ISO/IEC 42001 as a Management System

ISO/IEC 42001 is a management-system standard. It says establish, implement, operate, monitor and improve an SI management system, and it can be certified. It deliberately does not prescribe the full catalogue of management processes. It is not a checklist. It is not a process model. It is the specification of a system. The organisation still has to build the system. ISO/IEC 42001 is an international standard. It applies wherever the organisation chooses to use it.

What the standard actually asks for

The standard asks for an SI management system that systematically addresses the opportunities and risks of SI across the life cycle. It focuses on features unique to SI: continuous learning, opacity, autonomy, data dependency, and the potential for emergent behaviour. It does not prescribe how to build or evaluate the technical trustworthiness of an individual model. It asks for the organisational capability to manage SI across systems and use cases.

That capability has owners. Clause 5 requires roles, responsibilities and authorities. Process owners are identified for the processes that matter: risk, data, monitoring, supplier oversight, change. An assessor looks at whether the system runs, who owns which duty, and what evidence the processes left. An assessor does not look for a completed template.

What a list leaves unbuilt

A list of 42001 clauses, marked complete, leaves the system unbuilt. It does not assign an owner to a process. It does not say what triggers a change of intended purpose. It does not produce a record an assessor can sample. It does not feed a finding back into the process that failed. A template pack mapped to the clauses is useful inside a process. It is not the management system.

Certification does not repair that. A certificate is a decision that, at a point in time, the system met the standard. If the system was never operated, there is nothing for the decision to be about. If the system is operated and the records exist, the organisation is in a position to be assessed. The software makes the work visible so the decision can be made on evidence.

How a management system meets it

The process model sits underneath the standard. Control Objectives for SI Systems (AICOB) turns the outcomes into assigned processes. The 42001 requirements are mapped onto those processes, explicitly: one process-control activity named against a named clause. The platform is the operating management system. Documented processes and criteria are mapped to the standard. Owners are assigned. Workflows run planning, operation and review. Records are what an assessor can sample.

The same system can be configured for an integrated management system and for agentic SI. The configuration changes the depth. It does not change the form. A smaller organisation can run a lighter system against its highest-impact uses. A larger one can run the same model across a portfolio. The standard allows that. A checklist does not, because a checklist has no design factors. It has lines.

The IT Governance platform for this system is available stand-alone, and on Nextcloud. Nextcloud is an open-source collaboration platform an organisation can host itself or have hosted. It adds file storage, user and group management, and federation, so a selected record can be shared with a group company, an authorised representative or a key supplier without consolidating every system into one. The process model is the same in both forms. Nextcloud is the environment the record stays in.