Skip to content

Commit fd9b0df

Browse files
Ankit-UniyalAnkit-Uniyal
authored
Update README.md for Clause 4 context and requirements
1 parent 3f091c8 commit fd9b0df

1 file changed

Lines changed: 183 additions & 166 deletions

File tree

‎03-CLAUSE4-CONTEXT/README.md‎

Lines changed: 183 additions & 166 deletions
Original file line numberDiff line numberDiff line change
@@ -1,169 +1,186 @@
11
# Clause 4 — Context of the Organisation
22
## ISO/IEC 42001:2023 | Implementation Guide
33

4-
> **Purpose:** Establish the foundation of your AIMS by understanding your organisation's environment, stakeholders, scope, and the system itself.
5-
6-
---
7-
8-
## 4.1 — Understanding the Organisation and Its Context
9-
10-
### What it requires
11-
Identify all internal and external issues relevant to your purpose that affect your ability to achieve AIMS intended outcomes.
12-
13-
### Internal Issues to Identify
14-
| Issue Area | Examples |
15-
|-----------|---------|
16-
| AI Strategy | Business goals for AI, board-level AI ambitions |
17-
| Existing AI Systems | Current AI tools, models, products in use |
18-
| Governance | Policies, ethics committees, decision-making structures |
19-
| People and Culture | AI literacy, risk appetite, accountability culture |
20-
| Technical Capability | Data quality, infrastructure, MLOps maturity |
21-
| Ethics and Values | Fairness commitments, transparency policies |
22-
23-
### External Issues to Identify
24-
| Issue Area | Examples |
25-
|-----------|---------|
26-
| Regulation | EU AI Act, GDPR, sector-specific AI rules |
27-
| Standards | ISO 42001, ISO 27001, NIST AI RMF |
28-
| Market | Customer AI expectations, competitor practices |
29-
| Technology | Vendor dependencies, open-source risks |
30-
| Society | Public trust in AI, bias concerns, media scrutiny |
31-
32-
### Implementation Steps
33-
1. Run a PESTLE analysis focused on AI — document each factor
34-
2. Conduct an internal AI capability review — systems, people, processes
35-
3. Populate the Context Register (template below)
36-
4. Get sign-off from senior management
37-
5. Schedule annual review and trigger-based updates
38-
39-
### Documents Required
40-
- Context of the Organisation Register (internal + external issues, rated by relevance)
41-
- AI Systems Inventory (all AI systems: name, purpose, owner, risk level, status)
42-
- PESTLE Analysis Worksheet
43-
44-
---
45-
46-
## 4.2 — Understanding Needs and Expectations of Interested Parties
47-
48-
### What it requires
49-
Identify who has a stake in your AI systems, what they need, and which of those needs become binding requirements for your AIMS.
50-
51-
### Interested Parties Register Template
52-
53-
| Stakeholder | What They Need | Binding? | How Addressed |
54-
|------------|----------------|----------|---------------|
55-
| Employees | Safe AI tools, transparency, no unjust automation | Yes — labour law | AI use policy, training |
56-
| Customers / End Users | Fair decisions, explainability, data privacy | Yes — GDPR, contract | Privacy notices, explanations |
57-
| Regulators | Compliance with AI laws, audit trails | Yes — legal | Compliance controls, records |
58-
| AI Vendors / Suppliers | Clear requirements, IP protection | Yes — contract | Supplier agreements |
59-
| Investors / Board | Risk management, reputational protection | Yes — fiduciary | AIMS reports, board updates |
60-
| General Public / Society | Non-discriminatory AI, societal benefit | Ethical | Ethics framework, bias testing |
61-
| Certification Body | Conformity with ISO 42001 | Yes — certification | Full AIMS implementation |
62-
63-
### Implementation Steps
64-
