What the management system covers

The requirement, in our words

Set the boundaries and applicability of the AI management system, and keep the scope as documented information. The scope fixes which activities the management-system requirements cover, and it must be traceable to the context analysis.

What it means for human oversight

An oversight register that sits outside the management-system scope will not be audited, resourced or reviewed. The scope should name the systems, the business units and the third parties whose oversight controls are inside the system.

How to evidence it

Attach the artefacts above to the What the management system covers row with the system name, the owner and the date. The first one is the anchor: A documented scope statement. The OH-02 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Traceability from the scope to the context issues and interested-party requirements. If that artefact for OH-02 cannot be produced, the row is a gap, whatever the policy says.

OH-02 carries 3 evidence items and 2 common gaps. For what the management system covers, the auditor looks for a named person with an authority, not a committee title, so the row needs both the name and the sentence that grants the power. The OH-02 statement above is ours, written from ISO/IEC 42001:2023, 4.3, not a reproduction of the licensed text.

Common gaps

• Systems in use excluded without justification
• Scope not linked to the context analysis

Related units

• Context and the role you play
• The AI policy
• AI risk assessment