ISO/IEC 42001 and Connected AI Governance: Building an AI Management System That Works

AI governance is maturing quickly.

A few years ago, many organizations were still asking whether they needed an AI policy.

Now the question is bigger:

• Which AI systems are in use?
• Who owns them?
• What data do they use?
• Which vendors are involved?
• Which risks have been assessed?
• Which controls are operating?
• Which evidence proves those controls?
• Which AI systems are monitored after approval?
• Which incidents or issues have occurred?
• Which AI use cases require executive oversight?
• Which obligations or standards apply?
• Which parts of the program are audit-ready?

That is why ISO/IEC 42001 matters.

ISO/IEC 42001 gives organizations a structured way to build an Artificial Intelligence Management System, or AIMS. ISO describes the standard as providing requirements and guidance for organizations that develop, provide, or use AI systems, helping them manage AI-related risks while supporting innovation, trust, and accountability.  

But a management system does not work because a document says it exists.

It works when policies, roles, risk assessments, controls, evidence, monitoring, issues, audits, management reviews, and improvement actions are connected.

That is where Connected GRC becomes essential.

In a Connected GRC program, ISO/IEC 42001 is not treated as a certification checklist or a binder of AI governance procedures. It becomes a connected operating model that links AI strategy, AI policy, AI inventory, use-case assessments, model risk, data governance, vendor risk, controls, evidence, monitoring, incidents, issues, internal audit, management review, and executive reporting.

The goal is not to create an AI management system that looks good on paper.

The goal is to build one that works.

What is ISO/IEC 42001?

ISO/IEC 42001 is an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System within an organization.

ISO says ISO/IEC 42001 applies to organizations that develop, provide, or use AI systems. It is designed to help organizations manage AI risk while supporting innovation, trust, and accountability. ISO also describes ISO/IEC 42001 as the first global standard defining how to establish, implement, maintain, and continually improve an AI management system.  

An AI management system is not just an AI policy.

It is a structured set of policies, processes, roles, controls, assessments, monitoring routines, evidence records, and improvement mechanisms that govern how AI is developed, provided, deployed, used, and monitored.

In practical terms, ISO/IEC 42001 helps organizations answer:

• What AI systems are in scope?
• What AI policy applies?
• Who is accountable?
• What AI risks and impacts are assessed?
• What controls are required?
• How is AI data governed?
• How are third-party AI systems managed?
• How are AI systems monitored?
• How are issues handled?
• How is performance reviewed?
• How does the organization improve the AI management system over time?

That is why ISO/IEC 42001 fits naturally into Connected GRC.

What is an AI Management System?

An AI Management System is a structured operating model for managing the responsible development, provision, deployment, use, monitoring, and improvement of AI systems.

ISO explains that an AI management system helps organizations define responsibilities for AI use, identify and assess AI-related risks, ensure transparency and accountability, manage data quality and system performance, address ethical, legal, and societal concerns, and monitor AI systems throughout their lifecycle.  

Inside Connected GRC, an AI management system should include:

• AI policy
• AI objectives
• AI inventory
• AI use-case intake
• AI risk assessment
• AI impact assessment
• data governance
• model governance
• vendor and third-party governance
• controls
• evidence
• monitoring
• incident management
• issue remediation
• internal audit
• management review
• continual improvement
• executive reporting

A management system is not a static artifact.

It is a way of operating.

Why ISO/IEC 42001 belongs inside Connected GRC

ISO/IEC 42001 touches many GRC domains at once.

It connects to:

• AI Governance
• Enterprise Risk Management
• Compliance Management
• Privacy Risk Management
• Cyber & IT Risk
• Third-Party Risk Management
• Contract Lifecycle Management
• Policy Management
• Evidence Management
• Issues Management
• Internal Audit
• Regulatory Change Management
• GRC Dashboards
• Board and executive reporting

AI governance cannot live in one function.

