What falls within scope?

Defining scope involves determining which AI systems and activities are governed by the AIMS. This is one of the most critical and misunderstood parts of ISO 42001. Most organizations include:

• AI models developed internally
• AI-powered product features
• AI systems that automate or influence decisions
• Third-party AI tools used in operations

Examples include recommendation engines, fraud detection systems, hiring algorithms, customer support chatbots, and predictive analytics tools. Third-party and embedded AI Even if an organization did not build the AI system, it may still fall under scope if the organization uses or relies on it. ISO 42001 requires governance over use, not just development. Risk-based inclusion and exclusion Not all AI systems require the same level of control. Low-risk AI systems may have lighter governance, while high-impact systems require stronger oversight. Any exclusions must be clearly justified and documented. Not all AI systems require the same level of control. Low-risk AI systems may have lighter governance, while high-impact systems require stronger oversight. Any exclusions must be clearly justified and documented.