How to start an AI management system under ISO/IEC 42001 You can start ISO/IEC 42001 without seeking certification: use Clauses 4–10 as a self-assessment and the 38 Annex A controls as a checklist. The core documents an auditor looks for are an AI policy approved by top management (Clause 5.2), a Statement of Applicability (Clause 6.1.3) and an AI system impact assessment (Clause 6.1.4). ISO/IEC 42001 is a voluntary standard, not law.
A large overseas customer of a Thai auto-parts factory sends a supplier questionnaire asking, 'Do you operate an AI management system under ISO/IEC 42001?' The factory only uses AI for visual inspection and a customer chatbot. The IT manager opens the standard's structure and has no idea which clause to start with.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- ISO/IEC 42001 is a management system standard with the same Clause 4–10 structure and Plan-Do-Check-Act cycle as ISO 9001 and ISO/IEC 27001. It asks who is responsible, how risk is assessed, what evidence exists and when it is reviewed, not how accurate your model is.
- The three core documents for certification are the AI policy (5.2), the Statement of Applicability (6.1.3) and the AI system impact assessment (6.1.4).
- An independent auditor can certify you against ISO/IEC 42001; certificates are renewed every 3 years, with surveillance audits in between.
- Most Thai organisations do not need certification, but benefit from using the standard's structure to organise their AI work.
- Organisations that buy rather than build AI can mark most model-building controls in A.6 and A.7 as not applicable in the SoA, provided the reasons are clear.
How to do it in 8 steps
Work through these 8 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Define your role and scope (Clause 4)Decide whether you are a developer, provider or user of AI, because that answer determines which Annex A controls apply to you. Then write a short scope covering which units and AI systems are included and what is excluded and why. A narrow scope you can justify beats a broad one you cannot deliver.
- Have top management approve an AI policy (Clauses 5.1–5.2)Write a 2–3 page policy setting out why you use AI, 5–7 principles, your accepted risk level, who approves new tools and when the policy is reviewed. Have top management sign it; the meeting minutes are the evidence an auditor will ask for.
- Assign roles to named people (Clause 5.3)Build a role table of 5–8 rows, such as an AIMS owner (your Data Protection Officer can take this on at first), an owner for each system, a human overseer and an internal auditor who is not the person doing the work.
- Set criteria and build an AI risk register (Clauses 6.1.1–6.1.2)Use a 3×3 likelihood-by-impact matrix with simple rules: low is accepted, medium is treated and monitored, high is escalated or stopped. Then record risks per system, such as bias, privacy, security and supplier outage.
- Complete a 38-row Statement of Applicability (Clause 6.1.3)List every control from A.2.2 to A.10.4 with applicable or not, the reason, the status and where the evidence is. Have management sign off the residual risk.
- Assess impact on people and society (Clause 6.1.4)For higher-risk systems, assess who is affected, including vulnerable groups, and what happens if the system is misused. The team's guide recommends that someone who did not procure the system carries out the assessment.
- Train staff and reassess on a schedule (Clauses 7–8)Keep evidence of staff competence and policy acknowledgement, and repeat risk assessments at planned intervals and whenever the model, supplier, purpose or data changes. The team's guide suggests every 6 months for high-risk systems and yearly for others.
- Run an internal audit and management review (Clauses 9.2–9.3)Audit at least once a year using the SoA as your checklist, and hold a management review once or twice a year. The minutes must record decisions, not just that items were noted.
What is ISO/IEC 42001 and how is it different from other AI frameworks?
ISO/IEC 42001 is the standard for an AI management system (AIMS), built on the same Clause 4–10 structure as ISO 9001 and ISO/IEC 27001. What sets it apart is three items it requires that other frameworks do not, which form the core of a certification audit.
Organisations that already hold ISO/IEC 27001 can move quickly, because document control, internal audit and management review work the same way.
- An AI policy approved by top management (Clause 5.2).
- A Statement of Applicability explaining which Annex A controls you selected or excluded and why (Clause 6.1.3).
- An assessment of the AI system's impact on individuals and society (Clause 6.1.4 and A.5).
Do we need ISO 42001 certification?
Most Thai organisations do not need certification, but they benefit from the standard's structure: use Clauses 4–10 as a self-assessment and Annex A as a checklist, then decide on certification later.
Unlike the NIST AI RMF, ISO/IEC 42001 can be certified. Certification lets you prove your approach to customers and partners, but it has real costs, and an organisation seeking it must buy the official standard; a summary guide cannot replace it.
Do companies that only buy AI have to implement every Annex A control?
No, but you must answer every one. The Statement of Applicability lists all 38 controls with whether each applies and why; it is not just a list of what you do.
According to the AIPDPA team's guide, 'we are a user, we don't train models' is an acceptable reason for A.6.1.x, A.6.2.2–A.6.2.4 and most of A.7.2–A.7.6, but not for the areas that deal directly with use.