1. Brainstorm all stakeholder groups using the table above as a starting point
65-
2. For each group, document: who they are, what they need, legal or contractual basis
66-
3. Classify requirements as mandatory or best practice
67-
4. Feed mandatory requirements into your AIMS controls and policies
68-
5. Review when stakeholder landscape changes
69-
70-
### Documents Required
71-
- Interested Parties Register
72-
- Legal and Regulatory Requirements Register
73-
74-
---
75-
76-
## 4.3 — Determining the Scope of the AIMS
77-
78-
### What it requires
79-
Define the exact boundaries of your AI Management System — what AI systems, organisational units, functions, and activities are included.
80-
81-
### Scope Statement Template
82-
83-
AIMS Scope Statement — [Organisation Name]
84-
85-
[Organisation Name] operates an AI Management System in accordance with ISO/IEC 42001:2023,
86-
covering the design, development, deployment, monitoring, and decommissioning of AI systems
87-
used in the following business functions:
88-
- [Function 1, e.g., Customer Service Automation]
89-
- [Function 2, e.g., Credit Risk Scoring]
90-
- [Function 3, e.g., HR Candidate Screening]
91-
92-
Organisational units in scope: [list teams/departments]
93-
Physical locations in scope: [offices, data centres, remote]
94-
95-
Exclusions: [List any AI systems NOT in scope and the reason why]
96-
97-
Approved by: [Name, Title] | Date: [Date] | Version: 1.0
98-
99-
### How to Determine Scope
100-
1. List every AI system in your AI Systems Inventory
101-
2. Decide which systems are high enough risk to include
102-
3. Consider starting with a pilot scope (1-2 AI systems) then expanding
103-
4. Align scope with 4.1 context and 4.2 stakeholder findings
104-
5. Document exclusions with clear justification
105-
6. Get formal approval from top management
106-
107-
### Common Mistakes to Avoid
108-
- Scope too vague — be specific about which AI systems are included
109-
- Scope not approved — needs top management sign-off
110-
- Scope inconsistent with context — should flow logically from 4.1 and 4.2
111-
- Exclusions not justified — auditors will challenge them
112-
113-
### Documents Required
114-
- AIMS Scope Statement (formal document, management approved)
115-
- Scope Exclusion Justification Log
116-
117-
---
118-
119-
## 4.4 — The AI Management System
120-
121-
### What it requires
122-
Establish, implement, maintain, and continually improve an AIMS — including all processes needed to meet the standard's requirements.
123-
124-
### What This Means in Practice
125-
- Every process must have: owner, inputs, outputs, controls, and records
126-
- Processes must be documented at the level needed to ensure consistency
127-
- Processes must connect to each other (risk feeds operations; audits feed improvement)
128-
- The system must be reviewed and improved continuously, not set up once and forgotten
129-
130-
### AIMS High-Level Process Flow
131-
- Clause 4 (Context) feeds into Clause 5 (Leadership) and Clause 6 (Planning)
132-
- Clause 6 (Planning) feeds into Clause 7 (Support) and Clause 8 (Operations)
133-
- Clause 8 (Operations) is evaluated by Clause 9 (Performance Evaluation)
134-
- Clause 9 findings drive Clause 10 (Improvement)
135-
- Clause 10 improvements feed back into all other clauses
136-
137-
### Documents Required
138-
- AIMS Process Map (visual or table showing all processes, owners, and connections)
139-
- Master Document List (all policies, procedures, templates, records)
140-
141-
---
142-
143-
## Clause 4 — Complete Documents Checklist
144-
145-
| # | Document | ISO Ref | Status |
146-
|---|----------|---------|--------|
