ISO/IEC 42001 Clause 10: Improvement (Continual Improvement & Corrective Action)

Clause 10.2 – Nonconformity and Corrective Action outlines how organizations must respond when the AIMS or an AI system outcome does not meet a requirement or deviates from expected practice. A nonconformity could be discovered through various means – an internal audit finding, an incident or error in an AI system, a compliance check, a customer complaint, or even during day-to-day operations. Whenever such a nonconformity occurs, ISO 42001 requires a structured approach to address it and prevent it from happening again.

At a high level, the required steps for handling nonconformities and implementing corrective action are:

1. React and Control: React to the nonconformity immediately to control and correct it. This may involve containing the issue and mitigating any adverse consequences.
   Example: if an AI model is producing incorrect or biased outputs (a nonconformity with expected performance or ethical standards), the immediate action might be to pull that model from production or activate a human review fallback to contain the impact.
2. Deal with Consequences: Address any consequences caused by the nonconformity. Ensure any harm or compliance breaches are managed. Continuing the example, this could mean informing affected users or correcting any decisions that were made based on faulty AI output.
3. Root Cause Analysis: Investigate the cause of the nonconformity to understand why it happened and how to prevent it. ISO 42001 expects organizations to evaluate the need for action to eliminate the cause(s) of the nonconformity so it does not recur or occur elsewhere. This often involves performing a root cause analysis – using methods like the “Five Whys” or Ishikawa (fishbone) diagrams to dig deeper than the immediate symptom. Additionally, check if similar issues exist in other areas or could potentially occur under similar conditions.
   Example: if an AI system failed due to a data quality issue, assess whether other AI projects might have similar vulnerabilities.
4. Implement Corrective Actions: Once the root cause is identified, take corrective action to eliminate that root cause and prevent recurrence. Corrective actions should be appropriate to the effects and severity of the problem. In some cases, this could mean updating a procedure or providing additional training; in others, it could require a redesign of an AI model, a new control, or changes to supplier arrangements. The key is addressing the underlying issue, not just the surface problem.
   Example: fixing a flawed algorithm rather than merely correcting one erroneous output.
5. Review Effectiveness: After implementing the fix, review and verify the effectiveness of the corrective action. This might involve testing the AI system under the same conditions that caused the issue, auditing the changed process, or monitoring outputs over time to ensure the problem has truly been resolved and hasn’t recurred. A corrective action is not “closed” until there is objective evidence (e.g. data or audit results) showing the issue is resolved and will not resurface.
6. Make System Changes if Necessary: If the nonconformity revealed weaknesses in the AI management system, update the AIMS documentation or processes accordingly. This could mean revising risk assessment criteria, improving supplier evaluation processes, tightening change management for AI models, or other systemic changes to plug any gaps. Clause 10.2 explicitly expects organizations to “make changes to the AI management system, if necessary” following a corrective action, to further ensure the issue doesn’t happen elsewhere.
7. Document the Incident and Action: Maintain documented information as evidence of the nature of the nonconformity, the actions taken, and the results of the corrective action. This means keeping a record in a nonconformity log or incident register that details what went wrong, when it was detected, who was responsible, what root cause was found, what correction and corrective steps were taken, and the outcome. This documentation is crucial for transparency and is often reviewed during audits or certification assessments to confirm that issues are handled properly and improvements are recorded. It also helps your own team learn from past mistakes.

Following these steps ensures a thorough approach to problems: you correct the immediate issue and also address the underlying causes to prevent future recurrence.
Example: if a bias in an AI model’s decisions is identified (nonconformity with your fairness criteria), the organization might (1) correct or remove biased outputs immediately, (2) analyze and find that the training data lacked diversity (root cause), (3) retrain or adjust the model with better data and bias mitigation techniques (corrective action), and (4) later verify that the model’s decisions improved in fairness metrics (effectiveness review). Additionally, the organization would document this incident and perhaps update its data procurement or model validation procedures (system change) to avoid similar bias issues elsewhere.

Best Practices for Nonconformity & Corrective Action

• Establish a Clear Process: Develop a formal procedure for handling nonconformities – from detection to closure. Ensure all staff know how to report issues when they see them. Having a standard workflow (often called a Corrective Action Preventive Action – CAPA process) helps maintain consistency. It should include prompt recording of the issue, notification of responsible personnel, root cause analysis, action tracking, and verification steps.
• Maintain a Nonconformity Log: Use a centralized log or tracking system to record all nonconformities and corrective actions. This log should capture details and status (open, in-progress, closed). Reviewing this log periodically can reveal patterns (e.g., multiple incidents in a particular process or AI model) and help prioritize systemic improvements. Many organizations integrate this with their incident management or GRC (Governance, Risk, Compliance) software for automation and alerts.
• Thorough Root Cause Analysis: Avoid the temptation to apply quick fixes without understanding why a problem occurred. Invest time in a proper root cause analysis for each significant nonconformity. Techniques like the 5 Whys or fishbone diagrams are useful to peel back layers of symptoms and uncover the fundamental cause. 
• Action Plans with Accountability: For each nonconformity, create a corrective action plan that details what will be done, by whom, and by when. Assign ownership to ensure accountability. Include interim containment actions (immediate fixes) as well as long-term preventive measures. Ensure that management is aware of major nonconformities and allocates necessary resources to fix them properly.
• Verify and Close: After corrective actions are implemented, verify their effectiveness before closing the issue. This might require collecting data or conducting a follow-up audit/inspection. Only close the corrective action once you have evidence that the solution worked (for instance, a problematic AI model has been re-tested and meets the performance criteria, or an updated process has been followed without issues for a period of time). A corrective action isn’t finished until there is objective evidence showing the issue will not recur.
• Use a No-Blame Culture: Adopt a culture that views reporting of nonconformities and near-misses as opportunities to improve rather than grounds for punishment. When employees and stakeholders are encouraged to speak up about problems or potential problems, you’ll find out about issues early and can address them before they escalate. Recognize teams for identifying and resolving issues, which reinforces proactive behavior.
• Integrate with Continual Improvement: Treat each nonconformity as a chance to make broader improvements.
  Example: if an issue revealed a gap in training, improve the training program for all staff, not just fix that one case.
  During management review meetings, discuss not only the status of corrective actions but also what was learned and how the AIMS can be improved as a result. ISO 42001 expects that lessons from nonconformities feed into the continual improvement process.
• Capture Opportunities for Improvement: In addition to formal nonconformities, encourage capturing Opportunities for Improvement (OFIs) – suggestions that may not stem from a failure, but from an idea to do things better. This could be as simple as an employee noticing an AI validation step could be improved, or a stakeholder suggesting a new metric to track AI performance. Have a channel (like an improvement register or suggestion program) for collecting these ideas. Clause 10’s spirit is not just about correcting wrongs, but also about making things better proactively.
  ISO 42001 compliance benefits from mechanisms to capture and implement improvement ideas from employees and stakeholders.

Effective corrective action management leads to a virtuous cycle: every mistake or incident strengthens the system rather than weakening it. Over time, this will greatly enhance the reliability, safety, and compliance of your AI systems.