConsolidate management inputs
Bring relevant risks, supplier results, policy status, incidents, audit findings and improvement actions into management-review records and decisions.
Review · decisions · improvement
Define the AIMS boundary
Start with the services, data and suppliers around AI use.
STORM Cartography provides reusable context for scoping: the business services, data, software, infrastructure, people and external providers connected to the activities being governed.
- Build scope from existing operational records
- Expose dependencies that influence AI risk and accountability
- Add AI-specific classifications only after agreeing the taxonomy
Translate analysis into action
Keep AI-related risks, controls and owners together.
The custom risk register can hold organisation-defined AI risks and treatment decisions. It is a flexible record, not a substitute for an approved AI risk or impact-assessment method.
- Likelihood, impact, risk level and treatment strategy
- Controls, mitigation actions, owners and review dates
- Evidence attachments and exported treatment records
Control the governance rules
Make AI policy a maintained operating document.
Use the documentation lifecycle for AI policies, acceptable-use rules, approval procedures, supplier expectations and role-specific guidance, while preserving history and accountability.
- Authors, owners, reviewers and approvers
- Version history, planned reviews and reminders
- Acknowledgement status and supporting audit trail
Review and improve
Keep gaps, actions and measures visible to management.
STORM provides action tracking, configurable objectives and KPI records, and management-review inputs. Their use for an AIMS must be configured and validated rather than assumed from the existing ISMS setup.
- Assigned gaps, target dates and remediation progress
- Organisation-defined objectives and measurable indicators
- Decisions and improvement actions retained for review
AI-specific control themesA.2 A.3 A.4 A.5 A.6 A.7 A.8 A.9 A.10
Connect management-system discipline to the AI lifecycle.
Annex A adds AI-focused control objectives. These summaries are orientation only; use the licensed standard to determine the exact applicable controls and implementation evidence.
AI policies
Set and maintain organisational direction for the responsible development, provision or use of AI systems.
Policy · review · ownershipInternal organisation
Define roles, responsibilities, authorities and processes for reporting concerns about AI systems.
Accountability · escalationResources
Understand the data, tooling, systems, computing resources and people involved in AI activities.
Inventory · dependenciesAI system impacts
Establish a consistent way to identify, document and respond to impacts on relevant people and groups.
Impact assessment · evidenceAI system lifecycle
Apply governance throughout design, development, verification, validation, deployment, operation and retirement.
Lifecycle · change · assuranceData for AI systems
Govern data acquisition, quality, provenance, preparation and appropriate use across the lifecycle.
Data governance · traceabilityInformation for interested parties
Define what information is communicated to users and stakeholders and how AI-related events are reported.
Transparency · communicationUse of AI systems
Set processes and responsibilities for appropriate organisational use, including monitoring and operating instructions.
Acceptable use · oversightThird-party relationships
Address responsibilities and risks when AI systems, components, data or services depend on external parties.
Suppliers · customers · evidenceBuild the operating system01 02 03 04 05
From AI discovery to continual improvement.
A practical implementation begins with accountable scope and ends with evidence-led review—not with a generic checklist.
Discover
Identify AI-enabled activities, systems, data, people, suppliers and intended purposes.
Context · scope · inventoryAssess
Define and apply approved risk and impact-assessment methods.
Risk · impact · opportunityGovern
Approve policy, roles, objectives, controls, lifecycle rules and supplier expectations.
Policy · controls · ownershipEvaluate
Monitor defined measures, review evidence, audit the AIMS and escalate exceptions.
Measures · audit · reviewImprove
Correct gaps, respond to change and document management decisions and learning.
Actions · change · improvementPractical questions
Keep governance support and product claims separate.
STORM can provide an operating workspace around an AIMS implementation. AI-specific content, technical assurance and certification require additional defined methods and qualified review.
Does STORM currently include a built-in ISO/IEC 42001 assessment?
The supplied STORM technical description does not list ISO/IEC 42001 among the currently supported standards and does not document a ready-made assessment template. STORM can support foundational governance records, while requirement content and mappings must be confirmed and configured with ICT PROTECT before use.
Can STORM act as an AI model registry?
A dedicated AI model registry is not documented. Cartography can hold services, data, software, infrastructure, people and supplier relationships that may contribute to AIMS scope, but AI-specific model metadata and lifecycle fields must be separately defined and validated.
Does STORM perform AI system impact assessments?
STORM supports configurable risk records, impact information, evidence and action tracking, but the technical description does not claim a native ISO/IEC 42005 or ISO/IEC 42001 AI impact-assessment workflow. An approved methodology and suitable content are still required.
Does STORM monitor bias, drift or explainability?
No such AI-specific model monitoring is documented. STORM's security monitoring capabilities concern supported Microsoft security configurations and should not be presented as AI quality, bias, drift or explainability monitoring.
Can STORM issue ISO/IEC 42001 certification?
No. STORM can organise governance records and evidence. Where certification is pursued, an independent competent certification body conducts the audit and makes the certification decision; ISO/IEC 42006 defines additional requirements for bodies certifying AIMS.
Does ISO/IEC 42001 replace AI laws or regulations?
No. It is a management-system standard and does not replace applicable legal obligations. Organisations must separately identify the laws, regulatory requirements, contracts and stakeholder expectations relevant to each AI use case.
Bring your AI governance scope
Book a STORM demo Test STORM against the records your AIMS must actually control.
Use a focused discussion to review AI scope, risk methodology, policies, suppliers, evidence, actions and reporting—and identify which ISO/IEC 42001 content or product configuration is still required.