Skip to main content

ISO/IEC 42001 Guidance Catalog

This page renders a Gemara GuidanceCatalog that re-expresses the structure of ISO/IEC 42001:2023 — its AIMS management-system clauses and Annex A reference controls — as guidelines with stable identifiers such as iso42001-6.1.2 and iso42001-A.9.4. Controls, policies and evaluations elsewhere in this site can cite those identifiers instead of restating requirements.

Paraphrase, not normative text

Statement text is a non-authoritative paraphrase written for interoperability. It does not reproduce ISO normative wording and is not a substitute for a licensed copy of ISO/IEC 42001:2023. For the requirement-by-requirement comparison against Ten Factor Governance, see the ISO/IEC 42001 Analysis.

GuidanceCatalogStandardv0.1.0draft
This catalog re-expresses the operable structure of ISO/IEC 42001:2023 as Gemara guidelines so that Governance Twins, controls, policies, sensitive activities and evaluations can cite stable identifiers (for example iso42001-6.1.2 or iso42001-A.9.4). COPYRIGHT NOTICE: ISO/IEC 42001 is a copyrighted ISO/IEC publication. This file intentionally uses paraphrased objectives and statements rather than copying normative ISO text. For conformity assessment and audit, always consult a licensed copy of ISO/IEC 42001:2023 and any applicable amendments. Annex A control titles follow the publicly documented control set; control purposes here are concise paraphrases suitable for machine-readable mapping, not ISO control wording. Scope of this catalog: Clauses 4–10 management-system requirements and the 38 Annex A reference controls across A.2–A.10. Clauses 1–3 (scope, normative references, terms and definitions) and informative Annexes B–D are omitted because they do not define the core operable requirements/reference-control set represented here. Annex A controls are reference controls considered during AI risk treatment; they are not automatically applicable to every AI system. Applicability should be determined through the organisation’s risk-treatment process and recorded in its Statement of Applicability.

Exemptions

Clauses 1–3 (Scope, Normative references, Terms and definitions)

These clauses define document scope, references and vocabulary rather than operable AIMS guidelines; terms should live in a shared lexicon if needed.

Annex B — Implementation guidance for AI controls

Annex B provides implementation guidance for Annex A controls rather than additional reference controls. Represent it as companion guidance if implementation-level detail is needed.

Redirect: ISO/IEC 42001:2023 Annex B

Annex C — Potential AI-related organizational objectives and risk sources

Annex C provides informative examples of objectives and risk sources. These are better represented as companion risk/threat catalogs rather than requirements in this GuidanceCatalog.

Redirect: ISO/IEC 42001:2023 Annex C

Annex D — Use of the AI management system across domains or sectors

Annex D provides informative guidance on applying the AIMS with other management systems and sector/domain requirements.

Redirect: ISO/IEC 42001:2023 Annex D

Showing 70 of 70

Context of the organization

Clause 4 — organisational context, interested parties, AIMS scope and the AI management system itself.

iso42001-4.1Understanding the organization and its context
Objective

Determine internal and external issues relevant to the organisation’s purpose and its ability to achieve the intended outcomes of the AIMS.

Statements
  • iso42001-4.1.1

    Identify and maintain awareness of internal and external issues relevant to the AIMS and its intended outcomes.

  • iso42001-4.1.2

    Consider whether climate change is a relevant issue when applying the current harmonized management-system requirement.

iso42001-4.2Understanding the needs and expectations of interested parties
Objective

Identify interested parties relevant to the AIMS and determine their relevant requirements.

Statements
  • iso42001-4.2.1

    Identify interested parties relevant to the AIMS.

  • iso42001-4.2.2

    Determine the requirements of those interested parties that are relevant to the AIMS, including applicable legal, regulatory and contractual requirements.

  • iso42001-4.2.3

    Consider that relevant interested parties may have requirements related to climate change.

iso42001-4.3Determining the scope of the AI management system
Objective

Define and document the boundaries and applicability of the AIMS, taking account of context, interested-party requirements and the organisation’s role in relation to AI systems.

Statements
  • iso42001-4.3.1

    Determine the boundaries and applicability of the AIMS using the organisation’s context and relevant interested-party requirements.

  • iso42001-4.3.2

    Consider the organisation’s activities, products and services, and its role as developer, provider or user of AI systems, as applicable.

