NovaQTech Insights
From QMS to AI Governance: How ISO 9001 and ISO/IEC 42001 Can Work Together in the Age of AI
Amir Abbas Mousapour
NovaQTech Group
October 2026
Abstract
Artificial intelligence is rapidly moving from being a specialized technology to becoming part of everyday organizational processes. As AI begins to influence supplier evaluation, design, inspection, customer interaction, risk assessment, corrective action, auditing, and management decision-making, an important question emerges: where does traditional Quality Management end and AI Governance begin?
This article examines the relationship between Quality Management Systems (QMS) and Artificial Intelligence Management Systems (AIMS), particularly in the context of ISO 9001:2026 and ISO/IEC 42001:2023. It argues that AI should not automatically be treated as a separate technical layer when it materially influences the intended outcomes of quality-related processes.
The article proposes several practical concepts for AI-enabled management systems, including three levels of AI involvement—AI Assistance, AI Influence, and AI Decision—the concept of Human–AI System Failure, and AI Dependency Mapping. It also proposes a practical process-based framework connecting business processes, AI roles, risks, human oversight, controls, evidence, performance evaluation, and improvement.
The central argument is straightforward: organizations may delegate tasks to AI, but they cannot delegate accountability for the quality of the systems they choose to operate.
Keywords: Quality Management System; QMS; Artificial Intelligence; AI Governance; ISO 9001:2026; ISO/IEC 42001:2023; AIMS; Human Oversight; Auditing; AI Risk; Human–AI Systems
1. Introduction — When AI Becomes Part of the Management System
Artificial intelligence is rapidly becoming part of normal organizational work. Organizations increasingly use AI to analyze information, support decisions, communicate with customers, evaluate risks, prepare documents, monitor performance, and improve operational efficiency.
From a quality-management perspective, however, this development raises a more fundamental question:
What happens when AI is no longer simply a tool used by an organization, but becomes part of the processes through which the organization delivers quality?
Consider a relatively simple example. An organization operating a Quality Management System uses an AI application to analyze customer complaints, identify recurring problems, and recommend corrective actions. The organization may still have procedures, responsibilities, performance indicators, internal audits, and management reviews. Yet part of the analysis influencing its quality decisions is now performed by AI.
This creates questions that conventional approaches to quality management have not always needed to address explicitly.
Who is accountable for the reliability of AI-generated analysis? How does the organization determine whether the information provided to AI is appropriate? What happens when AI provides an incorrect or misleading recommendation? What level of human review is necessary? What evidence should remain available for an auditor?
These are not merely information-technology questions.
Once AI can influence product or service conformity, customer satisfaction, operational decisions, risk evaluation, or process effectiveness, it becomes relevant to the management system itself.
This is where the relationship between ISO 9001-based Quality Management Systems and ISO/IEC 42001-based Artificial Intelligence Management Systems becomes particularly important.
ISO 9001:2026 remains the international requirements standard for Quality Management Systems, while ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System. ISO describes ISO/IEC 42001 as the world’s first AI management-system standard.
The two standards address different management objectives and should not be treated as competing systems.
For organizations in which AI is becoming embedded in business processes, the more useful question is:
Where do Quality Management and AI Governance need to meet?
This article explores that question from a practical management-system and auditing perspective.
Ultimately, the challenge is not simply to manage AI. It is to ensure that, as organizations become increasingly AI-enabled, accountability, process control, competence, evidence, risk management, and continual improvement do not become weaker simply because part of the work is now performed by a machine.
2. Where QMS and AI Governance Meet
Quality management and AI governance may initially appear to address different organizational concerns. One focuses primarily on consistent quality outcomes; the other addresses the responsible management of AI.
The boundary becomes less clear when AI begins participating in processes that influence quality.
The connection is not created simply because an organization has purchased an AI application. It becomes significant when the use, output, or decision of an AI system can materially affect the performance or outcome of a quality-relevant process.
An AI tool used to improve the wording of an internal document may present limited QMS significance. The same technology used to evaluate supplier performance, analyze inspection results, classify customer complaints, support design decisions, or recommend acceptance or rejection of an output can have very different implications.
The question should therefore not simply be:
“Does the organization use AI?”
A more useful management-system question is:
“Where does AI influence a process, decision, or output that matters to quality?”
Several familiar management-system disciplines immediately become relevant: leadership and accountability, process control, risk and opportunity, competence, documented information, performance evaluation, internal audit, management review, corrective action, and continual improvement.
