ISO/IEC 42001 AIMS RACI Template
A RACI matrix for an ISO/IEC 42001 AI management system: ten roles against the requirements in clauses 4 to 10 and each Annex A area from A.2 to A.10, with sample assignments and a check that every row has exactly one Accountable role.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Subscribers customise it with their own details and generate the document for their own work.
RACI preview: clauses 4 to 6
R = Responsible, A = Accountable, C = Consulted, I = Informed. The full template covers clauses 4 to 10 and Annex A areas A.2 to A.10, plus role holders.
| Clause or area | Activity | Top management | AIMS manager | CISO | AI system owner | ML / data science | Data protection / privacy | Legal / compliance | HR / learning | Procurement | Internal audit |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Clause 4 Context | Determine the internal and external issues relevant to AI, and the organisation's roles for each AI system (for example provider or user) | C | A/R | C | C | C | C | C | - | - | I |
| Clause 4 Context | Identify interested parties and their requirements, including legal and contractual ones | I | A/R | C | C | - | C | R | - | - | - |
| Clause 4 Context | Define and approve the AIMS scope, boundaries and justified exclusions | A | R | C | C | C | C | C | - | - | I |
| Clause 5 Leadership | Show leadership commitment: resources, integration into business processes, direction | A/R | R | C | I | - | - | - | - | - | I |
| Clause 5 Leadership | Approve and communicate the AI policy | A | R | C | C | - | C | C | I | - | I |
| Clause 5 Leadership | Assign AI roles, responsibilities and authorities | A | R | C | C | C | C | C | C | - | I |
| Clause 6 Planning | Define the AI risk assessment method and run AI risk assessments | I | A | C | R | R | C | C | - | - | I |
| Clause 6 Planning | Plan AI risk treatment and select controls (Annex A and any others) | I | A | R | R | C | C | C | - | - | I |
| Clause 6 Planning | Produce the Statement of Applicability with a justification for each control | I | A/R | C | C | - | C | C | - | - | I |
26 more rows in the full template. Customise it with your organisation’s details and download it as Word, PDF, Markdown or CSV with Pro.
A RACI matrix for an ISO/IEC 42001 AI management system: who is Responsible, Accountable, Consulted and Informed for the requirements in clauses 4 to 10 and for each Annex A area (A.2 to A.10), across ten roles. Sample assignments for a mid-size organisation; change them to fit yours. The summary checks that each activity has exactly one Accountable role and someone Responsible.
Your context
How to read this matrix
RACI by clause and Annex A area
One row per requirement or Annex A area. Exactly one A per row; use A/R where the accountable role also does the work. Split a row if different teams own different parts of it.
Role holders
Who holds each role today.
Loading…
TL;DRWhat this template gives you
4 points
- Clause 5 expects top management to assign and communicate AIMS roles, responsibilities and authorities; a RACI is a clear way to show it.
- Ten roles against 26 clause-level activities (context, leadership, planning, support, operation, performance evaluation, improvement) and nine Annex A areas.
- Internal audit is kept Consulted or Informed on the areas it audits, so the audit programme stays independent.
- The summary flags rows with no Accountable or more than one, rows nobody is Responsible for, and the busiest roles.
Frequently asked questions
Does ISO/IEC 42001 require a RACI matrix?
Not by name. It requires roles, responsibilities and authorities for the AIMS to be assigned and communicated (clause 5) and controls on internal organisation (Annex A area A.3). A RACI is a common, auditable way to show both.
What is the AIMS manager role?
The person who runs the AI management system day to day: scope, risk and impact processes, the Statement of Applicability, documented information and the management review pack. Some organisations call it Head of AI Governance or Responsible AI lead.
Can one person hold several roles?
Yes, especially in a smaller organisation. Keep internal audit separate from the areas it audits, and keep one Accountable role per row.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. A free account gets 3 free tool runs, shared across every tool; after that, customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) needs Pro, $5/month or $40/year. Your work is saved in your own browser.
Tools for each standard
AI standards toolkit →Every ISO tool on PlayCISO, grouped by the standard it supports. Standards are described in our own words; you still need your own copies of them.
ISO/IEC 27090: AI security guidance
Guidance on security threats to AI systems. It cannot be certified; apply it inside your ISO/IEC 27001 or 42001 management system.
- ISO 27090 Readiness ChecklistProScore six weighted themes and see your gaps ranked.
