A city is aligning to ISO/IEC 42001 for AI management. What should the AIMS-oriented adoption emphasize?
Select an answer to reveal the explanation.
Short Explanation
ISO/IEC 42001 isn’t a bumper sticker. It’s about policy, roles, risk, and continual improvement—an AI management system the city actually runs.
Full Explanation
ISO/IEC 42001-oriented adoption for a city emphasizes an AI management system: policy that sets intent and boundaries, roles that assign responsibility, risk processes that identify and treat AI risks, and continual improvement that closes findings over time. Those clauses make AI governance a managed organizational capability rather than a one-off project. Municipal AIMS work typically integrates with existing ISMS/GRC practices so AI risks are reviewed with the same discipline as other enterprise risks.
A one-time sticker purchase with no policy or roles fails because certification theater without management-system substance does not control AI. Skipping risk and continual improvement clauses entirely fails by concept: risk treatment and improvement are core AIMS elements, not optional marketing extras. Replacing all human managers with unsupervised AI agents fails accountability and misreads the standard—management systems organize human organizational control of AI, they do not abolish human management.
Exam caveat: aligning to 42001 themes can be valuable even before formal certification; the exam focus is operationalizing policy, roles, risk, and improvement—not buying a logo. Operational check: inventory AIMS artifacts (AI policy, role definitions, risk register entries for AI systems, corrective-action tracking) and verify each production AI use maps to those elements with a named owner and last review date.