Plan Before You Deploy: ISO 42001 Clause 6 and the Risk Thinking Behind Self-Policing AI

An organization that polices its own AI has to anticipate what could go wrong before it does. Clause 6 turns that foresight into a repeatable planning process.

So far in this series, we have covered Clause 4, where an organization maps its context and stakeholders, and Clause 5, where top management takes ownership through an AI policy and clear roles. Clause 6, Planning, is where that understanding and leadership become concrete action.

Clause 6 of ISO/IEC 42001 requires organizations to address risks and opportunities, assess AI risks and the impacts of AI systems, decide how to treat those risks, set measurable AI objectives, and plan changes to the management system in a controlled way. For any organization serious about self-policing, this is the heart of the standard.

Why Self-Policing Depends on Planning

Self-policing is not just about reacting to problems. It is about seeing them coming. AI systems can fail in ways traditional software does not: models drift, training data carries hidden bias, outputs can be misused, and decisions can affect people who never agreed to be part of the process. An organization that waits for complaints or regulatory findings to reveal these issues is not policing itself; it is being policed by others.

Clause 6 gives organizations a structured way to identify those risks early, decide what to do about them, and document the reasoning. That record is what allows an organization to show, to itself and to others, that its AI decisions were deliberate.

6.1 Actions to Address Risks and Opportunities

Building on the issues and interested-party requirements identified in Clause 4, the organization must determine the risks and opportunities that need to be addressed so the AIMS can achieve its intended results, prevent or reduce undesired effects, and achieve continual improvement. It must also establish AI risk criteria that distinguish acceptable from non-acceptable risks. Clause 6.1 then sets out three specialized processes.

• AI risk assessment (6.1.2): a defined, repeatable process to identify, analyze, and evaluate AI risks, considering both the likelihood of events and their potential consequences for the organization, individuals, and society.
• AI risk treatment (6.1.3): choosing appropriate treatment options, determining the necessary controls, and comparing them against the controls in Annex A to make sure nothing important has been overlooked. The result is documented in a Statement of Applicability that explains which controls are included or excluded and why.
• AI system impact assessment (6.1.4): a process to assess the potential consequences an AI system’s development, provision, or use could have on individuals, groups of individuals, and societies. The results feed back into the risk assessment.

The impact assessment is one of the features that sets ISO/IEC 42001 apart from other management system standards. It asks the organization to look beyond its own business risk and consider the people on the receiving end of its AI. For self-policing, that outward-looking perspective is essential.

6.2 AI Objectives and Planning to Achieve Them

The organization must set AI objectives at relevant functions and levels. Those objectives must be consistent with the AI policy, measurable where practicable, monitored, communicated, and updated as needed. For each objective, the organization must plan what will be done, what resources are required, who is responsible, when it will be completed, and how results will be evaluated.

Well-written objectives turn broad commitments into targets that can be checked. “Be fair” is a principle. “Complete a bias evaluation for every customer-facing model before release” is an objective. The more specific the objective, the easier it is for the organization to hold itself accountable.

6.3 Planning of Changes

When the organization decides changes to the AIMS are needed, those changes must be carried out in a planned manner. AI environments change quickly, with new models, new vendors, new regulations, and new use cases. Planned change management helps ensure that governance keeps pace without creating gaps or breaking existing controls.

Putting Clause 6 to Work: Practical Steps

1. Define your risk criteria first. Agree on what counts as acceptable and unacceptable risk before assessing individual systems, so decisions are consistent.
2. Use a common risk method. Apply the same assessment approach across AI systems so results can be compared and prioritized. ISO/IEC 23894 offers helpful guidance on AI risk management.
3. Make impact assessments routine. Build AI system impact assessments into project intake and change processes, not just initial deployment.
4. Work through Annex A carefully. Treat the Statement of Applicability as a thoughtful record of decisions, with a clear reason for every control included or excluded.
5. Write SMART AI objectives. Make objectives specific, measurable, achievable, relevant, and time-bound, and assign an owner to each.
6. Revisit assessments on a schedule. Update risk and impact assessments when systems, data, laws, or intended uses change.

Common Pitfalls to Avoid

• Copying a generic risk register. Template risks that do not reflect your actual AI systems give a false sense of security.
• Focusing only on business risk. Ignoring impacts on individuals and society misses the purpose of the impact assessment.
• Treating the Statement of Applicability as a checklist. Excluding controls without solid justification weakens the entire risk treatment process.
• Vague objectives. Objectives that cannot be measured cannot be monitored, and what cannot be monitored cannot be policed.

The Bottom Line

Clause 6 is where self-policing becomes proactive. By assessing AI risks and impacts, choosing controls deliberately, and setting objectives that can be measured, an organization builds a governance program that looks ahead rather than behind. In the next post, we will look at Clause 7, Support, and the people, resources, and documentation needed to put these plans into action. For further information email us at pjr@pjr.com or for a quote for ISO 42001 certification Click Here.