Legal may own regulatory interpretation.
Compliance may own governance procedures.
Privacy may own personal data review.
Cyber may own AI security risk.
Procurement may own vendor intake.
Third-party risk may own AI provider due diligence.
Business owners may own AI use cases.
Data teams may own datasets.
Model owners may own validation and monitoring.
Internal audit may review the program.
Executives may own risk decisions.

Connected GRC gives these teams a shared operating model.

It makes the AI management system traceable, accountable, evidenced, and reportable.

ISO/IEC 42001 is not the same as an AI policy

An AI policy is important.

But it is not enough.

A policy says what should happen.

An AI management system makes it happen.

That is the difference.

ISO/IEC 42001 is not the same as the NIST AI RMF

ISO/IEC 42001 and the NIST AI RMF are related, but they are not the same.

NIST’s AI RMF Core is organized around four functions: Govern, Map, Measure, and Manage. NIST describes those functions as outcomes and actions that help organizations manage AI risks and responsibly develop trustworthy AI systems.  

A practical distinction:

In Connected GRC, these should work together.

NIST AI RMF can help structure AI risk thinking.

ISO/IEC 42001 can help structure the management system.

Connected GRC can operationalize both.

ISO/IEC 42001 is not the same as EU AI Act compliance

ISO/IEC 42001 can support AI governance readiness, but it should not be treated as automatic compliance with every AI regulation.

The European Commission says the EU AI Act entered into force on August 1, 2024 and follows staggered application dates.  

The EU AI Act creates legal obligations based on risk categories, roles, system types, and use cases. ISO/IEC 42001 provides a management-system framework for AI governance.

They are related, but not identical.

A Connected GRC program should map:

• ISO/IEC 42001 requirements
• EU AI Act obligations, where applicable
• NIST AI RMF functions
• CRI AI RMF or sector-specific requirements, where applicable
• internal AI policies
• customer commitments
• vendor contract obligations
• evidence
• controls
• issues
• monitoring

This prevents teams from confusing certification readiness with regulatory readiness.

The ISO/IEC 42001 Connected GRC map

An AI management system should connect to the broader GRC data model.

This is what makes ISO/IEC 42001 operational inside Connected GRC.

The management-system requirement becomes a workflow.

The workflow creates records.

The records create evidence.

The evidence supports accountability.

1. Define the AI management system scope

AIMS scope is the starting point.

The organization needs to define which AI systems, business units, products, services, geographies, vendors, datasets, and use cases are in scope.

A connected scope record should include:

• business units in scope
• products or services in scope
• AI systems in scope
• AI use cases in scope
• third-party AI tools in scope
• AI vendors in scope
• datasets in scope
• legal entities in scope
• jurisdictions in scope
• AI lifecycle stages in scope
• exclusions
• rationale
• approval

Scope matters because not every AI use case needs the same governance depth.

A customer-impacting AI decision tool should not be treated like a low-risk internal drafting assistant.

The scope should be connected to the AI inventory.

If the inventory changes, scope may need to change.

2. Define AI policy and AI objectives

ISO/IEC 42001 is a management-system standard, so policy and objectives matter.

A connected AI policy should define:

• acceptable AI use
• prohibited AI use
• data-use rules
• vendor AI requirements
• approval requirements
• human oversight expectations
• monitoring expectations
• incident escalation
• exception management
• evidence requirements
• employee responsibilities

AI objectives should be measurable where possible.

Examples:

• maintain complete inventory of approved AI use cases
• review high-risk AI use cases before launch
• ensure AI systems using sensitive data receive privacy review
• ensure third-party AI tools receive vendor risk review
• monitor high-risk AI systems on an approved cadence
• remediate AI issues within defined timelines
• provide executive reporting on AI risk posture

A connected AI objective record should include:

• owner
• metric
• target
• related risk
• related control
• evidence
• dashboard
• review cadence

AI policy defines expectations.

AI objectives make performance measurable.

3. Build the AI inventory as the system of record

The AI inventory is the foundation of ISO/IEC 42001 inside Connected GRC.

