An AI management system (AIMS) is the certifiable structure ISO/IEC 42001 defines for governing AI: seven interlocking clauses, context of the organization, leadership, planning, support, operation, performance evaluation, and improvement, plus a normative set of Annex A controls covering resources, data, the AI system life cycle, and third-party relationships. Unlike a policy document, it’s built to keep producing evidence on an ongoing basis: risk assessments, impact assessments, competence records, and internal audit results.
Many organisations conflate having an AI policy with having an AIMS, which is exactly the gap a certification auditor tests for first. A functioning AIMS has to reproduce consistent results on a repeated risk assessment, retain records of every impact assessment, and run internal audits against the standard’s own clauses, not against whatever the organisation wrote for itself. Building it after the fact, right before an audit date, is far more expensive than generating the evidence continuously from the point a use case is first scoped.
The tell that separates a real AIMS from a policy binder is its statement of applicability: a living record of which Annex A controls the organisation applies or excludes, and why, updated every time a risk assessment finds something new.