ISO 42001 AI Management Advisor
Build and certify an AI Management System (AIMS) under ISO/IEC 42001:2023 — AI policy, Annex A controls, AI risk and impact assessments, Statement of Applicability, and lifecycle governance.
ISO 42001 is the first certifiable standard for managing AI responsibly — and customers, regulators, and boards are starting to ask for it. But "AI governance" is vague until you map it to the AIMS clauses, Annex A controls, and an AI impact assessment.
Who it's for: AI governance and risk leads, organizations pursuing ISO 42001 certification, teams operationalizing responsible AI, compliance officers aligning AI controls to a standard, product teams managing the AI lifecycle
Example
"Run an ISO 42001 gap assessment and draft our AI policy and Statement of Applicability" → A clause-and-Annex-A gap report, an AI policy, an AI risk and impact assessment, and an SoA for AI systems
CLAUDE.md Template
New here? 3-minute setup guide → | Already set up? Copy the template below.
# ISO 42001 AI Management System (AIMS) Skill
You are an expert ISO/IEC 42001:2023 Lead Auditor and AIMS implementation consultant. You assist organisations — whether AI providers, AI users, or both — with implementing, auditing, and certifying an AI Management System (AIMS) under ISO/IEC 42001:2023.
## How to Respond
Always clarify the organisation's role if not stated — **AI provider** (develops/deploys AI), **AI user** (integrates third-party AI), or **both** — as this determines which controls and processes apply most directly.
Match your output to the task type:
| Task | Output Format |Get new playbooks like this one
One email a week with new Claude Code workflows. Free, like everything here.
No spam. Unsubscribe anytime.
What This Does
Turns Claude Code into an ISO/IEC 42001:2023 AI Management System (AIMS) advisor. It runs gap assessments, drafts AI policy, applies Annex A controls for AI, performs AI risk assessments and AI system impact assessments, builds the Statement of Applicability for AI systems, guides AI lifecycle management and incident management, addresses AI transparency and bias, and produces certification-readiness materials.
The Problem
Everyone wants "responsible AI," but ISO 42001 is what makes it auditable: an AI policy, an AI impact assessment, Annex A controls, and a management system that governs the AI lifecycle. Teams struggle to translate principles into the specific AIMS clauses and controls a certification body expects — and to connect ISO 42001 with the EU AI Act and NIST AI RMF work they may already be doing.
Quick Start
Step 1: Create Your Workspace
mkdir -p ~/Documents/ISO-42001
Step 2: Download the Template
mv ~/Downloads/CLAUDE.md ~/Documents/ISO-42001/
Step 3: Add Context (Optional)
Describe your AI systems, their purpose and data, and any existing governance documentation.
Step 4: Run Claude Code
cd ~/Documents/ISO-42001
claude
Step 5: Start
Say: "Run an ISO 42001 gap assessment and draft our AI policy."
Example Commands
"Run an ISO 42001 gap assessment against the AIMS clauses"
"Draft an AI policy and governance structure"
"Which Annex A controls does ISO 42001 require for our AI systems?"
"Perform an AI risk assessment and AI system impact assessment"
"Build a Statement of Applicability for our AI systems"
"Design AI incident management and lifecycle controls"
"How do we address AI transparency and bias under 42001?"
"Map ISO 42001 to the EU AI Act and NIST AI RMF"
What You Get
| Output | Contents |
|---|---|
| Gap Assessment | AIMS clause and Annex A findings |
| AI Policy | Governance, roles, and responsible-AI commitments |
| Risk & Impact Assessment | AI-specific risk and impact methodology |
| Statement of Applicability | AI controls and justification |
| Certification Plan | Readiness checklist |
Tips
- Anchor on the AI impact assessment — it's the heart of an AIMS.
- Reuse EU AI Act / NIST AI RMF work — controls overlap substantially.
- Govern the whole lifecycle — data, development, deployment, and monitoring.
Important Disclaimer
This is a compliance support tool, not a certification audit. Certification requires an accredited body. Have qualified governance and audit professionals review outputs before relying on them.