  • iso42001-4.3.3

    Maintain the AIMS scope as documented information.

iso42001-4.4AI management system
Objective

Establish, implement, maintain and continually improve an AIMS, including the processes needed and their interactions.

Statements
  • iso42001-4.4.1

    Establish, implement, maintain and continually improve the AIMS in accordance with the requirements of ISO/IEC 42001.

  • iso42001-4.4.2

    Determine the processes needed for the AIMS and how those processes interact.

Leadership

Clause 5 — leadership commitment, AI policy, and roles/responsibilities/authorities.

iso42001-5.1Leadership and commitment
Objective

Ensure top management demonstrates leadership and commitment for the AIMS.

Statements
  • iso42001-5.1.1

    Ensure the AI policy and AI objectives are established and compatible with the organisation’s strategic direction.

  • iso42001-5.1.2

    Integrate AIMS requirements into organisational processes.

  • iso42001-5.1.3

    Ensure resources needed for the AIMS are available.

  • iso42001-5.1.4

    Communicate the importance of effective AI management and conformity with AIMS requirements.

  • iso42001-5.1.5

    Ensure the AIMS achieves its intended outcomes.

  • iso42001-5.1.6

    Direct and support persons contributing to AIMS effectiveness.

  • iso42001-5.1.7

    Promote continual improvement and support relevant management roles.

iso42001-5.2AI policy
Objective

Establish, maintain and communicate an AI policy appropriate to the organisation and its AI-related purpose.

Statements
  • iso42001-5.2.1

    Establish an AI policy appropriate to the organisation’s purpose and providing a framework for AI objectives.

  • iso42001-5.2.2

    Include commitments to satisfy applicable requirements and continually improve the AIMS.

  • iso42001-5.2.3

    Maintain the AI policy as documented information, communicate it within the organisation, and make it available to relevant interested parties as appropriate.

iso42001-5.3Organizational roles, responsibilities and authorities
Objective

Assign and communicate responsibilities and authorities for roles relevant to the AIMS.

Statements
  • iso42001-5.3.1

    Assign responsibility and authority for ensuring the AIMS conforms to ISO/IEC 42001 requirements.

  • iso42001-5.3.2

    Assign responsibility and authority for reporting AIMS performance to top management.

  • iso42001-5.3.3

    Ensure relevant AI responsibilities and authorities are assigned and communicated within the organisation.

Planning

Clause 6 — risks and opportunities, AI risk assessment and treatment, AI system impact assessment, objectives and planned changes.

iso42001-6.1.1Actions to address risks and opportunities — General
Objective

Plan actions addressing risks and opportunities so the AIMS can achieve intended outcomes, prevent or reduce undesired effects and improve.

Statements
  • iso42001-6.1.1.1

    Consider organisational context and interested-party requirements when determining AIMS risks and opportunities.

  • iso42001-6.1.1.2

    Determine actions to address identified risks and opportunities, integrate those actions into AIMS processes, and evaluate their effectiveness.

iso42001-6.1.2AI risk assessment
Objective

Define and apply an AI risk assessment process that produces consistent, valid and comparable results.

Statements
  • iso42001-6.1.2.1

    Establish and maintain AI risk criteria, including criteria for risk acceptance and for performing AI risk assessments.

  • iso42001-6.1.2.2

    Identify AI risks associated with development, provision or use of AI systems within the AIMS scope.

  • iso42001-6.1.2.3

    Analyse identified AI risks by considering potential consequences and likelihood, and determine risk levels.

  • iso42001-6.1.2.4

    Evaluate analysed risks against established criteria and prioritize them for treatment.

  • iso42001-6.1.2.5

    Retain documented information about the AI risk assessment process and results.

iso42001-6.1.3AI risk treatment
Objective

Define and apply a process for selecting and implementing treatments for AI risks.

Statements
  • iso42001-6.1.3.1

    Select appropriate AI risk treatment options based on risk assessment results.

  • iso42001-6.1.3.2

    Determine controls necessary to implement the selected treatment options and compare them with Annex A to verify that necessary controls have not been omitted.

  • iso42001-6.1.3.3

    Produce a Statement of Applicability identifying necessary controls, their implementation status, and justification for inclusion or exclusion of Annex A controls.

  • iso42001-6.1.3.4

    Formulate an AI risk treatment plan and obtain designated management approval for the plan and acceptance of residual AI risk.

  • iso42001-6.1.3.5

    Retain documented information about AI risk treatment.

iso42001-6.1.4AI system impact assessment
Objective

Define a process for assessing potential consequences of AI systems for individuals, groups and societies.

