In the previous post in this series, we looked at Clause 4, Context of the Organisation, and how understanding the organisation’s context, interested parties and role in the AI ecosystem helps establish the foundations for responsible AI. Understanding that context is only the first step. It must inform decisions, controls and oversight, and ISO/IEC 42001 places clear leadership responsibilities on top management.

Clause 5, Leadership, sets out what top management must do to establish, implement and maintain an Artificial Intelligence Management System (AIMS). It addresses leadership and commitment, the AI policy, and the assignment of roles, responsibilities and authorities. Together, these requirements establish accountability for how AI is governed, including who is responsible for oversight when an AI system produces an unexpected or harmful outcome.

Why Visible Leadership Matters for AI Governance

Internal oversight is effective only when it is supported by leadership and embedded in business decisions. If AI governance is treated solely as a compliance-team responsibility, it may be bypassed when deadlines, commercial priorities or operational pressures arise. When senior leaders set expectations, provide resources and review performance, governance is more likely to become part of the organisation’s day-to-day management and decision-making.

ISO/IEC 42001 places leadership requirements on top management, defined as the person or group of people who directs and controls the organisation at the highest level. Specific tasks can be delegated, but top management remains responsible for ensuring that the AIMS is effective and aligned with the organisation’s strategic direction.

5.1 Leadership and Commitment

Top management must demonstrate leadership and commitment to the AIMS. In practice, this includes:

• Setting direction: ensuring that the AI policy and AI objectives are established and are compatible with the organisation’s strategic direction.
• Integrating governance: incorporating AIMS requirements into relevant business processes, rather than operating AI governance as a separate or disconnected activity.
• Providing resources: ensuring that the people, competence, budget, tools and time needed to establish, implement, maintain and continually improve the AIMS are available.
• Communicating importance: communicating the importance of effective AI management and the need to conform to the AIMS requirements.
• Driving results: ensuring that the AIMS achieves its intended outcomes and directing and supporting people who contribute to its effectiveness.
• Promoting improvement: supporting continual improvement and encouraging managers to demonstrate leadership within their areas of responsibility.

For effective AI governance, this is the difference between a management system that exists on paper and one that operates in practice. Leadership should be evidenced through decisions, resource allocation, performance reviews and action on identified weaknesses—not simply through a published policy.

5.2 AI Policy

Top management must establish an AI policy that is appropriate to the organisation’s purpose, provides a framework for setting AI objectives, and includes commitments to meet applicable requirements and continually improve the AIMS. The policy must be maintained as documented information, communicated within the organisation and made available to interested parties, as appropriate.

An effective AI policy sets out the organisation’s commitments and expectations for the development, provision or use of AI. It should be relevant to the organisation’s activities and risks, and provide a practical basis for decisions and controls. Depending on the organisation’s context, it may address principles such as fairness, transparency, accountability, privacy, security and safety, and should align with related arrangements for information security, data protection, quality and risk management. The policy should be reviewed when significant changes in technology, business activities or applicable requirements make this necessary.

5.3 Roles, Responsibilities, and Authorities

Top management must ensure that responsibilities and authorities for relevant roles are assigned and communicated within the organisation. The AIMS must include responsibility for ensuring conformity with ISO/IEC 42001 and for reporting on AIMS performance to top management.

Clear responsibilities turn governance requirements into operational practice. Each AI system or use case should have an identified owner where appropriate, risk decisions should have defined approval routes, and escalation arrangements should specify who can investigate concerns and take action. Without clear responsibilities and sufficient authority, issues can fall between teams and corrective action may be delayed.

Putting Clause 5 to Work: Practical Steps

1. Appoint an executive sponsor. Identify a senior leader who will support the AIMS, address barriers and review its performance.
2. Develop the AI policy collaboratively. Involve relevant functions—including compliance, legal, information technology, data, operations and business teams—so the policy reflects actual AI use and applicable obligations.
3. Link policy commitments to objectives. Translate relevant commitments into measurable AI objectives under Clause 6, with owners, timeframes and methods for evaluating results.
4. Document responsibilities. Use a RACI matrix or equivalent method to clarify who is responsible, accountable, consulted and informed for AI systems and management processes.
5. Define escalation and intervention authority. Specify who can restrict, suspend or withdraw an AI system or use case when risks, incidents or unexpected outcomes warrant action, in line with the organisation’s procedures.
6. Include AI governance in management review. Report on AIMS performance, objectives, significant risks, incidents, corrective actions and opportunities for improvement—not just completed activities.

Common Pitfalls to Avoid

• Delegating oversight without leadership involvement. Assigning day-to-day tasks to a department does not remove top management’s responsibilities under the AIMS.
• A policy that is not implemented. Generic wording that is not communicated, understood or reflected in decisions provides little practical direction.
• Responsibility without authority. Assigning oversight duties without the ability to escalate concerns or initiate action weakens governance.
• Ignoring unapproved AI use. Failing to understand how AI tools are used across the organisation can leave gaps between the formal policy and actual practice.

The Bottom Line

Clause 4 helps an organisation understand its context. Clause 5 establishes the leadership, policy and accountability needed to govern AI effectively. Top management should provide resources, set clear expectations and ensure that responsibilities are understood and acted upon. These arrangements help make AI governance demonstrable and subject to review. In the next post, we will look at Clause 6, Planning, including AI risk assessments, impact assessments and objectives. For further information, email [email protected], or Request a Free Quote for ISO/IEC 42001 certification through the PJR UK free quotation page.