Actions to Address Risks and Opportunities Explained for ISO 42001
ISO 42001 Clause 6.1
This clause is the heart of the standard. The risk assessment, the risk treatment, the Statement of Applicability and the impact assessment all live here.
ISO 42001 Clause 6.1 - Actions to Address Risks and Opportunities Explained
Clause 6.1 is the longest and most demanding clause in ISO 42001. It is divided into four sub-clauses that together establish the organisation's approach to AI risk and the controls put in place to address it. The sub-clauses are tightly linked and are covered together in this article because the documented evidence for one feeds into the next.
ISO 42001 Clause 6.1.1 - General
The general sub-clause establishes the requirement to plan for the AI management system by considering the issues from Clause 4.1 and the requirements from Clause 4.2, and determining the risks and opportunities that need to be addressed. The aim is to give assurance that the management system can achieve its intended results, prevent or reduce undesired effects, and achieve continual improvement.
The organisation must establish AI risk criteria. These are the criteria used to distinguish acceptable from non-acceptable risks, perform AI risk assessments, conduct AI risk treatment, and assess AI risk impacts. The criteria are typically expressed through a risk rating matrix that combines likelihood and consequence ratings to produce an overall risk level, with thresholds for acceptable, requires-treatment and unacceptable risk.
Risks and opportunities must be determined according to the domain and application context of each AI system, the intended use of the AI system, and the external and internal context described at Clause 4.1. The organisation must plan actions to address these risks and opportunities, integrate those actions into the management system processes, and evaluate the effectiveness of the actions taken. Documented information must be retained on actions taken to identify and address AI risks and opportunities.
ISO 42001 Clause 6.1.2 - AI risk assessment
The AI risk assessment process must be defined and established. The standard sets out detailed requirements for what the process must achieve. The process must be informed by and aligned with the AI policy and AI objectives. It must be designed so that repeated risk assessments produce consistent, valid and comparable results. It must identify risks that aid or prevent the achievement of AI objectives. It must analyse risks by assessing the potential consequences to the organisation, individuals and societies, by assessing where applicable the realistic likelihood of risks, and by determining the levels of risk. It must evaluate risks by comparing the results against the risk criteria and prioritising assessed risks for treatment.
Documented information about the AI risk assessment process and the results of risk assessments must be retained. In practice this is most efficiently delivered through a structured AI risk register that captures the AI system, the risks identified, the consequence and likelihood ratings, the resulting risk level, and the controls in place or proposed.
The AI risk assessment is distinct from the AI system impact assessment in Clause 6.1.4. The risk assessment looks at risks to the organisation's AI objectives and to the individuals and societies affected. The impact assessment is a more focused exercise on the consequences of an AI system's deployment, intended use and foreseeable misuse. Both feed each other, but they are separate processes with separate documented evidence.
ISO 42001 Clause 6.1.3 - AI risk treatment
The AI risk treatment process must be defined and must select appropriate treatment options for the assessed risks. It must determine all controls necessary to implement the chosen treatment options and compare those controls against Annex A to verify that no necessary controls have been omitted. Controls from Annex A that are relevant must be considered. Additional controls beyond those in Annex A may be needed and may be designed by the organisation or drawn from other sources. The implementation guidance in Annex B must be considered for the chosen controls.
The output of the risk treatment process is the Statement of Applicability, which is a defining concept of ISO 42001 shared with ISO 27001. The Statement of Applicability documents the necessary controls and provides justification for the inclusion or exclusion of each Annex A control. Justification for exclusion can be that a control is not deemed necessary by the risk assessment or that it is not required by, or is subject to exceptions under, applicable external requirements.
The risk treatment process must produce an AI risk treatment plan, which sets out how the chosen controls will be implemented. The risk treatment plan and the acceptance of residual risks must be approved by the designated management. The necessary controls must be aligned to the AI objectives at Clause 6.2, available as documented information, communicated within the organisation, and available to interested parties as appropriate.
ISO 42001 Clause 6.1.4 - AI system impact assessment
The AI system impact assessment is the most distinctive AI-specific concept in the standard. The organisation must define a process for assessing the potential consequences for individuals or groups of individuals and societies that can result from the development, provision or use of AI systems.
The impact assessment must determine the potential consequences an AI system's deployment, intended use and foreseeable misuse has on individuals, groups and societies. It must take into account the specific technical and societal context where the AI system is deployed and the applicable jurisdictions. The result must be documented and, where appropriate, made available to relevant interested parties. The result must also be considered in the risk assessment under Clause 6.1.2.