Statements
  • iso42001-6.1.4.1

    Assess potential consequences arising from deployment, intended use and foreseeable misuse of AI systems.

  • iso42001-6.1.4.2

    Consider the technical and societal context of deployment and applicable jurisdictions.

  • iso42001-6.1.4.3

    Document impact-assessment results and make them available to relevant interested parties where appropriate.

  • iso42001-6.1.4.4

    Use impact-assessment results as an input to AI risk assessment.

iso42001-6.2AI objectives and planning to achieve them
Objective

Establish measurable AI objectives at relevant functions and levels and plan how they will be achieved.

Statements
  • iso42001-6.2.1

    Ensure AI objectives are consistent with the AI policy, take account of applicable requirements, and are measurable where practicable.

  • iso42001-6.2.2

    Monitor, communicate, update and document AI objectives.

  • iso42001-6.2.3

    Determine actions, required resources, responsible persons, timing and evaluation methods for achieving AI objectives.

iso42001-6.3Planning of changes
Objective

Carry out necessary changes to the AIMS in a planned manner.

Statements
  • iso42001-6.3.1

    Plan changes to the AIMS before implementation and manage them in a controlled manner.

Support

Clause 7 — resources, competence, awareness, communication and documented information.

iso42001-7.1Resources
Objective

Determine and provide resources needed to establish, implement, maintain and continually improve the AIMS.

Statements
  • iso42001-7.1.1

    Determine and provide the resources required for effective operation and continual improvement of the AIMS.

iso42001-7.2Competence
Objective

Ensure persons whose work affects AI performance have the necessary competence.

Statements
  • iso42001-7.2.1

    Determine necessary competence for persons doing work under organisational control that affects AI performance.

  • iso42001-7.2.2

    Ensure competence through appropriate education, training or experience.

  • iso42001-7.2.3

    Take action to acquire necessary competence where needed and evaluate effectiveness of those actions.

  • iso42001-7.2.4

    Retain documented evidence of competence.

iso42001-7.3Awareness
Objective

Ensure relevant persons understand the AI policy, their contribution to AIMS effectiveness and consequences of nonconformity.

Statements
  • iso42001-7.3.1

    Ensure persons are aware of the AI policy and relevant AI objectives.

  • iso42001-7.3.2

    Ensure persons understand their contribution to AIMS effectiveness and the benefits of improved AI performance.

  • iso42001-7.3.3

    Ensure persons understand the implications of not conforming to AIMS requirements.

iso42001-7.4Communication
Objective

Determine internal and external communications relevant to the AIMS.

Statements
  • iso42001-7.4.1

    Determine what to communicate, when, with whom, how and by whom for communications relevant to the AIMS.

iso42001-7.5.1Documented information — General
Objective

Maintain documented information required by ISO/IEC 42001 and additional information necessary for AIMS effectiveness.

Statements
  • iso42001-7.5.1.1

    Include documented information required by ISO/IEC 42001.

  • iso42001-7.5.1.2

    Include additional documented information determined by the organisation to be necessary for AIMS effectiveness.

iso42001-7.5.2Creating and updating documented information
Objective

Ensure documented information is appropriately identified, formatted, reviewed and approved.

Statements
  • iso42001-7.5.2.1

    Apply appropriate identification and description to documented information.

  • iso42001-7.5.2.2

    Use appropriate formats and media.

  • iso42001-7.5.2.3

    Review and approve documented information for suitability and adequacy.

iso42001-7.5.3Control of documented information
Objective

Control AIMS documented information so it is available, suitable and protected.

Statements
  • iso42001-7.5.3.1

    Ensure documented information is available and suitable for use where and when needed.

  • iso42001-7.5.3.2

    Protect documented information against inappropriate use, loss of integrity or other compromise.

  • iso42001-7.5.3.3

    Control distribution, access, retrieval, use, storage, preservation, changes, retention and disposition as applicable.

  • iso42001-7.5.3.4

    Identify and control external documented information needed for AIMS planning and operation.

Operation

Clause 8 — operational planning and control, operational AI risk assessment/treatment, and AI system impact assessment.

iso42001-8.1Operational planning and control
Objective

Plan, implement and control processes needed to meet AIMS requirements and implement planned risk and opportunity actions.

Statements
  • iso42001-8.1.1

    Establish operating criteria for relevant processes and control those processes in accordance with the criteria.

