ISO 42001 Implementation Checklist for AI Companies in Vietnam

ISO/IEC 42001 implementation starts with an operating management system, not the purchase of a certificate. An organization needs a defined scope, accountable owners, AI risk processes, operating controls, and evidence that shows those controls work. This checklist turns those needs into work a product, engineering, security, and compliance team can assign and track.

ISO describes ISO/IEC 42001:2023 as the standard for establishing, implementing, maintaining, and continually improving an artificial intelligence management system, or AIMS. It applies to organizations that develop, provide, or use AI based products and services.

What should an ISO 42001 checklist cover?

A practical implementation plan covers eight workstreams:

1. Define the context and AIMS scope.
2. Create an AI system inventory.
3. Establish policies, roles, and approval rights.
4. Assess AI risks and impacts.
5. Select controls and treatment actions.
6. Govern data, suppliers, and the AI lifecycle.
7. Monitor performance and respond to incidents.
8. Run internal audits and management reviews.

This is a readiness and operations checklist. Certification, if the organization chooses to pursue it, comes from an independent certification body. pTrackly does not issue ISO 42001 certificates and does not claim to hold ISO 42001 certification.

1. Define the AIMS scope

The scope identifies which AI systems are managed, which teams are accountable, and which activities fall inside the assessment boundary.

Document:

• The products, features, or business processes that use AI.
• Whether the organization develops, provides, operates, or uses each system.
• Relevant business units, technical teams, locations, and suppliers.
• Data and infrastructure inside the boundary.
• Dependencies and exclusions, with reasons.

A scope based only on model names or APIs misses how AI affects a real decision. Start with the business process, intended outcome, and affected people, then trace the supporting technology.

2. Build an AI system inventory

The AI inventory is the system of record for the AIMS (the AI system inventory and risk register guide has a field model and review cycle). Each entry should contain:

• System name and intended purpose.
• Business owner and technical owner.
• Model, provider, version, and deployment environment.
• Input data, outputs, and affected user groups.
• Degree of automation and points of human review.
• Known limitations, risks, and next review date.
• Links to design documents, test results, and change records.

Include third party AI tools when they affect an in-scope process. A coding assistant, transcription service, or content model can create data and supplier risks even when the company did not build the model.

3. Assign AI governance responsibilities

The organization needs named roles with decision rights. Define who can:

• Approve a new AI use case.
• Accept or reject residual risk.
• Authorize production deployment.
• Pause a system after an incident or unacceptable impact.
• Approve material changes to data, models, and suppliers.

Avoid assigning every responsibility to a generic "AI team." Evidence should show which person or defined role reviewed the information and approved the decision.

4. Assess AI risks and impacts

A risk assessment considers likelihood and consequences for the organization, customers, and affected parties. An impact assessment examines how a system may affect people, rights, safety, security, or service quality.

For each system, record:

• Intended purpose and reasonably foreseeable uses.
• Affected groups and business processes.
• Data bias, inaccurate outputs, and misuse scenarios.
• Privacy, security, intellectual property, and supplier risks.
• Preventive, detective, and response measures.
• Residual risk, approval criteria, owner, and review date.

The NIST AI Risk Management Framework organizes AI risk work into Govern, Map, Measure, and Manage. It is a useful operational reference for keeping a risk register current. NIST AI RMF is voluntary guidance, not an ISO certification scheme.

5. Select controls and treatment actions

Controls should follow the scope, organizational role, risk results, and applicable legal or contractual obligations. They are not identical for every AI system.

For each treatment action, document:

• The risk being treated.
• The selected control and its objective.
• Owner, deadline, and required resources.
• Evidence to collect.
• The method used to test operating effectiveness.
• The decision on residual risk.

Common control areas include system documentation, data management, information for interested parties, responsible use, and third party relationships. Teams should consult the published standard or a qualified specialist before defining their formal control scope.

6. Govern data and AI suppliers

For data, keep records of provenance, usage rights, quality criteria, preparation steps, representation limits, and the handling of sensitive information. For external services, review data use terms, model changes, retention, incident support, and exit options.

A supplier agreement is not a substitute for technical assurance. Keep test results, configurations, change records, and approval evidence alongside contract reviews.

7. Monitor deployed AI systems

AI risks change when data, models, prompts, users, or operating contexts change. The monitoring plan should define:

• Quality measures and alert thresholds.
• Recurring tests for identified risks.
• Feedback and complaint channels.
• AI incident classification and response.
• Rollback, suspension, and reassessment conditions.
• Owner and management review schedules.

NIST states that AI risk management should continue across the system lifecycle. That practice supports the continual improvement expected from an ISO management system.

8. Prepare internal audit and management review evidence

Before an independent assessment, verify that the AIMS operates as documented. The evidence set should include:

• Current scope, policies, objectives, and AI inventory.
• Risk register, impact assessments, and treatment plans.
• Competence, training, and responsibility records.
• Test, monitoring, change review, and incident records.
• Supplier reviews and approval decisions.
• Internal audit plans, findings, and corrective actions.
• Management review records and improvement decisions.

An internal audit should not stop at confirming that a document exists. Sampling should establish whether the process produced suitable evidence in day to day operations.

Which ISO 42001 evidence can be automated?

Automation works well for repeatable evidence with a reliable source, such as access lists, deployment versions, test results, change tickets, and scheduled reviews. Decisions about impacts, risk acceptance, and the suitability of a use case still require human judgment.

pTrackly helps teams translate requirements into assigned tasks, manage documents, retain evidence, and track recurring reviews. It supports AIMS readiness and maintenance without replacing management, specialists, or an independent certification body. See the pTrackly ISO 42001 solution and the ISO 42001 AI governance guide.

References

• ISO/IEC 42001:2023, AI management systems
• Vietnam Ministry of Science and Technology: ISO/IEC 42001 and AI governance
• NIST AI Risk Management Framework
• NIST AI RMF Playbook

This article provides general implementation information. It is not legal advice or a certification guarantee.