AI action plan
How AI control gaps become tracked work, with the same mechanism as the other domains.
Same plan, AI scope
The AI action plan uses the same mechanics as the supplier, organizational, and continuity plans — same tasks, same states, same overdue warning. Only the scope changes.
That is worth more here than in the other domains: AI risk is where teams have the least accumulated repertoire, and reusing a flow the team already runs reduces what has to be learned to one thing, which is the content.
Where items come from
Items arise from unmet AI controls — in your self-assessment or in a supplier's assessment — and arrive with their origin context intact, including the control and the standard anchoring it.
That detail matters more in AI than in other pillars. An item that says only "implement guardrails" is a sentence; an item pointing at the control, the AI RMF subcategory, and the matching ISO 42001 clause is a task someone can close and an auditor can check.
Owner and deadline
Every item has an owner and a deadline, and overdue items are flagged without waiting for someone to open the screen. It is the same rule as the other plans, for the same reason: with no overdue notice, an action plan is a list of intentions.