147-
| 1 | Context of the Organisation Register | 4.1 | To Do |
148-
| 2 | AI Systems Inventory | 4.1 | To Do |
149-
| 3 | PESTLE Analysis Worksheet | 4.1 | To Do |
150-
| 4 | Interested Parties Register | 4.2 | To Do |
151-
| 5 | Legal and Regulatory Requirements Register | 4.2 | To Do |
152-
| 6 | AIMS Scope Statement | 4.3 | To Do |
153-
| 7 | Scope Exclusion Justification Log | 4.3 | If needed |
154-
| 8 | AIMS Process Map | 4.4 | To Do |
155-
| 9 | Master Document List | 4.4 | To Do |
156-
157-
---
158-
159-
## What Auditors Check in Clause 4
160-
- Is the context analysis documented and up to date?
161-
- Are interested parties listed with specific, traceable requirements?
162-
- Is the scope precise — naming actual AI systems and functions?
163-
- Is there a management-approved scope document with a signature and date?
164-
- Does the AIMS cover all in-scope systems and activities?
165-
- Is there evidence the organisation reviews context periodically?
166-
167-
---
168-
169-
*ISO/IEC 42001:2023 AI Governance Toolkit — Clause 4 of 7 | See root README.md for full index*
4+
> **Purpose:** Establish the foundation of your AIMS by understanding your organisation's environment, stakeholders, scope, and processes.
5+
>
6+
> ---
7+
>
8+
> ## 📁 Files in This Folder — Read in This Order
9+
>
10+
> | # | File | What It Is | ISO Ref |
11+
> |---|------|-----------|---------|
12+
> | 1 | [CONTEXT-REGISTER.md](CONTEXT-REGISTER.md) | Internal & external issues register (PESTLE) | 4.1 |
13+
> | 2 | [AI-SYSTEMS-INVENTORY.md](AI-SYSTEMS-INVENTORY.md) | Register of all AI systems in scope | 4.1 |
14+
> | 3 | [INTERESTED-PARTIES-REGISTER.md](INTERESTED-PARTIES-REGISTER.md) | Stakeholder needs & binding requirements | 4.2 |
15+
> | 4 | [AIMS-SCOPE-STATEMENT.md](AIMS-SCOPE-STATEMENT.md) | Formal AIMS scope definition | 4.3 |
16+
> | 5 | [AIMS-PROCESS-MAP.md](AIMS-PROCESS-MAP.md) | All AIMS processes, owners & connections | 4.4 |
17+
>
18+
> > **Start here → CONTEXT-REGISTER.md → AI-SYSTEMS-INVENTORY.md → INTERESTED-PARTIES-REGISTER.md → AIMS-SCOPE-STATEMENT.md → AIMS-PROCESS-MAP.md**
19+
> >
20+
> > ---
21+
> >
22+
> > ## 4.1 — Understanding the Organisation and Its Context
23+
> >
24+
> > ### What it requires
25+
> > Identify all internal and external issues relevant to your purpose that affect your ability to achieve AIMS intended outcomes.
26+
> >
27+
> > ### Internal Issues to Identify
28+
> > | Issue Area | Examples |
29+
> > |-----------|----------|
30+
> > | AI Strategy | Business goals for AI, board-level AI ambitions |
31+
> > | Existing AI Systems | Current AI tools, models, products in use |
32+
> > | Governance | Policies, ethics committees, decision-making structures |
33+
> > | People and Culture | AI literacy, risk appetite, accountability culture |
34+
> > | Technical Capability | Data quality, infrastructure, MLOps maturity |
35+
> > | Ethics and Values | Fairness commitments, transparency policies |
36+
> >
37+
> > ### External Issues to Identify
38+
> > | Issue Area | Examples |
39+
> > |-----------|----------|
40+
> > | Regulation | EU AI Act, GDPR, sector-specific AI rules |
41+
> > | Standards | ISO 42001, ISO 27001, NIST AI RMF |
42+
> > | Market | Customer AI expectations, competitor practices |
43+
> > | Technology | Vendor dependencies, open-source risks |
44+
> > | Society | Public trust in AI, bias concerns, media scrutiny |
45+
> >
46+
> > ### Implementation Steps
47+
> > 1. Run a PESTLE analysis focused on AI — document each factor
48+
> > 2. 2. Conduct an internal AI capability review — systems, people, processes
49+
> > 3. 3. Populate the **Context Register** (template: `CONTEXT-REGISTER.md`)
