Lion Cipher Lab

Build an ISO/IEC 42001 AI management system (AIMS) and measure it

• GRC / Compliance
• Advanced
• ~110 min
• Free · no account required

Why it matters

There are three different things people mean when they say 'AI governance', and mixing them up is why so many programmes produce paper nobody trusts. The NIST AI Risk Management Framework is a voluntary framework: a way of thinking, adopt as much as you like, nobody audits you. The EU AI Act is law: it applies whether you like it or not, and for high-risk systems it comes with a conformity assessment. ISO/IEC 42001:2023 is the third thing and the one almost nobody can describe — a management system standard, published in 2023, in the same family shape as ISO/IEC 27001 for information…

What you'll learn

• what a management system standard (MSS) is, and why ISO/IEC 42001 is a different animal from a voluntary framework or a law
• writing an AIMS scope statement and an interested-parties register (clause 4)
• the AI role determination (provider / producer / user / partner) and how the role decides which Annex A controls can even apply
• drafting an AI policy, a RACI and the leadership evidence an auditor will ask for (clause 5)
• the distinction that trips everyone: the AI risk assessment (risk TO the organisation) vs the AI system impact assessment (impact ON individuals and society), with both produced for both systems (clause 6)
• building a real Statement of Applicability across all nine Annex A objectives, with a written justification for every include AND every exclude
• third-party and supplier control when the model is someone else's (clauses 7-8)
• setting AI objectives with metrics that would actually FAIL if the programme decayed, plus an internal audit programme and management review inputs/outputs (clause 9)
• nonconformity, correction vs corrective action, and continual improvement (clause 10)
• measuring your own SoA with a script: coverage %, per-objective coverage, and machine-detected certification theatre

Steps in this lab

1. What ISO/IEC 42001 actually is — and the four words you need first
2. Open a terminal and make a working folder (zero-assumption setup)
3. Clause 4 — context, scope, interested parties, and the AI role determination
4. Clause 5 — leadership, the AI policy, and who is actually accountable
5. Clause 6, part one — the AI RISK assessment (what could go wrong for US)
6. Clause 6, part two — the AI SYSTEM IMPACT assessment (what it does to PEOPLE)
7. Annex A and Annex B — selecting controls and writing the Statement of Applicability
8. Clauses 7 and 8 — support, operation, and controlling a supplier's model
9. Clause 9 — objectives, metrics that would actually fail, internal audit, management review
10. Clause 10 — nonconformity, correction vs corrective action, improvement
11. Write the measuring script — turn the SoA into a number
12. Run it — the real first-pass report (79.2%, six findings)
13. Clause 10 for real — close the findings, and watch the number go DOWN
14. The crosswalk — 42001 vs NIST AI RMF vs the EU AI Act vs 23894 vs 27001
15. When certification is worth the money — and when it is theatre
16. How a pro does it differently
17. Clean up, and what to take away

Open the full interactive lab →