- ISO 27090 in 10 MinutesFreeSix short modules with quizzes and a learning badge.
- Can You Be Certified to ISO 27090?FreeNo. What can certify or attest AI security instead.
- ISO 27090 Practice PathFreeAI security labs grouped by threat theme, with progress.
- ISO 27090 Threat-Mapping LabProMap AI scenarios to threat class, CIA property and fix.
- ISO 27090 Implementation LabProFive rounds as the CISO, ending with the auditor.
- ISO 27090 Auditor InterviewFreeAnswer an assessor; scored on evidence and ownership.
- ISO 27090 RACI TemplateProNine roles × 32 AI security activities, checked for one Accountable each.
- ISO 27090 Project Plan TemplateProEditable phases, tasks, owners, deliverables and indicative durations.
- ISO 27090 Project Plan GeneratorProA phased plan scaled to your size, systems and certifications.
- ISO 27090 Maturity TimelineProFive maturity levels with indicative months between them.
- ISO 27090 Cost EstimatorFreePeople-days per phase, a cost range and annual effort.
- ISO 27090 Sample ArtefactsProScope statement, threat register, policy, RACI and test log.
- ISO 27090 AI Security Test PlanProThirty test cases across ten AI threat areas.
- ISO 27090 Traceability MatrixFreeTrace each AI threat to controls, tests and evidence.
- AI Shared-Responsibility MatrixFreeProvider, customer or shared, per deployment model.
- AI Security Metrics SetFree20 KPIs and KRIs mapped to the threat themes.
- AI Security Review CalendarFree12 months of reviews with owners, as an .ics file.
- AI Security Board Briefing PackFreeA one-page board brief and five slides with notes.
- ISO 27090 Alignment StatementFreeSafe "aligned with 27090" wording for trust pages and RFPs.
ISO/IEC 42001: AI management system
The certifiable AI management system standard: clauses 4 to 10 plus Annex A controls, audited by an accredited certification body.
- ISO 42001 AIMS Scope BuilderFreeClause 4: context, interested parties and a draft scope.
- ISO 42001 Gap Assessment LabProPractise judging conformity against the AIMS standard.
- ISO 42001 Implementation Project PlanProScope to Stage 2: phases, tasks, owners and indicative durations.
- ISO 42001 Annex A GuideFreeA.2 to A.10: what good looks like and audit evidence.
- ISO 42001 SoA BuilderProStatement of Applicability with status and justification.
- ISO 42001 Objectives PlannerFreeMeasurable AI objectives with owners and KPIs.
- ISO 42001 AI Competence MatrixFreeClauses 7.2 and 7.3: roles, target levels and gaps.
- ISO 42001 Documented Information RegisterFreeEvery AIMS document and record with owner and retention.
- ISO 42001 Evidence BinderProAudit evidence by clause and Annex A area.
- ISO 42001 Internal Audit PlannerFree9.2: a risk-based 12-month audit programme.
- ISO 42001 Management Review PackPro9.3: every input, KPIs, decisions and actions.
- ISO 42001 Nonconformity TrackerFree10.2: root cause, corrective action, effectiveness.
- ISO 42001 Mock AuditProRehearse the certification audit and get a debrief.
- ISO 42001 Stage 2 Audit LabFreeThree audit days with a certification auditor.
- ISO 42001 Certification CountdownFreePlan back from your certificate date.
- ISO 42001 + 27001 IMS PlannerFreeWhat an AIMS and an ISMS can share or merge.
ISO/IEC 42005: AI system impact assessment
How to assess an AI system's impact on people, groups and society; feeds the 42001 impact assessment.
- ISO 42005 AI Impact AssessmentProAssess impact on people, groups and society.
ISO/IEC 23894: AI risk management
Guidance on managing AI risk, built on ISO 31000; feeds the 42001 risk assessment and treatment.
- ISO 23894 AI Risk Treatment PlanProIdentify, analyse and treat AI risks with owners.
ISO/IEC 27001: information security management
The certifiable ISMS that most AI security controls plug into.
- ISO 27001 Readiness ChecklistProCheck ISMS readiness before a 27001 audit.
Across standards
Implement a control once and evidence it for every framework that asks for it.
- AI Standards CrosswalkPro42001, 27001, 27090, EU AI Act and NIST AI RMF side by side.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.