What is an AI management system, and how is it different from an AI policy?

ISO describes an AI management system as a set of interrelated elements of an organization that establish policies and objectives, and the processes to achieve them, for the responsible development, provision or use of AI systems. It works as one structure, which is why it cannot be reduced to a single document. ISO/IEC 42001 sets the requirements for establishing, implementing, maintaining and continually improving one, for organizations of any size that develop, provide or use AI. See the ISO 42001 guide.

The AI policy is one required element inside the management system. Clause 5.2 of ISO/IEC 42001 asks top management to establish an AI policy that sets direction, commits to meeting the applicable requirements and commits to continual improvement.

A policy says what the organization intends. On its own it does not say who does the work, how a new AI system is assessed, or what happens when one changes. Those answers live in the rest of the system.

• A defined scope: which AI systems and activities the management system covers.
• Assigned roles: top management assigns the responsibilities and authorities for the system (clause 5.3). See who owns AI governance.
• An AI risk assessment process, repeated when systems or their context change.
• AI system impact assessments: what each system could do to the people and groups it affects.
• The Annex A controls: a reference set selected through the risk assessment, with each include or exclude decision justified.
• Monitoring, internal audit and management review that show whether the system works, and corrective action when it does not.

Ask who would notice if an AI system changed its model next week, and what would happen next. A named owner, a defined process and a record of the last time it ran point to a management system. A policy document alone does not.

In Acuna GRC, ISO 42001 runs next to the frameworks you already hold. AI Governance keeps one register of AI systems, gates approval on an impact assessment or a screening record and names who can override or suspend each system. In Implement, each AI control gets an owner, a schedule and a checklist, and every signed run is kept as a record. Staff Portal collects acknowledgements of the AI policy, kept with the version each person read. See ISO 42001 in Acuna GRC.