NIST’s AI Risk Management Framework similarly emphasizes defined human–AI roles, executive responsibility for AI risk decisions, human oversight, competence, documented controls, and assessment of potential impacts.
Leadership and Accountability
The introduction of AI does not remove organizational responsibility.
If an AI system recommends a decision, organizations still need to determine who owns the process, who is authorized to rely on the output, who reviews it when necessary, and who remains accountable for the final organizational decision.
Automation should not create ambiguity of accountability.
Process Approach and Operational Control
Where AI contributes materially to a process, the organization should understand how it receives information, what it produces, how that output is used, and what controls exist between the AI contribution and the final organizational outcome.
A simplified process might therefore become:
Process Input → AI Processing/Support → AI Output → Human Review or Automated Action → Process Output
The extent of control should depend on significance and risk rather than on the mere presence of AI.
Risk-Based Thinking
AI introduces additional sources of uncertainty: unreliable outputs, unsuitable data, bias, lack of transparency, model or system changes, inappropriate use, and excessive reliance on automated recommendations.
Where these risks can affect quality outcomes, they should not automatically be separated from the organization’s existing approach to risk.
Competence and Human Oversight
Human oversight means more than placing a person somewhere in the workflow.
Depending on risk, effective oversight may require understanding AI limitations, recognizing when verification is necessary, questioning outputs, and overriding automated recommendations where appropriate.
Effective human oversight requires a competent person capable of questioning the machine.
Evidence and Traceability
When AI materially contributes to an important decision, the organization may need sufficient evidence to reconstruct what occurred.
The appropriate level of traceability should depend on context and consequence. OECD’s AI Principles similarly connect accountability with context-appropriate traceability across datasets, processes, and decisions.
3. Quality Risks Created by AI — Who Is Responsible When AI Gets It Wrong?
AI can improve speed, scalability, consistency, and analytical capability. But it also creates a particular quality challenge: an output can appear professional, logical, and convincing while still being incomplete, misleading, or incorrect.
The apparent quality of an AI output should not be confused with the reliability of that output.
AI Does Not Remove Organizational Responsibility
Consider AI supporting supplier evaluation.
If AI recommends approval, the organization accepts the recommendation without appropriate verification, and the supplier later fails critical requirements, responsibility cannot simply be transferred to the AI system.
Organizations can delegate tasks to technology.
They cannot automatically delegate accountability with those tasks.
This position is consistent with broader AI-governance principles. NIST assigns executive leadership responsibility for decisions concerning AI risks, while OECD emphasizes accountability based on actors’ roles and context.
More Than Incorrect Output
AI-related quality risk extends beyond factual error.
Failure can result from inadequate inputs, inappropriate use, changes in operating conditions, insufficient competence, inconsistent results, unsuitable applications, or excessive human reliance on automated recommendations.
Three dimensions therefore deserve attention: the reliability of the AI, the quality of its inputs, and the way humans use its outputs.
Many future failures may not be exclusively “human error” or “machine error.” They may arise from their interaction.
Automation Bias and Human Oversight
As AI becomes more capable, users may gradually apply less scrutiny to its recommendations.
This creates a management-system paradox:
The better AI appears to perform, the greater the temptation may be to reduce human verification.
A person who routinely approves AI recommendations without meaningful evaluation may technically be “in the loop” while providing little real control.
NIST explicitly recognizes different human–AI configurations and the importance of clearly defining responsibilities and oversight according to context and risk. OECD likewise identifies human agency and oversight as possible safeguards appropriate to the context.
Control According to Consequence
Not every AI output requires extensive verification.
AI used to improve the wording of an internal meeting agenda should not necessarily receive the same controls as AI used to interpret critical requirements, assess product conformity, approve suppliers, or support safety-related decisions.
A practical distinction may be:
- Low-impact AI use → normal professional judgment
- Moderate-impact AI use → defined verification or review
- High-impact AI use → stronger controls, competent authorization, appropriate traceability, and performance evaluation
This leads to one of the central propositions of this article:
Do not control AI because it is AI. Control its use according to the significance of its impact on the process.
When AI Changes, Does the Process Change?
AI-enabled processes can change even when their documented procedures remain unchanged.
Providers may update models. Organizations may change prompts, configurations, integrations, data sources, or automation levels.
This creates another management question:
If the AI component of a controlled process changes significantly, should the organization treat this as a process change?
