A.2 Policies related to AI
The three Annex A controls that set management direction for AI: a documented AI policy, its alignment with other organizational policies, and its periodic review.
ISO 42001
ISO/IEC 42001:2023 AI management system: the 38 Annex A controls for governing how organizations develop, provide and use AI systems, grouped by control objective, with audit evidence, open-source tooling and certification guides.
A.3 Internal organization
The two Annex A controls that establish accountability inside the organization for AI: defined AI roles and responsibilities, and a process for raising concerns about AI systems.
A.4 Resources for AI systems
The five Annex A controls for documenting the resources an AI system depends on: an overall resource record plus data, tooling, system and computing, and human resources.
A.5 Assessing impacts of AI systems
The four Annex A controls for AI system impact assessment: the assessment process, its documentation, and the separate assessment of impacts on individuals or groups and on society.
A.6 AI system life cycle
The nine Annex A controls for responsible AI system development and the life cycle: objectives and processes for responsible design, then requirements, design records, verification and validation, deployment, operation, technical documentation and event logs.
A.7 Data for AI systems
The five Annex A controls for the data behind AI systems: data management processes, acquisition, data quality, provenance and data preparation.
A.8 Information for interested parties of AI systems
The four Annex A controls for information flows about AI systems: documentation for users, external reporting of adverse impacts, incident communication and reporting obligations to interested parties.
A.9 Use of AI systems
The three Annex A controls for using AI systems responsibly: processes for responsible use, objectives that guide use, and keeping use within the system's intended purpose.
A.10 Third-party and customer relationships
The three Annex A controls for AI across organizational boundaries: allocating life cycle responsibilities, managing suppliers of AI products and services, and meeting customer expectations.
ISO 42001 for AI companies and SaaS
ISO 42001 for organizations whose products build on or include AI: startups, SaaS adding AI features, organizations that only use AI, model providers, and answering customer AI governance questionnaires.
ISO 42001 requirements: clauses 4 to 10
The management system clauses of ISO 42001 that every certified organization must meet: context and scope, AI policy and roles, AI risk and impact assessment, objectives, competence, documented information, internal audit and management review.
ISO 42001 certification and audits
Getting ISO 42001 certified and keeping it: readiness and gap analysis, the evidence auditors ask for, stage 1 and stage 2, timelines, surveillance and recertification, and accreditation of ISO 42001 certification bodies.
ISO 42001 related standards and regulations
The standards and rules ISO 42001 works with: the ISO/IEC AI standards family, ISO/IEC 23894 risk guidance, ISO/IEC 27090 AI security guidance, and GDPR and privacy requirements for AI systems that process personal data.
ISO 42001 consultants and services
Buying outside help for ISO 42001: what consultants and implementation partners do, what must stay with the organization, independence from the certification body, and who should own AI governance internally.
ISO 42001 tools and cloud infrastructure
The infrastructure side of ISO 42001: open-source tools that keep AI governance evidence, building on AWS or Microsoft AI services and using their certificates, and AI security testing as evidence.
ISO 42001 by industry
How ISO 42001 applies where AI use is regulated or high-stakes: healthcare, financial services and insurance, HR and recruiting, and the public sector, with the EU AI Act rules that drive each.
ISO 42001 guides
Questions organizations ask when a customer, contract or regulator points them to ISO/IEC 42001: cost, the certification process, choosing a certification body, impact assessment, combining it with ISO 27001, and how it relates to the EU AI Act and the NIST AI RMF.
