ISO 42001 clause 4.1: context of the organisation

What ISO/IEC 42001 is

ISO/IEC 42001:2023 is the international standard for an AI management system: the policies, roles, processes and records an organisation uses to govern the AI it builds, provides or uses. Like ISO 9001 or ISO/IEC 27001 it is a management system standard, so it is structured as clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation and improvement), followed by Annex A, a reference set of 38 controls across 9 control objectives, and supporting guidance in Annexes B to D.

It is certifiable. An accredited certification body audits the organisation against it, in two stages followed by surveillance audits and recertification on a three-year cycle. This first article explains the standard, why a regulated firm might use it, and then turns to ISO 42001 clause 4.1. On 15 January 2026 UKAS announced that it had granted BSI the first UK accreditation for certifying AI management systems to the standard.

Why an FCA-regulated firm might use it

The FCA has said it does not plan AI-specific rules. Its approach is principles-based and focused on outcomes, relying on existing frameworks such as the Consumer Duty and the senior managers regime. That leaves each firm to decide what good AI governance looks like and how to prove it. Every firm already has to organise and control its affairs responsibly and effectively, with adequate risk management systems (PRIN 2.1.1R); AI is now part of those affairs.

ISO/IEC 42001 gives that work a recognised shape and an external test. It is useful where clients, group parents or investors ask how AI is governed, and where a firm wants one structure that its board, its senior managers and an auditor can all read. It is not a regulatory requirement, and certification does not give a presumption of conformity with the EU AI Act. This series takes the standard clause by clause and control by control, starting where an auditor starts: ISO 42001 clause 4.1.

What ISO 42001 clause 4.1 asks for

Clause 4.1 asks the organisation to work out the external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended results of its AI management system. The AI-specific addition is that the organisation must also determine its role or roles in relation to AI systems: for example whether it develops them, provides them to others, uses systems built by suppliers, or several of these at once. The intended purpose of the AI systems it develops, provides or uses is part of the same analysis.

Role matters because much of what follows depends on it. A firm that only uses a supplier's model has a different control set, and different exclusions in its Statement of Applicability, from a firm that trains its own credit model.

Context for a UK regulated firm

For most FCA-regulated firms the external issues include at least:

• Regulation: the Consumer Duty, the senior managers and certification regime, and UK GDPR, where Articles 22A to 22D on automated decision-making applied for remaining purposes from 5 February 2026.
• Cross-border reach: the EU AI Act applies to providers and deployers outside the EU where the output of the AI system is used in the EU.
• Supervisory direction: the FCA's Mills Review of July 2026 on how AI could reshape retail financial services, including its autonomy spectrum.
• Market and supply chain: dependence on a small number of model and cloud providers, and what clients expect to see.

Internal issues include the firm's risk appetite, its data, the skills it has in house, its existing control framework and how far AI already sits inside customer journeys such as onboarding, affordability, collections or complaints handling.

Evidence an auditor will accept

The standard does not prescribe a format. What works is a short, dated context analysis that names each issue, says why it matters to the AI management system, and points to where it is dealt with: a risk in the risk register, a requirement in the interested parties register, a boundary in the scope statement. Add a plain statement of the firm's AI role for each system in the inventory.

The common gap is a polished AI policy with no record of the thinking beneath it. The second is a context analysis written once for the certification project and never revisited, even after a new supplier, a new product or a change in the law.

What to do

1. Write down your AI roles. For every AI system in use, record whether you develop it, provide it, use it or a combination.
2. List the issues. Separate external from internal, and keep each one specific to AI rather than copied from a general strategy paper.
3. Link each issue forward. Show where it is picked up in your interested parties register, scope statement and risk assessment.
4. Date it and set triggers. Review on a fixed cycle and whenever a regulatory change, new AI system or material supplier change occurs.
5. Get it owned. Have the senior manager accountable for AI read and approve it.

Our view

In our view clause 4.1 is the most underrated clause in the standard. It looks like scene-setting, but it is the root of the scope and the risk assessment, and a weak context analysis shows up later as gaps nobody can explain. For an FCA firm, the regulatory section largely writes itself; the harder and more valuable work is being honest about the internal issues.

Published by compliance monitoring software for FCA firms. Every Handbook reference in this article was checked against the provision text in our FCA Handbook mirror before publication. This is general information, not legal advice.