Where that change can materially affect intended outcomes, there is a strong management-system case for evaluating its impact.
Human–AI System Failure
Imagine that AI generates an incorrect recommendation, an employee fails to identify the error, the organization has not established appropriate verification, and management has encouraged extensive automation.
Calling the outcome simply “human error” would be inadequate.
Calling it simply “AI error” would also be inadequate.
For the purposes of this article, I propose the term:
Human–AI System Failure
The concept directs root-cause analysis toward the interaction among technology, people, information, process design, competence, controls, and management decisions.
Corrective action should address the system that produced the failure rather than automatically blaming either the person or the technology.
4. AI as Part of the Process — Not Just a Tool
Not every use of AI should automatically become a QMS issue.
The management-system concern begins when AI can materially influence the intended outcome of a quality-relevant process.
The same AI application may therefore have very different significance depending on how it is used.
AI Assistance, AI Influence, and AI Decision
For practical management purposes, I propose three levels of AI involvement:
AI Assistance — AI helps a person perform an activity but does not materially determine the final outcome.
AI Influence — AI provides analysis, classification, prediction, or recommendation that materially influences human judgment.
AI Decision — AI determines or triggers an outcome with limited or no human intervention.
These categories are not proposed as ISO requirements or as a certification model. They are a practical method for understanding how deeply AI has entered a process.
The greater its influence, the more important questions of reliability, oversight, accountability, and traceability become.
Human-in-the-Loop Is Not Automatically a Control
A statement that “a human remains in the loop” provides limited assurance by itself.
The better question is:
Can that human effectively challenge the AI when necessary?
Meaningful oversight may require competence, authority, supporting information, knowledge of limitations, and the ability to reject or override AI recommendations.
Human presence and human control are not necessarily the same thing.
Process Ownership
Responsibility for AI cannot always be assigned entirely to IT.
IT may manage infrastructure, security, access, and technical configuration. But when AI affects supplier approval, design, inspection, customer complaints, or corrective action, the relevant process owner should understand the dependency.
The process owner does not need to become an AI engineer.
But that owner should be able to answer:
What is AI doing in my process?
What do we rely on it for?
What happens if it is wrong?
What controls do we have?
How do we know those controls work?
5. ISO 9001 and ISO/IEC 42001 — Complementary, Not Competing
ISO 9001 and ISO/IEC 42001 address different primary objectives.
ISO 9001:2026 provides requirements for a QMS, while ISO/IEC 42001:2023 establishes requirements for an AIMS for organizations developing, providing, or using AI-based products or services.
Their purposes are different, but their management architectures can intersect.
Organizations may operate multiple management systems, but they remain one organization—with shared leadership, people, processes, resources, suppliers, risks, objectives, information flows, and decisions.
Creating isolated systems for every discipline can result in duplication and fragmented governance.
True integration is not simply the merging of documents. It occurs when responsibilities, risks, controls, evidence, and decisions are managed coherently across systems.
Established QMS disciplines—including process ownership, competence, corrective action, internal audit, supplier management, performance evaluation, change management, and continual improvement—can also support effective AI governance.
The relationship works in both directions.
Not every organization with a QMS requires an AIMS, and not every AI activity necessarily belongs inside the QMS.
Instead:
The degree of integration between QMS and AI governance should follow the degree to which AI can influence quality outcomes.
6. A Practical Framework for Integrating QMS and AI Governance
To connect the two domains operationally, I propose the following process-based framework:
Business Process → AI Role → Risk & Impact → Human Oversight → Control → Evidence → Performance → Improvement
This framework is not an ISO requirement or an alternative certification model. It is a practical management approach derived from the preceding analysis.
Business Process
Start with the organizational process, not the technology.
Where is AI being used in a way that could influence intended outcomes?
AI Role
Determine whether AI provides Assistance, Influence, or Decision.
Risk & Impact
Ask:
What happens if the AI contribution is wrong, incomplete, unavailable, misunderstood, biased, or used outside its intended purpose?
Human Oversight
Where oversight is necessary, determine who reviews the output, what competence and authority are required, and when AI should be challenged or overridden.
Control
Design controls according to consequence. These may include verification, authorization thresholds, defined use cases, validation, data requirements, periodic testing, comparison against known results, or escalation criteria.
Evidence
Retain evidence proportionate to significance.
The objective is not to archive every AI interaction. It is to make consequential decisions sufficiently auditable.