- A.4 Resources
- A.5 Impact assessment
- A.8 Information for users
- A.9 Use of AI systems
- A.10 Suppliers and third parties
How is a Clause 5.2 AI policy different from ChatGPT usage rules?
A Clause 5.2 AI policy is approved by top management and gives a framework for setting objectives, assessing risk and making decisions. Rules for using tools such as ChatGPT are a child document of the policy, not the policy itself, and the team's guide calls this the most common mistake Thai organisations make.
A good policy covers why you use AI; principles such as fairness, transparency, human oversight, privacy, security and accountability; your accepted risk level; who approves new tools; links to your existing privacy and security policies (A.2.3); and an annual review (A.2.4).
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Treating your ChatGPT usage rules as your AI policy. | ✓ Write a 2–3 page top-level policy approved by top management and make the tool rules a child document. AIPDPA includes a ready-to-use workplace AI tools policy for that child document, plus an AI registry showing which tools are actually in use. |
| ✗ Assessing risk once at launch and never again. | ✓ Clause 8 expects reassessment at planned intervals and after significant changes, so set numeric intervals and clear triggers. AIPDPA's DPIA workspace provides a questionnaire, risk register and sign-off, so each AI system's DPIA can serve as its AI risk register. |
| ✗ Excluding A.9 or A.10 from the SoA because 'we are only a user'. | ✓ The user argument only works for model-building controls; the use and supplier areas need real evidence. AIPDPA's vendor register keeps your AI suppliers and their risk on file as A.10 evidence, and Kooru TrustAI can review your AI risks and set up the full governance system with you. |
Build your AI management system on the registry you already have
AIPDPA gives you an AI registry, an AI Risk Radar that checks ISO 42001, Thai law, NIST and the EU AI Act, a DPIA workspace with risk register and sign-off, and a staff quiz, so you keep the evidence an auditor asks for. See the demo account, no sign-up needed.
Included in the GROWTH, PRO and ENTERPRISE plans, from 4,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Is ISO 42001 mandatory under Thai law?
No. ISO/IEC 42001 is an international standard that organisations choose to adopt. Thai legal duties on personal data remain in the Personal Data Protection Act B.E. 2562 (2019) and the notifications issued under it.
How long is an ISO 42001 certificate valid?
According to the AIPDPA team's guide, certificates are issued by an independent auditor and renewed every 3 years, with surveillance audits in between.
We already have ISO 27001. Can we extend it to ISO 42001?
Yes, and quickly, because both standards share the Clause 4–10 structure and the Plan-Do-Check-Act cycle. The new work is the AI policy, an Annex A Statement of Applicability and the AI system impact assessment.
How many controls are in ISO 42001 Annex A?
There are 38 controls, from A.2.2 to A.10.4, and your Statement of Applicability must say for each one whether it applies and why.
Who should run the internal audit of an AI management system?
The auditor must be impartial and must not be the person who runs the system being audited. Small organisations can use someone from another department, or have the DPO audit only the parts they did not do themselves.
Can we use a summary guide instead of the standard to get certified?
No. ISO/IEC holds the copyright and sells the official standard, and an organisation seeking certification must buy it. A summary guide is only a map for getting started.
Sources
This guide relies on 6 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- ISO/IEC 42001:2023, Clause 4 (context of the organisation), as summarised in the AIPDPA team's ISO/IEC 42001 guide (a standard, not law)
- ISO/IEC 42001:2023, Clause 5.2 (AI policy), as summarised in the AIPDPA team's ISO/IEC 42001 guide (a standard, not law)
- ISO/IEC 42001:2023, Clause 6.1.3 (AI risk treatment and Statement of Applicability), as summarised in the AIPDPA team's ISO/IEC 42001 guide (a standard, not law)
- ISO/IEC 42001:2023, Clause 6.1.4 (AI system impact assessment), as summarised in the AIPDPA team's ISO/IEC 42001 guide (a standard, not law)
- ISO/IEC 42001:2023, Clause 8.2 (AI risk assessment at planned intervals), as summarised in the AIPDPA team's ISO/IEC 42001 guide (a standard, not law)
- ISO/IEC 42001:2023, Clauses 9.2–9.3 (internal audit and management review), as summarised in the AIPDPA team's ISO/IEC 42001 guide (a standard, not law)
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
An AI registry and AI Risk Radar against Thai law, NIST, ISO 42001 and the EU AI Act, plus a workplace AI-use policy.
Join the waitlist →Questionnaire, risk register and sign-off in one place, with a printable report.
Join the waitlist →Know who processes data for you, how risky they are and whether the contract is in place.
Join the waitlist →An AI-use risk review and an AI governance setup for your organisation.
See the service →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.