1.2 Navigating the AIMS Framework & Study Plan

How to study this exam efficiently

The official blueprint is broad rather than numerically detailed: Domain 1 addresses fundamental AIMS principles and concepts, while Domain 2 addresses the AIMS itself. PECB does not publish topic weights for this Foundation exam. Your plan should therefore guarantee complete coverage before it tries to predict frequency.

Build a two-layer mental model

Start with the management-system spine. ISO/IEC 42001 uses the harmonized management-system structure:

Then add the AI-specific layer: AI risk assessment, AI system impact assessment, objectives for responsible development and use, lifecycle controls, data governance, information for interested parties, and responsibility across suppliers and customers.

A useful retrieval exercise is to explain one end-to-end thread. Context identifies relevant issues and interested parties. Leadership establishes direction. Planning defines risk and impact processes and objectives. Support supplies competence and controlled information. Operation performs the assessments and treatments. Performance evaluation monitors and audits results. Improvement addresses nonconformities and strengthens the system.

Learn the annex architecture accurately

Annex A is a normative reference catalogue of control objectives and controls. It contains 38 controls in nine groups. The correct distribution is:

The pattern totals 38. Do not use the inaccurate 31-control pattern sometimes produced by collapsing subgroups or treating objective rows as controls.

Annex A is normative, but not every control is automatically required for every organization. Clause 6.1.3 requires the organization to determine necessary controls, compare them with Annex A so none are omitted, and justify inclusion and exclusion in the Statement of Applicability. Annex B is also normative and gives implementation guidance for the Annex A controls. Annex C is informative material on potential objectives and risk sources. Annex D is informative guidance on use of the AIMS across domains or sectors.

Separate four kinds of statements

Many wrong answers blur requirement levels. Label each study statement as one of these:

1. Clause requirement: mandatory text in Clauses 4–10, such as defining an impact-assessment process.
2. Applicable Annex A control: a control selected through risk treatment and recorded in the Statement of Applicability.
3. Normative implementation guidance: Annex B guidance associated with the Annex A controls; it informs implementation without turning every example into the only acceptable method.
4. Practice example: a model card, RACI matrix, red-team exercise, or canary release that may be useful but is not named as a universal requirement.

When a quiz option says that ISO/IEC 42001 always requires a particular tool, committee title, fairness formula, cloud architecture, or reporting deadline, treat the claim skeptically. The standard is technology-neutral and context-sensitive.

Use three study passes

Pass 1: structure and vocabulary

Learn the two domains, PDCA map, clause purposes, important terms, and Annex group names. Use flashcards that ask for meaning in both directions: “Clause 8?” and “Where is operation?” Include the distinction between an AI risk assessment and an AI system impact assessment.

Pass 2: requirement mapping

For each clause, build a small map with four columns: purpose, required action, documented information, and related Annex controls. For example, Clause 6.1.4 defines an impact-assessment process and documents results; Clause 8.4 performs assessments at planned intervals or when significant changes are proposed; A.5 provides related reference controls.

Pass 3: scenarios and traps

Work scenario questions by identifying the actor, lifecycle stage, triggering condition, and required output. Ask whether the scenario concerns development, provision, or use. Identify whether it is about organizational objectives, risks to those objectives, or consequences for individuals, groups, and societies. Finally, decide whether the answer describes a clause requirement or merely one possible control implementation.

A practical schedule

A ten-session plan can be adapted to available time:

• Session 1: exam identity, concepts, terminology, and standards relationships.
• Session 2: responsible AI, roles, lifecycle, risk, and impact.
• Sessions 3–5: Clauses 4–6, with extra practice on risk treatment, SoA, impact assessment, and objectives.
• Sessions 6–7: Clauses 7–10 and PDCA linkages.
• Sessions 8–9: Annex A groups and exact control numbers.
• Session 10: mixed practice, error log, and official-logistics recheck.

Keep an error log with three fields: why your answer was wrong, the governing clause or control, and the cue you will use next time. Re-answer missed questions after a delay rather than immediately memorizing a letter.

Closed-book preparation

Because the exam is closed book, build recall around relationships rather than page locations. Practice recreating the PDCA map and Annex count table from memory. Use plain-language explanations: if you cannot explain why Clause 6 plans and Clause 8 executes, the numbering alone will not help in a scenario.

Do not memorize unofficial passing scores, domain percentages, or invented “favorite exam topics.” Use only current official logistics. A good final check is whether you can accurately explain every heading in the 24-section guide and answer its quizzes without depending on an answer pattern.