Performance
Do not measure AI solely through speed and productivity.
An AI-enabled process may become faster while becoming less reliable.
Efficiency without confidence in the output is not necessarily improvement.
Improvement
When failures occur, investigate the entire Human–AI system and use the findings for corrective action and continual improvement.
7. AI Dependency Mapping
Traditional process mapping shows activities, interactions, inputs, outputs, and responsibilities.
AI-enabled organizations may need another perspective:
Where is the organization dependent on AI for achieving the intended results of its processes?
For this article, I propose calling this concept AI Dependency Mapping.
A simplified representation could be:
Business Process → AI Role → Degree of Influence → Potential Consequence → Human/Technical Control → Evidence → Performance Monitoring
The purpose is not to create another layer of bureaucracy.
It is to make AI dependency visible.
NIST’s AI RMF already uses mapping as part of its broader risk-management architecture and emphasizes understanding context, intended application, human oversight, and potential impacts. The concept proposed here applies similar risk-oriented thinking specifically to process architecture within management systems.
AI Dependency Mapping may help management identify an important vulnerability:
Which processes would be affected tomorrow if an important AI capability failed, changed significantly, or began producing unreliable results?
If management cannot answer that question, the organization may already depend on AI more than it realizes.
8. What This Means for Auditors
AI will not only change the processes being audited.
It may change how auditors think about evidence, responsibility, process effectiveness, change, and risk.
Traditional audit methods remain valid: interviewing people, examining records, observing activities, following process trails, and testing controls.
But part of the reasoning between an input and an organizational decision may now occur through AI.
The audit trail is therefore no longer necessarily entirely human.
Follow the AI Trail
Consider supplier approval:
Supplier Information → AI Evaluation → Risk Recommendation → Human Review → Approval → Supplier Performance
The auditor does not necessarily need to understand the internal mathematics of the model.
The auditor does need sufficient understanding to evaluate whether the organization appropriately controls its reliance on AI.
New Audit Questions
Traditional questions can be extended:
Does AI contribute to this activity?
What information does it use?
How do you know its output is sufficiently reliable for this purpose?
Who reviews it?
When would you reject or override its recommendation?
Can you show me an example where the AI recommendation was challenged?
The last question may be particularly informative when an organization claims meaningful human oversight.
Evidence
An auditor should neither accept AI-generated information automatically because it comes from sophisticated technology nor reject it automatically because a machine generated it.
The fundamental audit question remains:
Is the evidence sufficient, reliable, and relevant to support the conclusion?
Auditors Do Not Need to Become AI Engineers
Most management-system auditors do not need to become machine-learning specialists.
They need sufficient competence to recognize where AI matters, understand associated risks, evaluate management controls, and recognize when specialized technical expertise is required.
Auditing Human Oversight
An approval field labelled “Reviewed by Human” does not by itself demonstrate meaningful control.
Auditors may need to establish whether the reviewer understands limitations, can independently evaluate the output, possesses authority to reject it, and actually exercises professional judgment.
Auditors increasingly need to distinguish between human presence and human control.
Auditing Change
A process map may appear unchanged from the previous year while the AI supporting it has changed significantly.
Useful future audit questions may therefore include:
“What has changed in the AI components supporting this process since the last evaluation?”
When Auditors Use AI
Auditors themselves will increasingly use AI to review documents, identify inconsistencies, organize evidence, analyze trends, and develop questions.
The same accountability principle applies to them:
Tasks may be delegated to AI; professional accountability cannot.
This creates an interesting symmetry.
Auditors will increasingly use AI to audit organizations that themselves use AI.
Future auditor competence may therefore include not only knowing how to use AI, but knowing when not to trust it.
9. A Practical QMS–AI Governance Checklist
The following questions are offered as a practical starting point rather than as additional ISO requirements.
- Where is AI being used?
Has the organization identified AI use that can materially influence quality-related outcomes? - What role does AI play?
Is it providing Assistance, Influence, or Decision? - What happens if it is wrong?
What are the potential consequences of inaccurate, incomplete, biased, unavailable, or misleading output? - Who remains accountable?
Are responsibilities for AI-supported decisions clearly established? - Is human oversight meaningful?
Does the reviewer have the competence, authority, information, and time necessary to challenge AI? - Are inputs sufficiently controlled?
Is information provided to AI appropriate and suitable for the intended purpose? - Has the AI been evaluated for its intended use?