  • iso42001-8.1.2

    Retain sufficient documented information to have confidence that processes were carried out as planned.

  • iso42001-8.1.3

    Control planned changes and review unintended changes, taking action to mitigate adverse effects where necessary.

  • iso42001-8.1.4

    Ensure externally provided processes, products or services relevant to the AIMS are appropriately controlled.

iso42001-8.2AI risk assessment
Objective

Perform AI risk assessments at planned intervals and when significant changes are proposed or occur.

Statements
  • iso42001-8.2.1

    Perform AI risk assessments using the process and criteria established under Clause 6.1.2.

  • iso42001-8.2.2

    Reassess AI risk when significant changes could affect previously assessed risks.

  • iso42001-8.2.3

    Retain documented information on AI risk assessment results.

iso42001-8.3AI risk treatment
Objective

Implement the AI risk treatment plan and retain evidence of the results.

Statements
  • iso42001-8.3.1

    Implement planned AI risk treatments.

  • iso42001-8.3.2

    Retain documented information about the results of AI risk treatment.

iso42001-8.4AI system impact assessment
Objective

Perform AI system impact assessments according to the defined process and retain the results.

Statements
  • iso42001-8.4.1

    Perform impact assessments for AI systems within scope where required by the organisation’s impact-assessment process.

  • iso42001-8.4.2

    Update impact assessments when relevant changes affect potential impacts.

  • iso42001-8.4.3

    Retain documented results of AI system impact assessments.

Performance evaluation

Clause 9 — monitoring/measurement, internal audit and management review.

iso42001-9.1Monitoring, measurement, analysis and evaluation
Objective

Determine and perform monitoring, measurement, analysis and evaluation needed to assess AI performance and AIMS effectiveness.

Statements
  • iso42001-9.1.1

    Determine what needs to be monitored and measured and the methods needed to ensure valid results.

  • iso42001-9.1.2

    Determine when monitoring and measurement occur and when results are analysed and evaluated.

  • iso42001-9.1.3

    Determine who performs analysis and evaluation.

  • iso42001-9.1.4

    Evaluate AI performance and effectiveness of the AIMS.

  • iso42001-9.1.5

    Retain documented evidence of monitoring and measurement results.

iso42001-9.2.1Internal audit — General
Objective

Conduct internal audits at planned intervals to determine conformity and effective implementation of the AIMS.

Statements
  • iso42001-9.2.1.1

    Determine whether the AIMS conforms to the organisation’s own requirements and to ISO/IEC 42001 requirements.

  • iso42001-9.2.1.2

    Determine whether the AIMS is effectively implemented and maintained.

iso42001-9.2.2Internal audit programme
Objective

Plan, establish, implement and maintain an internal audit programme.

Statements
  • iso42001-9.2.2.1

    Define audit frequency, methods, responsibilities, planning requirements and reporting.

  • iso42001-9.2.2.2

    Consider process importance, relevant changes and previous audit results when planning audits.

  • iso42001-9.2.2.3

    Define audit criteria and scope for each audit.

  • iso42001-9.2.2.4

    Select auditors and conduct audits to ensure objectivity and impartiality.

  • iso42001-9.2.2.5

    Report audit results to relevant management, take appropriate correction/corrective action, and retain evidence of the audit programme and results.

iso42001-9.3.1Management review — General
Objective

Top management reviews the AIMS at planned intervals to ensure continuing suitability, adequacy and effectiveness.

Statements
  • iso42001-9.3.1.1

    Conduct management reviews of the AIMS at planned intervals.

iso42001-9.3.2Management review inputs
Objective

Management review considers relevant information about the state, performance and changing context of the AIMS.

Statements
  • iso42001-9.3.2.1

    Consider status of actions from previous management reviews.

  • iso42001-9.3.2.2

    Consider changes in internal and external issues and interested-party requirements relevant to the AIMS.

  • iso42001-9.3.2.3

    Consider AIMS performance trends, including nonconformities, corrective actions, monitoring results and audit results.

  • iso42001-9.3.2.4

    Consider opportunities for continual improvement and other information needed to judge AIMS effectiveness.

iso42001-9.3.3Management review results
Objective

Record decisions and actions arising from management review.

Statements
  • iso42001-9.3.3.1

    Determine decisions related to continual improvement opportunities and any need for AIMS changes.

  • iso42001-9.3.3.2

    Retain documented information as evidence of management review results.