The inventory should include:

• AI system or tool name
• AI use case
• business purpose
• business owner
• technical owner
• model owner, where relevant
• internal or third-party AI
• vendor or model provider
• business process supported
• data used
• personal data involvement
• sensitive data involvement
• decision impact
• automation level
• human oversight
• lifecycle stage
• risk tier
• assessment status
• approval status
• monitoring status
• incident history
• open issues
• evidence

SmartSuite’s AI Governance page describes centralized AI model inventories, risk and performance assessments, recurring assessments, monitoring cycles, standardized risk signals, issue workflows, and executive dashboards.  

That is the right model.

The AI inventory should not be a spreadsheet maintained once a quarter.

It should be a living governance record.

4. Define roles, responsibilities, and authorities

ISO/IEC 42001 readiness depends on clear accountability.

A connected AI governance model should define:

• AI governance owner
• AI use-case owner
• model owner
• data owner
• privacy reviewer
• cyber reviewer
• legal reviewer
• compliance reviewer
• vendor owner
• contract owner
• issue owner
• monitoring owner
• approval authority
• escalation authority
• internal audit role
• executive sponsor

The charter should define who can:

• approve AI use
• reject AI use
• approve exceptions
• accept residual risk
• pause an AI system
• require remediation
• approve vendor AI terms
• approve monitoring thresholds
• close AI issues
• escalate to executives or the board

AI governance fails when everyone is consulted but no one is accountable.

Connected GRC should make decision rights visible.

5. Conduct AI risk assessments

AI risk assessment should be tied to the use case.

A connected AI risk assessment should include:

• AI use case
• business owner
• system or model
• intended use
• affected stakeholders
• decision impact
• data used
• vendor involvement
• risk tier
• inherent risk
• controls
• residual risk
• approval decision
• conditions
• evidence
• issue, if needed

AI risks may include:

• inaccurate output
• bias
• lack of explainability
• privacy risk
• security risk
• regulatory risk
• vendor risk
• operational risk
• reputational risk
• intellectual property risk
• misuse
• human oversight failure
• model drift
• overreliance

Risk assessment should not be a form that disappears after approval.

It should connect to controls, evidence, monitoring, and issue management.

6. Conduct AI impact assessments where needed

Some AI use cases require more than a risk assessment.

They require an impact assessment.

An AI impact assessment may consider:

• affected individuals
• affected groups
• rights or interests affected
• customer impact
• employee impact
• safety impact
• privacy impact
• fairness impact
• transparency needs
• explainability needs
• legal or regulatory exposure
• societal impact
• mitigation measures
• residual impact
• approval conditions

ISO’s AI standards ecosystem now includes ISO/IEC 42005, which ISO describes as an AI system impact assessment standard published in 2025.  

Inside Connected GRC, an AI impact assessment should connect to:

• AI use case
• data inventory
• privacy review
• legal review
• controls
• evidence
• issues
• approval decision
• monitoring requirements

Impact assessment is not only a compliance artifact.

It is a decision tool.

7. Connect AI governance to data governance

AI management depends on data management.

A connected AI data record should show:

• data category
• data owner
• data source
• sensitivity
• personal data involvement
• confidential data involvement
• training use
• prompt use
• output use
• retention
• access controls
• vendor processing
• privacy review
• evidence
• issue history

AI data risks may include:

• poor data quality
• biased data
• sensitive data exposure
• unauthorized use
• unclear retention
• model training without approval
• vendor data-use ambiguity
• inability to delete or correct data
• lack of data lineage
• unsupported outputs

AIMS controls should not treat data as an afterthought.

Data is often where AI risk begins.

8. Connect AI governance to third-party and vendor risk

Many organizations use AI through third-party systems.

A connected AI vendor record should include:

• vendor
• AI functionality
• model provider
• business owner
• data used
• contract owner
• cyber review
• privacy review
• legal review
• data-use terms
• model training terms
• subprocessor information
• audit rights
• incident notification obligations
• retention terms
• security evidence
• open issues
• renewal impact
• offboarding requirements

AI vendor risk should connect to:

• Third Party Risk
• Vendor Portal
• Contract Lifecycle Management
• Privacy Risk Management
• Cyber & IT Risk
• Evidence Management
• Issues Management

If a vendor AI tool uses customer data, processes sensitive information, or influences business decisions, it should not be approved through a standard procurement workflow alone.

