Use this after the AI inventory exists and before any AI risk or impact work, so those steps know their boundary. You get three documents in a new folder, ./ai-management-system-scope/: the scope document, saying which AI systems, teams and places the AI management system covers and why (scope.md); a who-does-what table for the AI work, using role titles rather than names (roles.md); and the list of decisions leadership still has to make (open-questions.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Leadership approves the scope; the agent proposes it.

Inputs to gather

Read the security management system scope statement, its context and interested parties analysis, the AI register, the organisation chart, the product pages and customer contracts that mention AI, and the list of management system processes that already run (risk, internal audit, document control, incidents, supplier management, management review). Ask the reader, in one message: why the company wants the AI management system (customer demand, regulation, certification, internal control), which AI products customers rely on, who in leadership sponsors it, and whether certification is planned.

Step 1: write the reason into the scope

The reason drives the boundary. If customers ask for it, the AI they buy must be inside. If regulation drives it, the systems the regulation reaches must be inside. If it is internal control, start with the systems that make or support decisions about people. Write the reason in two lines at the top of the scope document (scope.md); every later boundary choice should trace back to it.

Step 2: draw the boundary

Decide and record, each with a reason:

AI systems: name them from the register. Customer-facing AI and AI that affects people go in by default. Internal productivity tools usually go in as use, with lighter treatment, rather than out.
Roles the company plays: building models, offering AI products or services, using AI built by others. Most companies play more than one; run a framework lookup on the role terms the standard uses and map each system to them.
Organisational units, locations and lifecycle stages: the teams that design, train, deploy, operate and retire the systems.

Then reconcile the list line by line against the AI register and explain every gap; the certification auditor will test the scope against the register. Rule of thumb: a scope that leaves out an AI feature on the company's own website will be questioned by the first auditor and the first enterprise customer who reads both.