Improvement

Clause 10 — continual improvement and nonconformity/corrective action.

iso42001-10.1Continual improvement
Objective

Continually improve the suitability, adequacy and effectiveness of the AIMS.

Statements
  • iso42001-10.1.1

    Use evaluation, review and operational learning to continually improve the AIMS.

iso42001-10.2Nonconformity and corrective action
Objective

Respond to nonconformities, address causes and prevent recurrence.

Statements
  • iso42001-10.2.1

    React to nonconformity, control and correct it, and address resulting consequences.

  • iso42001-10.2.2

    Evaluate the need for action to eliminate causes so the nonconformity does not recur or occur elsewhere.

  • iso42001-10.2.3

    Implement needed action and review its effectiveness.

  • iso42001-10.2.4

    Update risks/opportunities or the AIMS when necessary.

  • iso42001-10.2.5

    Retain documented evidence of the nonconformity, actions taken and corrective-action results.

Annex A — Policies related to AI

A.2 — management direction and support for AI systems through policy.

iso42001-A.2.2A.2.2 AI policy
Objective

Document and maintain policy governing the organisation’s development or use of AI systems.

Statements
  • iso42001-A.2.2.1

    Document and maintain policy governing the organisation’s development or use of AI systems.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.2.3A.2.3 Alignment with other organizational policies
Objective

Identify where existing organisational policies apply to or are affected by AI objectives and align them appropriately.

Statements
  • iso42001-A.2.3.1

    Identify where existing organisational policies apply to or are affected by AI objectives and align them appropriately.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.2.4A.2.4 Review of the AI policy
Objective

Review the AI policy periodically and when needed to ensure it remains suitable, adequate and effective.

Statements
  • iso42001-A.2.4.1

    Review the AI policy periodically and when needed to ensure it remains suitable, adequate and effective.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.

Annex A — Internal organization

A.3 — accountability, AI roles and reporting of concerns.

iso42001-A.3.2A.3.2 AI roles and responsibilities
Objective

Define and allocate roles and responsibilities needed for responsible implementation, operation and management of AI systems.

Statements
  • iso42001-A.3.2.1

    Define and allocate roles and responsibilities needed for responsible implementation, operation and management of AI systems.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.3.3A.3.3 Reporting of concerns
Objective

Provide a process for reporting concerns about the organisation’s role and responsibilities regarding AI systems throughout their life cycle.

Statements
  • iso42001-A.3.3.1

    Provide a process for reporting concerns about the organisation’s role and responsibilities regarding AI systems throughout their life cycle.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.

Annex A — Resources for AI systems

A.4 — identification and documentation of data, tooling, compute and human resources.

iso42001-A.4.2A.4.2 Resource documentation
Objective

Identify and document resources needed for relevant AI system life-cycle stages and other AI-related activities.

Statements
  • iso42001-A.4.2.1

    Identify and document resources needed for relevant AI system life-cycle stages and other AI-related activities.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.4.3A.4.3 Data resources
Objective

Document relevant information about data resources used by AI systems so associated risks and impacts can be understood and managed.

Statements
  • iso42001-A.4.3.1

    Document relevant information about data resources used by AI systems so associated risks and impacts can be understood and managed.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.4.4A.4.4 Tooling resources
Objective

Document relevant information about AI tooling resources, including models, algorithms, software and development or evaluation tools.

Statements
  • iso42001-A.4.4.1

    Document relevant information about AI tooling resources, including models, algorithms, software and development or evaluation tools.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.4.5A.4.5 System and computing resources
Objective

Document relevant system and computing resources needed to develop, operate, monitor or support AI systems.

Statements
  • iso42001-A.4.5.1

    Document relevant system and computing resources needed to develop, operate, monitor or support AI systems.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.4.6A.4.6 Human resources
Objective

Identify and provide human resources and expertise needed for responsible AI activities throughout relevant life-cycle stages.

Statements
  • iso42001-A.4.6.1

    Identify and provide human resources and expertise needed for responsible AI activities throughout relevant life-cycle stages.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.

Annex A — Assessing impacts of AI systems

A.5 — processes and records for assessing impacts on people and society.

iso42001-A.5.2A.5.2 AI system impact assessment process
Objective

Establish a process to assess potential consequences of AI systems for individuals, groups and society throughout relevant life-cycle stages.