The implementation guidance in Annex B.5 sets out the elements that the impact assessment process should cover. The circumstances under which an impact assessment should be performed include the criticality of the intended purpose and context, the complexity of the AI technology and the level of automation, and the sensitivity of the data types and sources processed. The elements of the assessment process include identification of sources, events and outcomes, analysis of consequences and likelihood, evaluation against acceptance criteria, treatment through mitigation measures, and documentation, reporting and communication.
For organisations processing personal data through AI systems, the AI system impact assessment can sit alongside or feed into existing data protection impact assessments. Where the same AI system raises both privacy and broader societal concerns, an integrated assessment is more efficient and more useful than separate parallel exercises.
How the four sub-clauses work together
The flow through Clause 6.1 is sequential and iterative. The general sub-clause sets the context and the risk criteria. The risk assessment identifies and rates the risks. The risk treatment selects controls to address the risks and produces the Statement of Applicability. The impact assessment looks specifically at the consequences for individuals and societies and feeds back into the risk assessment. The Statement of Applicability and the risk treatment plan are the documented outputs that drive the operational controls in Clause 8 and the controls in Annex A.
The Statement of Applicability is the document that ties everything together for ISO 42001, just as it does for ISO 27001. It lists every Annex A control, records whether it applies, gives the justification for inclusion or exclusion, and references the risk assessment evidence. An auditor will use the Statement of Applicability to test the consistency of the management system. If a control is included but not implemented, that is a finding. If a control is excluded but the risk assessment identified the risk it would address, that is a finding too.
The impact assessment is where many organisations find their existing risk processes do not quite fit. Risk assessment is usually about consequences to the organisation. The impact assessment is about consequences to individuals and societies, including consequences the organisation might benefit from but the affected individuals would not. That perspective shift is what the standard is asking for.
When auditing Clause 6.1, I trace the chain of evidence. I start at the AI Process Register and confirm each in-scope AI system has been risk assessed. I check the risk assessment is consistent with the documented criteria and produces ratings I can defend. I move to the Statement of Applicability and confirm each included control is supported by a risk and each excluded control is properly justified. I check the impact assessments for high-impact AI systems and confirm they consider the affected individuals and groups, not just the organisation.
The most common finding at Clause 6.1 is inconsistency between documents. The risk register identifies a risk that is not addressed in the Statement of Applicability. The Statement of Applicability includes a control that is not visible in operation. The impact assessment names affected individuals who do not appear in the interested parties register. Maintaining consistency across these documents is the discipline the management system is asking for.
We did the impact assessment first when we extended our system to cover the inspection AI. It forced us to think about the consequences for line operators if the AI got it wrong, and for customers if a defective unit got past the AI. That fed straight into the risk assessment, and the risk assessment fed straight into the Statement of Applicability. Doing it in that order made the whole thing line up.
Practical Compliance Guidance
The F-Q113 AI Impact Assessment establishes the integrated approach to identifying and addressing risks and opportunities across the management system. The AI-specific risk assessment, risk treatment are evidenced through the dedicated AI registers and assessments listed below.
Risks and opportunities can be formally listed on the F-IMS23 Opportunities and Risks Register.
The following alphaZ documents support compliance with ISO 42001 Clause 6.1.
| alphaZ document | How to use it |
|---|---|
| ISO 42001 AI Management System Toolkit | The full toolkit containing the AI management system documentation including the AI risk assessment, Statement of Applicability and AI system impact assessment templates. |
| F-IMS23 Opportunities and Risks Register | Records the risks and opportunities identified at the management system level, supporting compliance with the general requirements of Clause 6.1.1. |
| RA-AI Risk Assessment | The dedicated AI risk assessment document recording AI-specific risks, consequence and likelihood ratings, controls and treatment plans for each AI system. |
| F-IMS70 Annex A Controls | Records the Statement of Applicability with the inclusion or exclusion decision and justification for each Annex A control. |
| F-Q113 AI System Impact Assessment | The dedicated AI system impact assessment template for identifying and evaluating the potential consequences for individuals and societies. |
| F-IMS40 AI Process Register | Records the AI systems within scope, providing the inventory against which risk assessment and impact assessment are performed. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
UK Legislation
The following UK legislation is directly relevant to AI risk and impact assessment. Organisations outside the UK should identify the equivalent legislation applicable in their jurisdiction. Organisations selling AI products or services into the European Union should also consider the EU AI Act.
