Scoping is the single biggest decision in an ISO 42001 programme: the right boundary keeps a programme focused on the systems that matter and holds up at certification. Here is the working checklist we use with clients.
Inventory every AI system
Cast a wide net. Include:
Classify each system
| Dimension | Options |
|---|---|
| Role | Provider, Developer, User, Customer |
| Use case | Decision support, automation, content generation, prediction, classification |
| Risk level | Minimal, limited, high, unacceptable |
| Data sensitivity | Public, internal, confidential, regulated (PII, PHI, financial) |
| Audience | Internal staff, customers, regulators, public |
Define the boundary
Document scope along three axes:
Write a one-page scope statement signed by the AIMS owner. Auditors will quote this back to you.
Identify interfaces and exclusions
Any AI system excluded from scope must have a documented justification and a clean interface definition (what data crosses the boundary, what controls apply at the boundary).
Run the applicability assessment
Walk every Annex A control of ISO 42001 and decide: applicable, applicable with modification, or not applicable. Justify exclusions in the Statement of Applicability (SoA).
Validate with stakeholders
Workshop the scope and SoA with: legal, privacy, security, business owners, and internal audit. Surface disagreements before the certification body does.
07
Common scoping mistakes
Excluding embedded SaaS AI on the basis that "we did not build it." Wrong, the User role still applies.
Picking only one pilot system for scope. Auditors expect the boundary to reflect actual organizational AI activity.
Excluding training data lifecycle. Data preparation is in scope.
Ignoring shadow AI. Address it through policy and controls, not through scope exclusion.
Need Expert Guidance?
Our team of specialists can help you navigate these challenges and build a tailored strategy for your organization.
Schedule a ConsultationAllo Technologies provides advisory and managed services across cybersecurity, cloud, and AI.
Frequently asked questions
Find answers to common questions about our services
Share this article
Stay up to date
Get notified when new compliance guides and cybersecurity articles are published.
Related Reading
More insights from the Allo Technologies practice
Future-Proofing AI Strategy: 2025-2026 Outlook
AI regulations are accelerating globally. Gulf organizations must prepare for generative AI governance, ESG integration, and regulatory expansion.
Read moreAI Governance ROI: Business Case for Executives
AI governance investments yield measurable returns through risk reduction, market access, and competitive advantage. Build your business case here.
Read moreAI Risk Assessment: Gulf-Specific Use Cases
AI risks vary by industry and region. Healthcare, finance, and smart cities in the Gulf face unique challenges requiring tailored assessment approaches.
Read moreTalk to an Expert
Get personalized guidance from our senior security and compliance practitioners