Clause 4, Context of the organization
Know your situation before you write a single policy. Every requirement area of Clause 4, verified against the published structure of ISO/IEC 42001:2023 on August 25, 2026.
Every ISO management system starts the same way: the organization has to understand itself before it can manage anything. Clause 4 asks what internal and external issues shape your AI work, who has a stake in it, and where the management system's boundary sits.
The distinctive AI part is role clarity. The standard expects you to determine which role you play for each AI system in scope: provider, producer, user or partner. An organization that only buys a model has different obligations from one that builds it, and Clause 4 is where that distinction is written down.
The requirement areas
- 4.1 Understanding the organization and its context
Identify the internal and external issues that affect what your AI management system must achieve, including the role your organization plays relative to each AI system.
- 4.2 Understanding the needs and expectations of interested parties
Name the stakeholders (customers, regulators, employees, affected people) and what each expects from your use of AI.
- 4.3 Determining the scope of the AI management system
Draw the boundary: which systems, products, sites and functions the management system covers, stated plainly enough to audit.
- 4.4 AI management system
Establish, implement, maintain and continually improve the system itself, with its processes and their interactions defined.
Clause 4 is a discipline before it is a document
Reading the clause tells you what an auditor will look for. The AI Governance program drills the work itself, and the credential shows an employer you did it under assessment.
Clause and subclause identifiers follow ISO/IEC 42001:2023 exactly; the wording is our plain-English paraphrase, and the standard's full text is sold by ISO at iso.org/standard/81230.html. Not affiliated with or endorsed by ISO or the IEC. Last verified: August 25, 2026.