4.3 Clause 6.2 & 6.3: AI Objectives & Planning of Changes

Clauses 6.2 and 6.3: objectives and planned change

Policy provides direction; objectives make that direction measurable and manageable. Clause 6.2 establishes the criteria for AI objectives and the planning questions needed to achieve them. Clause 6.3 ensures that changes to the AIMS are deliberate rather than uncontrolled.

Clause 6.2: establish AI objectives

The organization establishes AI objectives at relevant functions and levels. The objectives must:

• be consistent with the AI policy;
• be measurable, if practicable;
• take applicable requirements into account;
• be monitored;
• be communicated;
• be updated as appropriate; and
• be available as documented information.

These are the exact criteria to memorize. “Reflect the risk and impact assessment results” is sensible linkage but is not a separate listed criterion in Clause 6.2. Risk and impact findings can still drive priorities because objectives, treatment, and AIMS outcomes are connected.

Measurable if practicable

The qualifier matters. Many objectives can use quantitative measures: reduce a defined subgroup error gap, complete impact assessments before a release gate, or meet a response time for material AI incidents. Others may initially require qualitative evidence. The organization should define how it will know the objective was achieved rather than forcing a meaningless number.

Avoid universal fairness or hallucination thresholds. A percentage that is appropriate in one task may be unsafe or meaningless in another. The metric, baseline, population, data window, owner, and decision rule should fit the objective.

Planning to achieve objectives

When planning how to achieve its AI objectives, the organization determines:

1. what will be done;
2. what resources will be required;
3. who will be responsible;
4. when it will be completed; and
5. how results will be evaluated.

Clause 6.2 expressly requires documented information on the objectives. It requires the five planning matters to be determined, but does not say each must be retained in a separate document. In practice, an objectives register or plan often records them together because that supports execution and auditability.

Example objective plan

This is an illustrative format, not a standard-mandated template.

Clause 6.3: planning of changes

Clause 6.3 is concise: when the organization determines the need for changes to the AIMS, the changes must be carried out in a planned manner.

That is the complete core requirement. A frequently repeated four-factor list—purpose and consequences, AIMS integrity, resources, and allocation of responsibilities—comes from the change-planning language of other management-system standards. It should not be attributed to ISO/IEC 42001 Clause 6.3.

Those subjects remain sensible considerations. A good plan can ask:

• Why is the change needed and what could it affect?
• Which AIMS processes, documents, controls, and interfaces change?
• Are resources and competence sufficient?
• Do responsibilities or authorities change?
• What verification, communication, and rollback are proportionate?
• Does the change trigger risk or impact assessment?

Present this as a practical checklist, not mandatory clause wording.

AIMS change versus AI-system change

Clause 6.3 directly refers to changes to the AI management system. Examples include changing scope, governance, risk criteria, communication processes, audit arrangements, or responsibility allocation.

AI-system changes are controlled through connected requirements. Clause 8.1 controls planned changes and reviews unintended operational changes. Clauses 8.2 and 8.4 trigger reassessment at significant change. Annex A.6 can provide lifecycle, deployment, monitoring, documentation, and logging controls when applicable.

A model retrain is therefore not automatically governed by a fictional four-part Clause 6.3 test. The organization evaluates whether it is significant under its processes, controls it operationally, and performs the relevant assessment and validation. A minor configuration correction and a new model with a different intended purpose do not require identical treatment.

Worked change scenario

An organization changes its customer-service assistant from one supplier model to another. The change can affect responsibilities, data handling, output behavior, technical documentation, monitoring baselines, user information, and incident response.

A planned approach might include supplier review, updated risk and impact assessments if the change is significant, regression testing, revised documentation, responsibility allocation, staff communication, deployment criteria, and post-release monitoring. These steps derive from the integrated AIMS and chosen controls; the standard does not say every change must use canary release, top-management approval, or one named test suite.

Objective and change traps

• “Measurable” is qualified by “if practicable.”
• Objectives must be documented; planning matters must be determined.
• Clause 6.3 is not the ISO 9001 four-factor clause.
• Not every technical edit is automatically a significant change.
• A significant change can trigger risk and impact reassessment even when it comes from a supplier.
• Vague objectives may fail the “measurable if practicable” test, but the severity of any audit finding depends on evidence and context; do not automatically label it major.