ISO/IEC 42001:2023
Govern your AI, not just your data
The first international AI management system standard. 39 Annex A controls across policy, internal organisation, resources, impacts, the AI life cycle, data and third parties are instantiated per workspace — with a Statement of Applicability, an AI-system register and AI-system impact assessments. Readiness is scored over the controls you deem applicable.
39
Annex A controls
SoA
applicability-driven
AI register
+ impact assessments
- 39 Annex A controls + SoA
- AI-system register
- AI-system impact assessments
- Management-system clauses + readiness
What’s in the module
The first AI management system standard, modelled properly
39 Annex A controls across areas A.2–A.10, plus the management-system clauses 4–10 tailored to AI — not a generic policy template.
- 01
39 Annex A controls + SoA
Controls across areas A.2–A.10 with applicability, justification and status. Exclude what does not apply; readiness scores over applicable controls only.
- 02
AI-system register
A first-class inventory of the AI systems you build or use, linked to the controls and impact assessments that govern them.
- 03
AI-system impact assessments
Structured impact assessments for each AI system, with an AI drafter that proposes a first version from the system’s context for a person to review.
- 04
Management-system clauses + readiness
Clauses 4–10 tailored to AI (AI policy, AI risk assessment and treatment) for the audit wizard, plus an AI readiness analyser that verdicts each control.
Beyond the controls
The surfaces an AI governance programme actually needs
Statement of Applicability
ISO 42001 is a Statement-of-Applicability standard. Every Annex A control carries applicability, justification and status; exclude what doesn’t apply to how you build or use AI, and readiness scores over the applicable set only.
AI-system register
A first-class inventory of the AI systems you build or procure — each linked to the controls that govern it and the impact assessment that documents its risks.
AI-system impact assessments
Structured impact assessments per AI system, with an AI drafter that proposes a first version from the system’s context and scope for a person to review and own.
AI readiness analyser
Per-control verdicts — ready, partial or gap — with the cited evidence behind them, persisted as snapshots so you can watch readiness move as you close gaps.
See ISO 42001 readiness on your AI
Register your AI systems, run an impact assessment, and watch the readiness analyser verdict each control — live.