AI management system (AIMS)
Definition
The set of interrelated policies, objectives, processes and controls an organization uses to govern the responsible development, provision or use of AI systems, as defined in ISO/IEC 42001.
An AI management system (AIMS) is AI governance made repeatable. Instead of reviewing each system ad hoc, the organization defines its scope, assigns roles, sets an AI policy and measurable objectives, and runs a plan-do-check-act cycle: it identifies risks and impacts, applies controls, monitors performance, conducts internal audits and management reviews, and corrects nonconformities.
An AIMS normally sits alongside existing management systems for information security (ISO/IEC 27001) and privacy (ISO/IEC 27701), sharing processes such as document control, competence, supplier management and incident handling. Its distinctive elements are the AI system inventory, AI risk and impact assessments, lifecycle controls from design to retirement, and transparency toward users and affected people. For example, a fintech running an AIMS would keep a register of every model in use, an owner for each, assessment records and a schedule of reviews, and would be able to show an auditor how a newly proposed chatbot moved from request to approved deployment.
Where this term is assessed
Assessed in the Responsible AI Leader (RAIL), domain 2: ISO/IEC 42001 AI management system.
Also covered in: Responsible AI Auditor (AUDAI)
Primary sources
- ISO/IEC 42001:2023