It needs AI-specific risk review.

9. Define AI controls and control objectives

AI controls should be explicit.

Examples include:

A connected AI control record should include:

• control objective
• owner
• frequency
• risk addressed
• policy mapping
• evidence requirement
• test method
• monitoring requirement
• issue trigger
• framework mapping
• last result
• open issues

AI controls make the management system measurable.

Without controls, AI governance becomes policy guidance.

10. Build AI evidence management

AI governance needs evidence.

Evidence may include:

• AI inventory record
• AI intake form
• risk tiering result
• AI risk assessment
• AI impact assessment
• privacy review
• cyber review
• legal review
• vendor assessment
• contract terms
• model documentation
• testing results
• human oversight documentation
• approval decision
• approval conditions
• monitoring results
• incident record
• issue remediation evidence
• management review materials
• internal audit evidence

A connected AI evidence record should include:

• AI use case
• AI system
• control supported
• policy supported
• period covered
• provider
• reviewer
• acceptance status
• issue link
• audit relevance
• external sharing restriction
• retention requirement

Evidence should be created as the AI management system operates.

Not assembled after audit or executive review begins.

11. Monitor AI systems after approval

AI governance does not end at approval.

Monitoring is essential because AI systems can change over time.

A connected AI monitoring record should include:

• AI system
• monitoring owner
• metric
• threshold
• review cadence
• data source
• reviewer
• result
• exception
• issue trigger
• escalation rule
• evidence
• reassessment trigger

Monitoring may cover:

• accuracy
• performance
• drift
• bias or fairness
• data quality
• human overrides
• user complaints
• incidents
• hallucination rates
• privacy signals
• security signals
• vendor changes
• regulatory changes
• availability

ISO explains that an AI management system helps organizations monitor AI systems throughout their lifecycle.  

That is a critical point.

AIMS maturity depends on ongoing monitoring, not only pre-deployment review.

12. Manage AI incidents and nonconformities

An AI management system should define what happens when something goes wrong.

AI incidents or nonconformities may include:

• unapproved AI use
• sensitive data entered into an AI tool
• inaccurate output affecting customers
• biased result
• model drift
• security issue
• prompt injection
• vendor AI incident
• policy violation
• monitoring threshold breach
• human oversight failure
• approval condition missed
• contract obligation missed

A connected AI incident or nonconformity record should include:

• AI system or use case
• event description
• date
• owner
• severity
• affected data
• affected stakeholders
• vendor involved
• policy or control involved
• evidence
• root cause
• issue created
• remediation plan
• validation
• reassessment decision
• escalation status

This connects ISO/IEC 42001 to Incident Management and Issues Management.

A management system is only credible if it learns from failures.

13. Connect AI issues to remediation and validation

AI gaps should become issue records when action is required.

Examples:

• missing inventory entry
• missing business owner
• missing privacy review
• missing cyber review
• missing vendor evidence
• insufficient contract terms
• incomplete impact assessment
• monitoring not defined
• monitoring exception unresolved
• incident root cause not remediated
• approval condition overdue
• AI policy exception not approved

A connected AI issue should include:

• issue source
• AI system or use case
• affected risk
• affected control
• owner
• severity
• root cause
• due date
• remediation plan
• evidence required
• validation method
• status
• escalation
• residual risk decision

Closure should require evidence.

Material issues should require validation.

That is how AI governance becomes defensible.

14. Conduct internal audits of the AI management system

ISO/IEC 42001 is a management-system standard, so internal audit and management review matter.

