ISO/IEC 42001 — Implement an AI management system (Lead Implementer)
Design, implement and sustain an AI management system according to the ISO/IEC 42001 standard, and prepare for the certification exam.
- Duration
- 38 h · 5.5 days
- Level
- Advanced
- Format
- On site · Remote · Blended
- Max. group size
- 12 participants
Overview
The ISO/IEC 42001 standard defines the requirements of an artificial intelligence management system (AIMS): governance, risk management, impact assessment, control of the AI system lifecycle and continual improvement. This five-day program, followed by a three-hour exam, guides professionals through implementing an AIMS: context and scope, leadership, planning, resources, operation, Annex A controls, performance evaluation and improvement. It relies on practical cases and ends with exam preparation. It also provides a solid foundation for demonstrating control of AI risks in the context of the AI Act.
Who this program is for
- Compliance, risk and security managers (CISOs)
- DPOs, internal auditors and consultants
- Compliance project managers, IT and legal teams in charge of AI
Prerequisites
- No strict technical prerequisites
- Prior experience in security, quality or compliance management is a plus
- Basic knowledge of a management system standard (ISO 27001, ISO 9001) is appreciated
Learning objectives
- Understand the requirements of the ISO/IEC 42001 standard and its vocabulary
- Define the context, scope and policy of an AI management system
- Conduct risk assessment and impact assessment of AI systems
- Select and implement the Annex A controls
- Organize documentation, awareness and operational control
- Prepare the internal audit, the management review and continual improvement
- Prepare for the certification exam
Detailed curriculum
11 modules · 38 h · 5.5 days
Introduction to AI and the ISO/IEC 42001 standard
- Reminders on AI, risks and trust issues
- Management standards: common structure, vocabulary, process approach
- Presentation of ISO/IEC 42001 and related standards
- Relationship with the AI Act, GDPR and ISO/IEC 27001
- Implementation approach and the role of the Lead Implementer
Context, interested parties and scope (clause 4)
- Analysis of the internal and external context
- Interested parties and their expectations
- The organization's role regarding AI: developer, provider, user
- Defining the scope of the management system
- Project scoping and initial gap analysis
Define the scope of the running case and carry out a first gap analysis.
Leadership and AI policy (clause 5)
- Management commitment
- AI policy: content and communication
- Responsible AI principles and trust objectives
- Roles, responsibilities and authorities
- Project organization and sponsorship
Write the AI policy for the running case and define the governance.
Planning: risks, impacts and objectives (clause 6)
- Risks and opportunities of the management system
- Assessment and treatment of AI-related risks
- Impact assessment of AI systems on individuals and society
- AI objectives and action planning
- Change management
Apply the risk assessment and impact assessment method to an AI system of the running case.
Support: resources, competence and documentation (clause 7)
- Human, technical and financial resources
- Competence, awareness and training
- Internal and external communication
- Documented information: creation, control, retention
- Documentation plan
Build the project's documentation and awareness plan.
Operation: lifecycle control (clause 8)
- Operational planning and control
- Lifecycle of an AI system: design, development, deployment, retirement
- Data and quality management
- Relationships with suppliers and third parties
- Incident and change management
Annex A controls
- AI-related policies and internal organization
- Resources, impact assessment and lifecycle
- Data, information for interested parties and use of systems
- Relationships with third parties and customers
- Selecting controls and justifying exclusions
Select the Annex A controls for the running case and justify the choices.
Performance evaluation (clause 9)
- Monitoring, measurement, analysis and evaluation
- Performance indicators of the management system
- Internal audit: principles, planning and conduct
- Management review: inputs and outputs
- Preparing for a certification audit
Prepare the internal audit program for the running case.
Continual improvement and project closure (clause 10)
- Nonconformities and corrective actions
- Continual improvement
- Maintaining compliance over time
- Preparing for the organization's certification
Implementation plan and exam preparation
- Summary of the implementation approach
- Building the complete project plan
- Mock exam and annotated correction
- Exam method and tips
Assemble the running-case deliverables into an AIMS implementation plan.
Take a mock exam under real conditions, then correct it as a group.
Certification exam
- 3-hour exam, proctored online or at a test center
- Available in French or English
- Certificate issued a few weeks after passing
Tools and technologies
Certifications
PECB certification attesting the ability to implement an AI management system according to ISO/IEC 42001. The Lead Implementer level requires professional experience (five years, two of them in AI) and AIMS project hours.
Teaching methods
- Alternating lectures and practical cases on a running case of a fictional organization
- Risk and gap analysis workshops
- Interactive quizzes at the end of each day
- Annotated mock exam
Assessment
- Daily quizzes
- Mock exam at the end of the course
- 3-hour certification exam, proctored online or at a test center, in French or English
Required equipment
- A room with a projector, or a connection to a virtual classroom
- One computer per participant
- Access to the ISO/IEC 42001 standard
Resources provided
- Complete course materials and running case
- Templates: AI policy, risk register, statement of applicability, internal audit plan
- Practice questions and mock exam
Career outcomes
- Implementation plan for an AIMS tailored to the organization
- Statement of applicability and initial risk register
- Preparation for the Lead Implementer certification exam