A management system is continuous
ISO/IEC 42001 calls for policies, risk management, roles and internal review that can be demonstrated in practice. Certification and surveillance audits look for records showing that those processes operate, not only documents saying they should.
The certificate has a boundary
An assessed management system does not automatically make every decision produced by a deployed model defensible. When a specific output is challenged, the institution still needs its context, applicable control, reviewer and outcome.
Make the audit trail routine
Evidence collected as AI operates connects the management system to real use. It allows teams to examine exceptions, improve controls and answer an auditor without recreating a decision after the fact.
ISO/IEC 42001 AI management system · Annex A controls · certification and surveillance audits