ISO 42001 Documentation: Templates and Best Practices

Required policies:

1. AI Management System Policy (Clause 5.2)
2. AI Risk Management Policy
3. Information Security Policy (if not separate ISO 27001)

Required procedures:

1. Document control procedure
2. Risk assessment and treatment procedure
3. Internal audit procedure
4. Management review procedure
5. Nonconformity and corrective action procedure
6. Competence assessment procedure

Required records:

1. Scope definition
2. Risk register
3. Statement of Applicability
4. Training records
5. Internal audit reports
6. Management review minutes
7. Corrective action records

Annex A requirements:

1. AI system inventory
2. Impact assessment records
3. AI lifecycle documentation
4. Data provenance records
5. Third-party assessment records
6. Transparency information
7. Human oversight records

Model cards provide standardized documentation for ML models. Key sections:

Model Details:

Model Name: Customer Churn Predictor v2.1
Model Type: Gradient Boosted Trees
Training Date: 2024-09-15
Version: 2.1.0
Owner: Data Science Team

Intended Use:

Primary Use: Predict customer churn probability
Users: Customer Success Team
Out of Scope: Credit decisions, pricing discrimination

Training Data:

Dataset: Customer interaction history 2021-2024
Size: 2.3M records
Features: 45 behavioral and demographic
Preprocessing: Anonymization, outlier removal
Known Limitations: Limited expatriate representation

Performance Metrics:

Accuracy: 87.3%
Precision: 84.1%
Recall: 79.8%
F1 Score: 81.9%
AUC-ROC: 0.912

Fairness Assessment:

Demographic Parity: Tested across nationality, gender, age
Equalized Odds: Within acceptable thresholds
Known Biases: Slight underperformance on <25 age group
Mitigation: Additional monitoring for young customer segments

Data sheets document datasets used in AI systems.

Motivation:

• Purpose of dataset creation
• Creator and funder
• Intended uses

Composition:

• Instance count and types
• Feature descriptions
• Missing data handling
• Confidentiality considerations

Collection Process:

• Data sources
• Collection mechanisms
• Timeframe
• Consent and ethical review

Preprocessing:

• Cleaning steps
• Transformations applied
• Selection criteria

Distribution:

• Access controls
• Usage restrictions
• Licensing