What provides confidence that the system is suitable for the specific application? - Are controls proportionate to consequence?
Are higher-impact applications subject to appropriately stronger controls? - Can important decisions be traced?
Can the organization reconstruct what happened, what AI contributed, who reviewed it, and what decision resulted? - Are AI-related changes controlled?
Can changes to models, configurations, integrations, data, use cases, or automation materially alter process performance? - Is performance monitored beyond efficiency?
Are errors, overrides, corrections, complaints, nonconformities, or other relevant outcomes evaluated? - Are failures analyzed systemically?
Does root-cause analysis consider people, AI, data, processes, controls, competence, and management decisions? - Are people competent to challenge AI?
Does AI competence include understanding limitations rather than simply knowing how to operate the technology? - Is relevant AI use included in internal audit?
Where AI materially influences QMS processes, is its role visible within the audit trail? - Does management understand AI dependency?
Does leadership know which processes would be affected if critical AI capability failed or became unreliable?
10. Conclusion — Quality Management in the AI Era
Artificial intelligence is entering organizational processes rapidly.
That does not make decades of quality-management thinking obsolete.
It may make them more important.
As organizations delegate increasing amounts of analysis, classification, recommendation, and decision support to AI, principles such as accountability, competence, process control, risk-based thinking, evidence, performance evaluation, corrective action, and continual improvement remain fundamental.
What changes is the environment in which they operate.
The traditional organizational process has involved people, equipment, information, suppliers, and management controls.
The emerging process increasingly includes another participant:
artificial intelligence.
This creates a management challenge that neither Quality Management nor AI Governance should address entirely in isolation.
ISO 9001 and ISO/IEC 42001 have different purposes, but where AI materially influences quality-related processes, their management disciplines inevitably intersect.
The appropriate response is neither to build excessive controls around every use of AI nor to treat AI as merely another software tool when it has become influential in consequential decisions.
A more practical principle is:
Do not control AI because it is AI. Control its use according to the significance of its impact on the process.
Organizations therefore need to understand where AI is used, how deeply it influences decisions, what could happen when it fails, who remains accountable, what human oversight is necessary, what evidence should remain, and how performance will be evaluated.
Quality professionals and auditors must evolve accordingly.
Future auditors may increasingly follow process trails that move between humans and machines. Quality managers may oversee processes in which part of the analysis is performed by AI. Process owners may become responsible for outcomes generated through combinations of human judgment and machine recommendations.
Yet one principle should remain unchanged:
Organizations may delegate tasks to AI, but they cannot delegate responsibility for the quality of the systems they choose to operate.
The most important question for an AI-enabled organization may therefore not be:
“Are we using AI?”
It may be:
“Do we understand where AI influences our processes—and do we remain in control of the outcomes?”
That is where Quality Management and AI Governance truly meet.
References
- International Organization for Standardization (ISO). ISO 9001:2026 — Quality management systems — Requirements. Sixth edition, published September 2026.
- International Organization for Standardization / International Electrotechnical Commission. ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system. First edition, December 2023.
- National Institute of Standards and Technology (NIST). Artificial Intelligence Risk Management Framework (AI RMF) — Core. In particular, the GOVERN and MAP functions addressing responsibility, competence, human–AI roles, oversight, context, and risk.
- National Institute of Standards and Technology (NIST). AI Risk Management Framework — Human–AI Interaction. Discussion of differentiated human roles, decision-making, oversight, autonomy, and human cognitive factors.
- National Institute of Standards and Technology (NIST). AI RMF Playbook. Guidance concerning human oversight, organizational accountability, training, and evaluation of oversight in high-risk settings.
- Organisation for Economic Co-operation and Development (OECD). OECD AI Principles — Human-centred values and fairness. Human agency and oversight as context-appropriate safeguards.
- Organisation for Economic Co-operation and Development (OECD). OECD AI Principles — Accountability. Accountability, traceability, systematic risk management, and lifecycle considerations for AI actors.
Author’s Note
The concepts AI Assistance / AI Influence / AI Decision, Human–AI System Failure, AI Dependency Mapping, and the proposed framework:
Business Process → AI Role → Risk & Impact → Human Oversight → Control → Evidence → Performance → Improvement
are presented in this article as practical management concepts developed by the author. They should not be interpreted as terminology or additional requirements established by ISO 9001:2026, ISO/IEC 42001:2023, NIST, or OECD.