An internal AIMS audit should evaluate whether:

• scope is defined
• AI policy is current
• roles and responsibilities are clear
• AI inventory is maintained
• AI risk assessments are performed
• AI impact assessments are performed where needed
• controls are defined and evidenced
• vendors are reviewed
• monitoring is performed
• incidents are escalated
• issues are remediated
• management review occurs
• continual improvement actions are tracked

An internal audit record should connect to:

• audit plan
• audit scope
• evidence
• findings
• issues
• remediation
• validation
• management review

Internal audit should not own the AI management system.

But it can provide assurance over whether the system is working.

15. Conduct management review

Management review is where the AI management system becomes accountable to leadership.

A connected management review should include:

• AI inventory status
• risk assessment status
• high-risk AI use cases
• monitoring results
• incidents
• issues
• remediation status
• internal audit findings
• vendor AI risks
• policy exceptions
• regulatory changes
• resource needs
• decisions needed
• improvement actions

A management review record should include:

• meeting date
• attendees
• materials reviewed
• decisions made
• actions assigned
• owners
• due dates
• evidence
• follow-up status

This connects ISO/IEC 42001 to the Connected GRC Operating Committee and executive reporting.

Management review should not be a ceremonial meeting.

It should create decisions and actions.

16. Build continual improvement into the workflow

An AI management system should improve over time.

Continual improvement may come from:

• incidents
• monitoring exceptions
• internal audit findings
• management review
• regulatory changes
• user feedback
• vendor changes
• data-quality issues
• model performance changes
• policy exceptions
• external assurance
• new AI use cases

Connected improvement actions should include:

• improvement source
• owner
• objective
• action plan
• metric
• due date
• evidence
• validation
• dashboard status

This prevents AI governance from becoming stale.

A mature AIMS should adapt as AI use, regulation, technology, and risk change.

17. Connect ISO/IEC 42001 to AI regulatory readiness

ISO/IEC 42001 can help organizations build governance discipline that supports regulatory readiness.

But the organization still needs to map specific legal obligations.

A connected AI regulatory readiness model should include:

• AI inventory
• AI risk classification
• legal obligations
• internal policy mapping
• controls
• evidence
• issue remediation
• incident records
• monitoring
• change management
• audit trail
• approval records
• customer or regulator response records

This is especially important for organizations facing:

• EU AI Act obligations
• sector-specific AI requirements
• privacy laws
• employment or consumer protection requirements
• financial-services model governance
• customer contractual commitments
• public-sector procurement requirements

Connected GRC makes the mapping visible.

It helps teams avoid treating ISO/IEC 42001 as a substitute for legal analysis.

18. Build ISO/IEC 42001 dashboards that show AIMS health

An ISO/IEC 42001 dashboard should show whether the AI management system is working.

Useful dashboard views include:

The dashboard should not only show activity.

It should show AIMS health.

How Connected GRC changes the ISO/IEC 42001 conversation

A disconnected ISO/IEC 42001 conversation sounds like this:

“We have an AI policy, an AI inventory, risk assessment templates, and a management review process. We are preparing documentation for ISO/IEC 42001 readiness.”

A connected ISO/IEC 42001 conversation sounds like this:

“Our AI inventory includes 61 use cases. Eleven are high risk, eight involve third-party AI vendors, and six involve sensitive data. Three high-risk use cases are missing monitoring evidence. Two vendor AI reviews have unresolved contract issues. One AI incident created a remediation issue that is pending validation. Management review has four open actions, and the dashboard shows two executive decisions needed before the next certification readiness review.”

The second conversation is more useful.

It shows whether the AI management system is operating.

That is the value of Connected GRC.

Where to start with ISO/IEC 42001 readiness

Organizations do not need to implement every AIMS workflow at once.

Start where the AI management system is weakest.

Start with the AI inventory if visibility is unclear

Create a central record of AI systems, use cases, owners, vendors, data, risk tier, approval status, monitoring, and issues.

Relevant links:

• AI Governance
• The Connected GRC Data Model
• How to Measure Connected GRC Program Health
• GRC Dashboards

Start with AI policy and objectives if governance is informal

Define policy expectations, AI objectives, responsibilities, controls, and reporting cadence.

