ISO 42001 Clause 7 explained: support

A plan you cannot run is just a document. Clause 7, “Support,” is the part of ISO 42001 that makes the plan from Clause 6 actually runnable: it covers the resources, the people and their competence, the awareness and communication, and the documentation that a working AI management system depends on. It is the least glamorous clause and one of the most consequential, because a well-designed system with no resourcing, no competent people and no maintained records quietly stops working, usually without anyone deciding that it should.

The five parts of Clause 7

Clause 7 is a checklist of what a functioning system needs:

• 7.1 Resources
• 7.2 Competence
• 7.3 Awareness
• 7.4 Communication
• 7.5 Documented information

None of them is difficult on its own. The discipline is not skipping any.

7.1 Resources

Clause 7.1 requires you to determine and provide the resources needed to establish, run, maintain and improve the AI management system. That means people, time, budget, tooling and infrastructure. It reads back directly to Clause 5.1, where leadership committed to making resources available; 7.1 is where that commitment becomes a concrete requirement. A system that exists on paper but has no one allocated to run it fails here.

7.2 Competence

This is the sub-clause that matters most for AI, and the one organisations most often underestimate. Clause 7.2 requires you to:

• determine the competence needed by people whose work affects the system;
• ensure they are competent, on the basis of education, training or experience;
• act to close gaps where they exist; and
• retain evidence of competence.

For AI, competence is not a formality. The people classifying risk, building systems and, above all, providing human oversight need genuine understanding: an overseer who cannot tell a sound output from a plausible-but-wrong one is a competence gap, not a staffing detail. This connects directly to the EU AI Act’s AI-literacy duty, which requires that people dealing with AI systems have sufficient understanding to do so responsibly. Meeting 7.2 well tends to satisfy much of that obligation at the same time.

7.3 Awareness

Where competence is about capability, awareness (7.3) is about orientation. The relevant people must be aware of the AI policy, of their own contribution to the management system and its benefits, and of the implications of not conforming. The distinction matters: someone can be technically competent yet unaware of the policy they are meant to be working within, or unaware that their shortcut undermines a control. Awareness is what makes the system a shared responsibility rather than the governance team’s private project.

7.4 Communication

Clause 7.4 requires you to determine the internal and external communications relevant to the system: what you will communicate, when, with whom, and how. Internally, that is keeping the people who run and rely on AI informed. Externally, it can mean communicating with customers, regulators, or the interested parties you identified in Clause 4, and, increasingly, being transparent with the people your AI systems affect. It is a modest requirement that prevents a common failure: governance decisions made and never communicated to the people who need to act on them.

7.5 Documented information

Clause 7.5 covers the documents and records the system runs on. ISO 42001 uses the single term documented information for both:

• documents that direct the system, policies, processes, procedures; and
• records that evidence it ran, risk assessments, impact assessments, logs, review minutes.

The clause has two demands. First (7.5.2), documented information must be created and updated properly: identified, in a suitable format, and reviewed and approved. Second (7.5.3), it must be controlled: available where needed, adequately protected, and managed through distribution, access, storage, version control and retention.

The point of all this is provability. A certification audit is, in large part, an examination of your documented information: it is how you demonstrate that the system described actually operates. But the standard rewards proportion, not volume. A clear, current, controlled set of documents beats a large pile of unmaintained ones, and the control requirements in 7.5.3 matter as much as the documents themselves, an out-of-date procedure that everyone ignores is worse than no procedure at all.

Common mistakes

• Unfunded systems. A system designed in Clause 6 with no resource allocated in 7.1 to actually run it.
• Awareness mistaken for competence. A short all-staff briefing that raises awareness but does not build the real competence 7.2 requires of the people doing the work.
• Uncontrolled documents. Policies and procedures with no version control or owner, so no one knows which copy is current, failing 7.5.3.
• Documentation for its own sake. Generating volume to look thorough, rather than the proportionate, maintained set the standard actually wants.
• Silent governance. Decisions made but never communicated (7.4), so controls exist in a document and nowhere in practice.

The short version

Clause 7 is the support layer that makes ISO 42001 operable. It requires you to resource the system properly (7.1), ensure the people running and overseeing AI are genuinely competent and to evidence it (7.2), make them aware of the policy and their role (7.3), communicate what needs communicating internally and externally (7.4), and create and control the documented information that lets you prove the system works (7.5). None of it is hard, but all of it is load-bearing: skip the support layer and a well-planned system slowly stops functioning, because the people, resources and records it depends on were never put in place. Get Clause 7 right and the system can actually be operated, which is exactly what Clause 8 goes on to do.

Standing up an AIMS? The ISO 42001 guide walks the full standard, the checklist turns it into a to-do list, and our ISO 42001 consulting helps you build the competence and documentation layer without drowning in paperwork. For a quick baseline, the free AI governance check takes about ten minutes, no email.

Previous: Clause 6, planning and AI risk. Next: Clause 8, operation.