Frameworks / ISO_42001
ISO/IEC 42001:2023 — AI Management Systems
ISO/IEC · International · effective 2023-12-01 · ISO_42001
Certifiable management-system standard. Certification evidences process, not model quality.
9 controls, mapped to the evidence that satisfies each
Every control links to the dimension whose evidence would satisfy it. That mapping is the working link between an obligation written in law or a standard and a document somebody has to produce. Each row has its own address: link to a single control.
| Control | Title | Requirement | Satisfied by |
|---|---|---|---|
| A.4 | Resources for AI systems | The resources the AI system depends on — data, tooling, compute, human competence — are identified and documented. | D1 |
| A.8 | Information for interested parties of AI systems | Information needed by users, affected parties and other interested parties is determined and provided. | D1 |
| A.7 | Data for AI systems | Data used by the AI system is managed: its sources, provenance, quality and preparation are recorded. | D5 |
| A.2 | Policies related to AI | An AI policy is established, approved, communicated and reviewed. | D6 |
| A.3 | Internal organization | Roles, responsibilities and reporting lines for the AI management system are defined and allocated. | D6 |
| A.6 | AI system life cycle | The AI system is developed, deployed, changed and retired under a defined and documented life cycle. | D6 |
| A.9 | Use of AI systems | Responsible use of the AI system is defined, including intended use and what use is not permitted. | D6 |
| A.10 | Third-party and customer relationships | Responsibilities are allocated and understood across suppliers, partners and customers in the AI supply chain. | D7 |
| A.5 | Assessing impacts of AI systems | Impacts of the AI system on individuals, groups and society are assessed and documented. | D7 |
What this mapping is, and what it is not
It is a reading of a published instrument, with each control cited to its source, mapped to the kind of evidence that would satisfy it. It is not legal advice, not a certification, and not a statement that any organisation complies with anything. Where an instrument is not yet in force, this page says so rather than selling urgency.
Talk to the person who built this
If you assess clients against this instrument, the mapping is the part you can check line by line. There is no sales team: this is founder-led, so it reaches the founder directly. Tenant access is $500 a month, and free early access to the method, the corpus and the router is on offer first if that is useful. If it is not a fit, saying so costs you one reply.