Clause 8, Operation
Where the plan meets actual AI systems. Every requirement area of Clause 8, verified against the published structure of ISO/IEC 42001:2023 on August 25, 2026.
Clause 8 is the doing clause: running the processes planned in Clause 6 across the real AI lifecycle. This is the only clause where the risk work is executed rather than planned.
Unusually for a Harmonized Structure standard, Clause 8 re-runs risk: operational AI risk assessment, risk treatment, and the AI system impact assessment all happen here, on live systems, not just in the planning document.
The requirement areas
- 8.1 Operational planning and control
Run the processes the management system needs, under controlled conditions, including control of outsourced work.
- 8.2 AI risk assessment
Perform AI risk assessments at defined intervals and when significant changes are proposed, and keep the records.
- 8.3 AI risk treatment
Implement the risk treatment plan and retain the documented results.
- 8.4 AI system impact assessment
Assess the potential consequences of AI systems for individuals, groups and society, following the process defined through Annex A.
Clause 8 is a discipline before it is a document
Reading the clause tells you what an auditor will look for. The AI Governance program drills the work itself, and the credential shows an employer you did it under assessment.
Clause and subclause identifiers follow ISO/IEC 42001:2023 exactly; the wording is our plain-English paraphrase, and the standard's full text is sold by ISO at iso.org/standard/81230.html. Not affiliated with or endorsed by ISO or the IEC. Last verified: August 25, 2026.