50+
> > 4. 4. Get sign-off from senior management
51+
> > 5. 5. Schedule annual review and trigger-based updates
52+
> >
53+
> > 6. ### Documents Required
54+
> > 7. - Context of the Organisation Register (internal + external issues, rated by relevance)
55+
> > - - AI Systems Inventory (all AI systems: name, purpose, owner, risk level, status)
56+
> > - - PESTLE Analysis Worksheet
57+
> >
58+
> > - ---
59+
> >
60+
> > ## 4.2 — Understanding Needs and Expectations of Interested Parties
61+
> >
62+
> > ### What it requires
63+
> > Identify who has a stake in your AI systems, what they need, and which of those needs become binding requirements for your AIMS.
64+
> >
65+
> > ### Interested Parties Register Template
66+
> > | Stakeholder | What They Need | Binding? | How Addressed |
67+
> > |-------------|---------------|----------|---------------|
68+
> > | Employees | Safe AI tools, transparency, no unjust automation | Yes — labour law | AI use policy, training |
69+
> > | Customers / End Users | Fair decisions, explainability, data privacy | Yes — GDPR, contract | Privacy notices, explanations |
70+
> > | Regulators | Compliance with AI laws, audit trails | Yes — legal | Compliance controls, records |
71+
> > | AI Vendors / Suppliers | Clear requirements, IP protection | Yes — contract | Supplier agreements |
72+
> > | Investors / Board | Risk management, reputational protection | Yes — fiduciary | AIMS reports, board updates |
73+
> > | General Public / Society | Non-discriminatory AI, societal benefit | Ethical | Ethics framework, bias testing |
74+
> > | Certification Body | Conformity with ISO 42001 | Yes — certification | Full AIMS implementation |
75+
> >
76+
> > ### Implementation Steps
77+
> > 1. Brainstorm all stakeholder groups using the table above as a starting point
78+
> > 2. 2. For each group, document: who they are, what they need, legal or contractual basis
79+
> > 3. 3. Classify requirements as mandatory or best practice
80+
> > 4. 4. Feed mandatory requirements into your AIMS controls and policies
81+
> > 5. 5. Review when stakeholder landscape changes
82+
> >
83+
> > 6. ### Documents Required
84+
> > 7. - Interested Parties Register
85+
> > - - Legal and Regulatory Requirements Register
86+
> >
87+
> > - ---
88+
> >
89+
> > ## 4.3 — Determining the Scope of the AIMS
90+
> >
91+
> > ### What it requires
92+
> > Define the exact boundaries of your AI Management System — what AI systems, organisational units, functions, and activities are included.
93+
> >
94+
> > ### Scope Statement Template
95+
> > ```
96+
> > AIMS Scope Statement — [Organisation Name]
97+
> >
98+
> > [Organisation Name] operates an AI Management System in accordance with ISO/IEC 42001:2023,
99+
> > covering the design, development, deployment, monitoring, and decommissioning of AI systems
100+
> > used in the following business functions:
101+
> > - [Function 1, e.g., Customer Service Automation]
102+
> > - [Function 2, e.g., Credit Risk Scoring]
103+
> > - [Function 3, e.g., HR Candidate Screening]
104+
> >
105+
> > Organisational units in scope: [list teams/departments]
106+
> > Physical locations in scope: [offices, data centres, remote]
107+
> > Exclusions: [List any AI systems NOT in scope and the reason why]
108+
> >
109+
> > Approved by: [Name, Title] | Date: [Date] | Version: 1.0
110+
> > ```
111+
> >
112+
> > ### How to Determine Scope
113+
> > 1. List every AI system in your AI Systems Inventory
114+
> > 2. 2. Decide which systems are high enough risk to include
115+
> > 3. 3. Consider starting with a pilot scope (1–2 AI systems) then expanding
116+