Relevant links:

• The Connected GRC Program Charter
• Policy Management
• Control Framework & Regulatory Libraries
• Connected GRC Operating Committee

Start with AI risk and impact assessments if approvals are inconsistent

Create tiered AI assessment workflows tied to data, privacy, cyber, legal, vendor, and business review.

Relevant links:

• CRI AI RMF
• Privacy Risk Management
• DPIA vs PIA vs Privacy Risk Assessment
• Cyber & IT Risk

Start with vendors if third-party AI is the main exposure

Connect AI providers to contracts, data-use terms, security review, privacy review, incidents, issues, and renewals.

Relevant links:

• Third Party Risk
• Vendor Portal
• Contract Lifecycle Management
• AI Governance

Start with monitoring if AI is already in production

Define performance metrics, thresholds, monitoring evidence, reassessment triggers, incidents, and issue workflows.

Relevant links:

• Issue Remediation and Validation
• Incident Management
• Evidence Management
• GRC Dashboards

The best starting point is the area where AI use has moved faster than governance control.

Common ISO/IEC 42001 implementation mistakes to avoid

Mistake 1: Treating ISO/IEC 42001 as a documentation project

AIMS readiness is not only policies and procedures.

It requires operating records, controls, evidence, monitoring, issues, audit, management review, and improvement.

Mistake 2: Treating the AI inventory as enough

The inventory is foundational, but ISO/IEC 42001 needs risk management, controls, evidence, monitoring, and improvement.

Mistake 3: Ignoring third-party AI

Many organizations use AI through vendors.

AI vendor risk must connect to contracts, data use, cyber review, privacy review, evidence, issues, and renewals.

Mistake 4: Reviewing AI only before launch

AI risk changes over time.

Monitoring, reassessment, incidents, and issue management are essential.

Mistake 5: Confusing ISO/IEC 42001 with automatic regulatory compliance

ISO/IEC 42001 can support governance and readiness, but organizations still need to map specific legal and regulatory obligations.

Mistake 6: Leaving management review disconnected from source records

Management review should use live records: inventory, risks, controls, evidence, monitoring, incidents, issues, audit findings, and decisions.

Mistake 7: Closing AI issues without validation

AI remediation should be evidenced and validated, especially for high-risk use cases.

A practical test for your AI management system

Pick one AI use case.

Then ask whether your current GRC model can quickly show:

• whether the use case is in the AI inventory
• business owner
• technical or model owner
• business purpose
• lifecycle stage
• risk tier
• data used
• sensitive or personal data involvement
• vendor or model provider
• policy mapping
• risk assessment
• impact assessment, if required
• privacy review
• cyber review
• legal or compliance review
• vendor review
• contract terms
• controls required
• evidence submitted
• approval decision
• approval conditions
• monitoring metrics
• monitoring exceptions
• incidents
• open issues
• remediation evidence
• validation status
• management review status
• executive decisions needed

Then ask whether you can answer those questions across your full AI inventory.

If the answer requires spreadsheets, intake forms, policy documents, vendor files, privacy assessments, cyber reviews, monitoring exports, contracts, and meetings, your AI management system is not connected enough.

That is common.

It is also the opportunity.

Final thought

ISO/IEC 42001 gives organizations a structured way to build an AI management system.

Connected GRC makes that system operational.

It links AI policy to objectives.
Objectives to inventory.
Inventory to use cases.
Use cases to risks.
Risks to controls.
Controls to evidence.
Evidence to assessments.
Assessments to approval.
Approvals to monitoring.
Monitoring to incidents.
Incidents to issues.
Issues to remediation.
Remediation to validation.
Internal audits to findings.
Management reviews to decisions.
Decisions to improvement.

That is what an AI management system should do.

It should not be a binder of AI governance documents.

It should be a connected operating model that helps the organization innovate responsibly, manage risk, prove accountability, and improve over time.

That is the practical value of ISO/IEC 42001 inside Connected GRC.