ISO 42001 AIMS Scope and Context

Overview

Draft and validate AIMS scope statement and organizational context for ISO/IEC 42001:2023 certification (Clause 4).

Getting Started

Add your source materials to the project workspace, then activate the ISO 42001 AIMS Scope and Context skill. The agent will guide you through the process step by step.

Example conversation

You: We’re preparing for ISO 42001 certification and need to document our AIMS scope and organizational context. We use one AI system in scope (recommendation engine) and have no third-party AI.

Agent: I’ll draft the scope and context using the skill’s reference. I’ll document internal and external issues, interested parties, AIMS boundaries, and in-scope systems. I’ll list exclusions with specific justification (e.g. “No third-party AI in scope”) and the relationship to the EU AI Act. Then I’ll run scope_context_check on the draft and fix any missing or weak sections until it passes.

Output excerpt

Scope and context excerpt

Context of the organization — Internal: objectives include responsible AI adoption; one product team develops the recommendation engine. External: EU AI Act applies; sector regulations [X]. Interested parties: customers, DPO, regulator. Needs: transparency, fairness, data protection.

AIMS scope — Boundaries: [Organization name], product [Y], recommendation engine and supporting data pipeline. In scope: development, deployment, and monitoring of the recommendation engine. Exclusions: no third-party AI systems (we do not use external AI APIs or embedded AI); justification: all AI in scope is developed and operated in-house. Interfaces: [e.g. CRM, analytics] documented in interface register.

Relationship to regulations — Scope aligns with EU AI Act obligations for the in-scope system; data processing under [GDPR/UK GDPR] referenced in data governance procedure.

Extension and validation

The skill includes scope_context_check, which validates the scope/context document for Clause 4. It checks for: context (internal/external issues, interested parties); scope (boundaries, applicability); exclusions with justification; relationship to regulations. It flags weak or generic exclusion justifications (e.g. “N/A” alone). Run it after drafting and address findings before audit.