AI Risk Treatment Process and Statement of Applicability
Plain English Translation
To meet ISO/IEC 42001:2023 clause 6.1.3 requirements, organizations must define a formal AI risk treatment process to manage the findings from their risk assessments. This involves selecting appropriate risk treatment options (such as mitigate, transfer, avoid, or accept), identifying the necessary controls, and comparing them against Annex A to ensure no critical safeguards are omitted. Ultimately, the organization must create an ISO 42001 statement of applicability (SoA) detailing included and excluded controls with justifications, and formally formulate an ISO 42001 risk treatment plan approved by designated management.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Map highest-priority AI risks to immediate mitigation controls using a simplified ISO 42001 risk treatment options avoid mitigate transfer accept framework.
- Draft an initial ISO 42001 statement of applicability referencing core Annex A controls.
Required Actions (scaleup)
- Formalize the AI governance risk treatment methodology for AIMS by integrating the AI risk treatment plan with broader enterprise risk management tools.
- Ensure all Annex A controls are systematically reviewed, with explicit justifications for exclusions, and obtain formal management sign-off on residual risks.
Required Actions (enterprise)
- Automate the linkage between risk assessments, the AI risk register and treatment plan, and the SoA within a unified GRC platform.
- Implement continuous monitoring to dynamically update the Statement of Applicability based on real-time threat intelligence and changing operational contexts.
An ISO 42001 risk treatment plan is a formal document that details how an organization will respond to identified AI risks, defining the chosen treatment options and specifying the controls necessary to mitigate those risks effectively.
To define an AI risk treatment process under ISO/IEC 42001:2023 clause 6.1.3 requirements, organizations must evaluate risk assessment findings, select appropriate treatment options, determine necessary controls against Annex A, produce a Statement of Applicability, and formulate a formal plan requiring management approval. Tools like WatchDog Security's Risk Register can help document treatment decisions, track action owners and due dates, and record residual risk acceptance approvals in a consistent workflow.
An ISO 42001 statement of applicability (SoA) is a mandatory document that details all necessary controls for managing AI risks, providing explicitly documented justifications for both the inclusion and exclusion of controls from Annex A.
Organizations determine ISO 42001 Annex A controls selection and justification by mapping the controls required to execute their chosen risk treatment strategies, comparing them directly against Annex A to verify that no necessary safeguards have been omitted.
When evaluating how to create statement of applicability (SoA) ISO 42001 documentation, organizations must include all implemented controls, reasons for their selection, and detailed justifications for excluding any Annex A controls (e.g., if deemed unnecessary by the risk assessment).
To appropriately understand how to document residual risk and risk acceptance for AI systems, organizations must record these details in the AI risk register and treatment plan, subsequently obtaining explicit, documented approval from designated management for accepting the remaining residual risks.
Clause 6.1.3 directly operationalizes the findings of Clause 6.1.2 by taking the analyzed results of the AI risk assessment and requiring the organization to formulate a specific, actionable AI governance risk treatment methodology for AIMS.
As ISO 42001 certification evidence for risk treatment and SoA, external auditors expect to review the documented risk treatment plan, the finalized Statement of Applicability, and records demonstrating formal management approval of both the plan and the residual AI risks. Tools like WatchDog Security's Compliance Center can help structure these artifacts, track control mapping completeness, and retain supporting evidence and approvals in an audit-friendly format.
Yes, organizations frequently utilize an AI risk treatment plan template ISO 42001 that standardizes the mapping of risks to Annex A controls, logs inclusion/exclusion justifications, and captures required management sign-offs in a structured format.
You should review and update the ISO 42001 risk treatment plan and Statement of Applicability at planned intervals, whenever significant changes occur to the AI systems, or when adjustments in the external regulatory landscape dictate a shift in the AI governance approach.
Maintaining a risk treatment plan and Statement of Applicability requires consistent traceability from risks to controls, plus clear approvals and revision history as AI systems change. Tools like WatchDog Security's Risk Register can centralize risk scoring, track treatment actions, capture residual risk acceptance, and generate board-ready reporting that supports ongoing SoA and plan updates.
Auditors typically want to see documented treatment decisions, control justifications, and management sign-off that is easy to reproduce and consistent across reviews. Tools like WatchDog Security's Compliance Center can help by organizing control mappings, tracking gaps, and collecting supporting evidence in one place so the risk treatment plan and SoA remain defensible during certification and surveillance audits.
"Taking the AI risk assessment results into account, the organization shall define an AI risk treatment process to: a) select appropriate AI risk treatment options; b) determine all controls that are necessary to implement the AI risk treatment options chosen and compare the controls with those in Annex A to verify that no necessary controls have been omitted; c) consider the controls from Annex A that are relevant for the implementation of the AI risk treatment options; d) identify if additional controls are necessary beyond those in Annex A in order to implement all risk treatment options; e) consider the guidance in Annex B for the implementation of controls determined in b) and c); f) produce a statement of applicability that contains the necessary controls [see b), c) and d)] and provide justification for inclusion and exclusion of controls. Justification for exclusion can include where the controls are not deemed necessary by the risk assessment and where they are not required by (or are subject to exceptions under) applicable external requirements; g) formulate an AI risk treatment plan."
"The organization shall obtain approval from the designated management for the AI risk treatment plan and for acceptance of the residual AI risks. The necessary controls shall be: aligned to the objectives in 6.2; available as documented information; communicated within the organization; available to interested parties, as appropriate. The organization shall retain documented information about the AI risk treatment process."
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-23 | WatchDog Security GRC Team | Initial publication |