> > 4. 4. Align scope with 4.1 context and 4.2 stakeholder findings
117+
> > 5. 5. Document exclusions with clear justification
118+
> > 6. 6. Get formal approval from top management
119+
> >
120+
> > 7. ### Common Mistakes to Avoid
121+
> > 8. - Scope too vague — be specific about which AI systems are included
122+
> > - - Scope not approved — needs top management sign-off
123+
> > - - Scope inconsistent with context — should flow logically from 4.1 and 4.2
124+
> > - - Exclusions not justified — auditors will challenge them
125+
> >
126+
> > - ### Documents Required
127+
> > - - AIMS Scope Statement (formal document, management approved)
128+
> > - - Scope Exclusion Justification Log
129+
> >
130+
> > - ---
131+
> >
132+
> > ## 4.4 — The AI Management System
133+
> >
134+
> > ### What it requires
135+
> > Establish, implement, maintain, and continually improve an AIMS — including all processes needed to meet the standard's requirements.
136+
> >
137+
> > ### What This Means in Practice
138+
> > - Every process must have: owner, inputs, outputs, controls, and records
139+
> > - - Processes must be documented at the level needed to ensure consistency
140+
> > - - Processes must connect to each other (risk feeds operations; audits feed improvement)
141+
> > - - The system must be reviewed and improved continuously, not set up once and forgotten
142+
> >
143+
> > - ### AIMS High-Level Process Flow
144+
> > - ```
145+
> > Clause 4 (Context) ──► Clause 5 (Leadership) ──► Clause 6 (Planning)
146+
> > │
147+
> > ▼
148+
> > Clause 10 (Improvement) ◄── Clause 9 (Performance) ◄── Clause 7 (Support)
149+
> > │
150+
> > ▼
151+
> > Clause 8 (Operations)
152+
> > ```
153+
> >
154+
> > ### Documents Required
155+
> > - AIMS Process Map (visual or table showing all processes, owners, and connections)
156+
> > - - Master Document List (all policies, procedures, templates, records)
157+
> >
158+
> > - ---
159+
> >
160+
> > ## Clause 4 — Complete Documents Checklist
161+
> >
162+
> > | # | Document | ISO Ref | File |
163+
> > |---|----------|---------|------|
164+
> > | 1 | Context of the Organisation Register | 4.1 | [CONTEXT-REGISTER.md](CONTEXT-REGISTER.md) |
165+
> > | 2 | AI Systems Inventory | 4.1 | [AI-SYSTEMS-INVENTORY.md](AI-SYSTEMS-INVENTORY.md) |
166+
> > | 3 | PESTLE Analysis Worksheet | 4.1 | Embedded in CONTEXT-REGISTER.md |
167+
> > | 4 | Interested Parties Register | 4.2 | [INTERESTED-PARTIES-REGISTER.md](INTERESTED-PARTIES-REGISTER.md) |
168+
> > | 5 | Legal and Regulatory Requirements Register | 4.2 | Embedded in INTERESTED-PARTIES-REGISTER.md |
169+
> > | 6 | AIMS Scope Statement | 4.3 | [AIMS-SCOPE-STATEMENT.md](AIMS-SCOPE-STATEMENT.md) |
170+
> > | 7 | Scope Exclusion Justification Log | 4.3 | Embedded in AIMS-SCOPE-STATEMENT.md |
171+
> > | 8 | AIMS Process Map | 4.4 | [AIMS-PROCESS-MAP.md](AIMS-PROCESS-MAP.md) |
172+
> > | 9 | Master Document List | 4.4 | See `06-CLAUSE7-SUPPORT/MASTER-DOCUMENT-LIST.md` |
173+
> >
174+
> > ---
175+
> >
176+
> > ## What Auditors Check in Clause 4
177+
> > - Is the context analysis documented and up to date?
178+
> > - - Are interested parties listed with specific, traceable requirements?
179+
> > - - Is the scope precise — naming actual AI systems and functions?
180+
> > - - Is there a management-approved scope document with a signature and date?
181+
> > - - Does the AIMS cover all in-scope systems and activities?
182+
> > - - Is there evidence the organisation reviews context periodically?
183+
> >
184+
> > - ---
185+
> >
186+
> > *ISO/IEC 42001:2023 AI Governance Toolkit | Clause 4 of 10 | See root [README.md](../README.md) for full index*

0 commit comments

Comments
 (0)