Organisations using AI need to anticipate what could go wrong before it happens. Clause 6 turns that responsibility into a structured, repeatable planning process.

In this series, we have covered Clause 4, which addresses the organisation’s context and interested parties, and Clause 5, which covers leadership, the AI policy and assigned responsibilities. Clause 6, Planning, translates that context and leadership commitment into planned action. (If the UK Clause 5 article has not yet been published, update this introduction or publish that article first.)

Clause 6 of ISO/IEC 42001 requires organisations to determine risks and opportunities, assess AI risks and impacts, select and evaluate risk treatments, establish AI objectives, and plan changes to the AI management system (AIMS). For compliance and risk teams, it provides a documented basis for decisions, accountability and continual improvement. The standard supports effective governance; it does not replace applicable legal or regulatory obligations.

Why Effective AI Governance Depends on Planning

Effective AI governance is not limited to responding to incidents; it requires organisations to identify and address foreseeable risks. AI systems may produce unreliable outputs, experience performance drift, reproduce bias in data or outcomes, expose information, or be used beyond their intended purpose. These issues can affect customers, employees and other individuals, as well as the organisation. Waiting for complaints, incidents or regulatory scrutiny is not a reliable risk-management strategy.

Clause 6 provides a structured approach to identifying risks, selecting proportionate treatment measures and documenting the rationale for decisions. This evidence can support internal oversight, management review and assurance activities, and help demonstrate that AI-related risks have been considered systematically.

6.1 Actions to Address Risks and Opportunities

Building on the context and interested-party needs identified under Clause 4, the organisation determines the risks and opportunities that need to be addressed so the AIMS can achieve its intended outcomes, prevent or reduce undesired effects, and support continual improvement. It also establishes AI risk criteria, including criteria for accepting risk. Clause 6.1 includes three related processes:

• AI risk assessment (6.1.2): a defined, repeatable process for identifying, analysing and evaluating AI risks. The assessment should consider the nature of the AI system, its intended use and context, and the potential likelihood and consequences of relevant events for the organisation and affected people.
• AI risk treatment (6.1.3): selecting appropriate treatment options and determining the controls needed to address identified risks. The organisation compares its necessary controls with those in Annex A to help ensure relevant controls have not been overlooked. The Statement of Applicability records the necessary controls, whether they are implemented, and the justification for including or excluding Annex A controls, as applicable.
• AI system impact assessment (6.1.4): assessing the potential consequences of an AI system’s development, provision or use for individuals, groups and society. The findings inform the AI risk assessment and help the organisation consider impacts beyond its own operational or commercial interests.

This impact-focused requirement encourages organisations to consider who may be affected by an AI system, how they may be affected, and whether safeguards are needed. For compliance teams, it creates a useful connection between risk assessment, responsible decision-making and evidence of governance.

6.2 AI Objectives and Planning to Achieve Them

The organisation establishes AI objectives at relevant functions and levels. Objectives must be consistent with the AI policy and be monitored, communicated and updated as appropriate; they must be measurable where practicable. For each objective, the organisation plans the activities, resources, responsibilities, timescales and method for evaluating results. Objectives should be documented and supported by evidence that progress is being monitored.

Well-defined objectives turn broad commitments into outcomes that can be assessed. For example, “promote fairness” is a principle, whereas “complete and record a bias evaluation for each customer-facing AI model before release” is a measurable target. The appropriate objective will depend on the system, its risks and the organisation’s obligations.

6.3 Planning of Changes

When changes to the AIMS are needed, the organisation must carry them out in a planned manner. Changes may arise from new or updated models, data sources, suppliers, intended uses, business processes or applicable requirements. Change control should assess the implications for existing risks, controls, responsibilities, documentation and monitoring, so that changes do not introduce unmanaged gaps.

Putting Clause 6 to Work: Practical Steps

1. Define risk criteria before assessing systems. Agree how risk levels will be evaluated and what makes a risk acceptable, including who has authority to accept residual risk. This supports consistent decisions and escalation.
2. Use a consistent risk assessment method. Apply a documented approach across AI systems so that results can be compared and prioritised. ISO/IEC 23894 provides guidance on AI risk management and can support the organisation’s chosen methodology.
3. Integrate impact assessments into the AI lifecycle. Include them in project approval, procurement, deployment and change-management processes, and revisit them when the system or its context changes.
4. Evaluate Annex A controls systematically. Record the rationale for controls included in or excluded from the Statement of Applicability, and ensure decisions are supported by the risk assessment and other applicable requirements.
5. Set meaningful AI objectives. Make objectives specific and measurable where practicable, assign accountable owners, set realistic timescales and define how effectiveness will be evaluated. SMART objectives can be a useful tool, but the standard’s requirements should guide the final wording.
6. Review assessments when circumstances change. Set review triggers for changes to systems, data, suppliers, intended uses, incidents, stakeholder needs or applicable legal and regulatory requirements, as well as any planned periodic review.

Common Pitfalls to Avoid

• Using a generic risk register without tailoring it. Risks should reflect the organisation’s actual AI systems, intended uses, operating context and affected stakeholders.
• Considering only business risk. The impact assessment should also consider potential consequences for individuals, groups and society.
• Treating the Statement of Applicability as a tick-box exercise. Control decisions need a clear rationale and should be consistent with the risk treatment process and applicable requirements.
• Setting vague objectives. If objectives are not measurable where practicable, monitored and evaluated, it is difficult to demonstrate progress or determine whether the AIMS is achieving its intended outcomes.

The Bottom Line

Clause 6 turns AI governance commitments into planned, documented action. By assessing risks and impacts, selecting appropriate controls, setting meaningful objectives and managing change, organisations can strengthen oversight and support continual improvement. ISO/IEC 42001 can form part of an organisation’s wider governance and assurance arrangements, alongside applicable legislation, regulatory guidance and sector-specific requirements. In the next post, we will look at Clause 7, Support, and the people, resources and documented information needed to implement these plans. For further information, email [email protected]. For a quote for ISO/IEC 42001 certification, use PJR’s UK Free Quote page.