Clause 6, Planning
Decide what can go wrong, and what good looks like, before you build. Every requirement area of Clause 6, verified against the published structure of ISO/IEC 42001:2023 on August 25, 2026.
Clause 6 is where risk enters the system. The organization plans how it will address risks and opportunities around its AI systems, and sets measurable AI objectives.
Two disciplines meet here: AI risk assessment (what could go wrong, for whom, how badly) and AI risk treatment (what you will do about it, and which Annex A controls you will use to do it). The output of that second exercise is the Statement of Applicability: the list of Annex A controls you have adopted, with a justification for every one you left out.
The requirement areas
- 6.1 Actions to address risks and opportunities
Plan how the organization will find, assess and treat AI risks, including how Annex A controls are selected and justified in the Statement of Applicability.
- 6.2 AI objectives and planning to achieve them
Set measurable AI objectives at the relevant functions and levels, and plan who does what, with which resources, by when.
- 6.3 Planning of changes
When the management system itself must change, plan the change rather than letting it happen by drift.
Clause 6 is a discipline before it is a document
Reading the clause tells you what an auditor will look for. The AI Governance program drills the work itself, and the credential shows an employer you did it under assessment.
Clause and subclause identifiers follow ISO/IEC 42001:2023 exactly; the wording is our plain-English paraphrase, and the standard's full text is sold by ISO at iso.org/standard/81230.html. Not affiliated with or endorsed by ISO or the IEC. Last verified: August 25, 2026.