ISO 42001 Clause 10 explained: improvement

Every clause so far has built the AI management system up: context, leadership, planning, support, operation, evaluation. Clause 10, “Improvement,” is what stops all of that from being a snapshot. It is the final clause of ISO 42001, and its job is to keep the system alive: to take what Clause 9 surfaced and turn it into actual change. It does this two ways, one forward-looking and one reactive: continual improvement, and nonconformity and corrective action.

Two parts, one purpose

• 10.1 Continual improvement (get better on purpose)
• 10.2 Nonconformity and corrective action (fix what goes wrong, at the root)

Both exist to close the loop. A management system that cannot improve and cannot properly handle its own failures is not a system; it is a document that ages.

10.1 Continual improvement

Clause 10.1 is short and it is a commitment: the organisation shall continually improve the suitability, adequacy and effectiveness of the AI management system. “Continual” is not “constant”, it does not mean perpetual upheaval. It means a standing habit of using what you learn to make the system better, rather than treating it as finished the day it launched.

In practice, continual improvement is powered by Clause 9. Your monitoring results, internal audit findings and management review decisions all point at things worth improving; 10.1 is the requirement to actually act on them. For AI specifically, this matters more than in most domains, because the ground moves: models change, uses expand, and the regulatory picture keeps shifting. A static AI governance system is an out-of-date one within a year. Continual improvement is how it keeps pace.

10.2 Nonconformity and corrective action

This is the disciplined machinery for when something goes wrong. A nonconformity is any failure to meet a requirement, whether a requirement of ISO 42001 or one of your own. A control in your Statement of Applicability that is not actually implemented, a risk assessment that was due and never happened, an AI system that behaved outside its defined bounds, each is a nonconformity.

When one occurs, Clause 10.2 requires you to:

• react to it, take action to control and correct it, and deal with the consequences;
• evaluate the need to eliminate the root cause so it does not recur, including checking whether the same nonconformity exists, or could occur, elsewhere;
• implement the action needed;
• review the effectiveness of that action; and
• update the management system if necessary.

The distinction at the heart of 10.2 is between correction and corrective action. Correction fixes this instance, you patch the control that was missing. Corrective action fixes the cause, so there is no next instance, you find out why the control was missing and change the process that let it happen. Organisations that only ever do correction keep solving the same problem forever. And throughout, you retain documented information: what the nonconformity was, what you did, and whether it worked.

Closing the loop: Plan-Do-Check-Act

Clause 10 is where ISO 42001 reveals its shape. The standard is built on the Plan-Do-Check-Act cycle that underlies every modern management system:

• Plan, Clauses 4 to 6 (context, leadership, planning)
• Do, Clauses 7 and 8 (support, operation)
• Check, Clause 9 (performance evaluation)
• Act, Clause 10 (improvement)

And “Act” flows straight back into “Plan.” The improvements you make here feed back into your context, your planning and risk, and your controls, and the cycle begins again. That is why we keep saying an AIMS is a system you operate, not a project you finish: Clause 10 is the clause that turns the line into a circle.

Common mistakes

• Improvement with no engine. Committing to continual improvement (10.1) but never feeding it from Clause 9, so nothing actually improves.
• Correction without corrective action. Fixing the symptom every time and never the root cause, so the same nonconformities keep returning.
• Unrecorded fixes. Handling problems informally with no documented information, so you cannot show, to an auditor or yourselves, that they were dealt with.
• No look-across. Fixing a nonconformity in one place without checking whether the same weakness exists elsewhere, which 10.2 explicitly asks you to do.
• Treating go-live as done. The deepest mistake, running the system as a finished artefact rather than a living one, which Clause 10 exists to prevent.

The short version

Clause 10 is what makes ISO 42001 a living system rather than a one-time build. It commits you to continually improving the system’s suitability, adequacy and effectiveness, driven by everything Clause 9 surfaces (10.1), and it gives you a disciplined way to handle failures: react, correct, find and eliminate the root cause, check the fix worked, and update the system, all recorded (10.2). Its deeper role is to close the Plan-Do-Check-Act loop, feeding improvement back into context, planning and controls so the whole cycle runs again. Get Clause 10 right and your AI governance keeps pace with a fast-moving field; skip it and even a well-built system quietly goes stale.

That completes the clause-by-clause walk through ISO 42001. To see how the ten clauses fit together, start with what an AIMS actually contains and the full ISO 42001 guide; the checklist turns the standard into a to-do list. When you want help building a system that improves rather than ages, our ISO 42001 consulting takes you from context to certification, and the free AI governance check gives you a baseline in about ten minutes, no email.

Previous: Clause 9, performance evaluation. Back to the start: Clause 4, context of the organization.