Statements
  • iso42001-A.5.2.1

    Establish a process to assess potential consequences of AI systems for individuals, groups and society throughout relevant life-cycle stages.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.5.3A.5.3 Documentation of AI system impact assessments
Objective

Document AI system impact-assessment results and retain them for an appropriate defined period.

Statements
  • iso42001-A.5.3.1

    Document AI system impact-assessment results and retain them for an appropriate defined period.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.5.4A.5.4 Assessing AI system impact on individuals or groups of individuals
Objective

Assess and document potential effects of AI systems on individuals or groups throughout the AI system life cycle.

Statements
  • iso42001-A.5.4.1

    Assess and document potential effects of AI systems on individuals or groups throughout the AI system life cycle.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.5.5A.5.5 Assessing societal impacts of AI systems
Objective

Assess and document potential societal impacts of AI systems throughout the AI system life cycle.

Statements
  • iso42001-A.5.5.1

    Assess and document potential societal impacts of AI systems throughout the AI system life cycle.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.

Annex A — AI system life cycle

A.6 — responsible design, development, verification, deployment, operation, documentation and logging.

iso42001-A.6.1.2A.6.1.2 Objectives for responsible development of AI system
Objective

Identify and document objectives that guide responsible development of AI systems and take those objectives into account during development.

Statements
  • iso42001-A.6.1.2.1

    Identify and document objectives that guide responsible development of AI systems and take those objectives into account during development.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.6.1.3A.6.1.3 Processes for responsible AI system design and development
Objective

Define and document processes for responsible design and development of AI systems.

Statements
  • iso42001-A.6.1.3.1

    Define and document processes for responsible design and development of AI systems.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.6.2.2A.6.2.2 AI system requirements and specification
Objective

Specify and document requirements for AI systems, including relevant functional, performance, risk, impact and responsible-AI requirements.

Statements
  • iso42001-A.6.2.2.1

    Specify and document requirements for AI systems, including relevant functional, performance, risk, impact and responsible-AI requirements.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.6.2.3A.6.2.3 Documentation of AI system design and development
Objective

Document AI system design and development sufficiently to support responsible implementation, review and life-cycle management.

Statements
  • iso42001-A.6.2.3.1

    Document AI system design and development sufficiently to support responsible implementation, review and life-cycle management.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.6.2.4A.6.2.4 AI system verification and validation
Objective

Define and perform verification and validation appropriate to AI system requirements, risks and intended use before and during deployment as needed.

Statements
  • iso42001-A.6.2.4.1

    Define and perform verification and validation appropriate to AI system requirements, risks and intended use before and during deployment as needed.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.6.2.5A.6.2.5 AI system deployment
Objective

Plan and control deployment of AI systems, including relevant readiness criteria, approvals and changes.

Statements
  • iso42001-A.6.2.5.1

    Plan and control deployment of AI systems, including relevant readiness criteria, approvals and changes.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.6.2.6A.6.2.6 AI system operation and monitoring
Objective

Define and document the processes and elements needed for responsible operation and monitoring of AI systems.

Statements
  • iso42001-A.6.2.6.1

    Define and document the processes and elements needed for responsible operation and monitoring of AI systems.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.6.2.7A.6.2.7 AI system technical documentation
Objective

Maintain technical documentation needed to understand, operate, assess and manage AI systems throughout their life cycle.

Statements
  • iso42001-A.6.2.7.1

    Maintain technical documentation needed to understand, operate, assess and manage AI systems throughout their life cycle.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.6.2.8A.6.2.8 AI system recording of event logs
Objective

Determine and implement event logging needed to support traceability, monitoring, incident investigation and accountability.

Statements
  • iso42001-A.6.2.8.1

    Determine and implement event logging needed to support traceability, monitoring, incident investigation and accountability.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.

Annex A — Data for AI systems

A.7 — development data, acquisition, quality, provenance and preparation.

iso42001-A.7.2A.7.2 Data for development and enhancement of AI system
Objective

Define and document processes for managing data used to develop or enhance AI systems.

Statements
  • iso42001-A.7.2.1

    Define and document processes for managing data used to develop or enhance AI systems.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.7.3A.7.3 Acquisition of data
Objective

Define and document how data used by AI systems is acquired, including relevant source, rights, constraints and selection information.

Statements
  • iso42001-A.7.3.1

    Define and document how data used by AI systems is acquired, including relevant source, rights, constraints and selection information.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.7.4A.7.4 Quality of data for AI systems
Objective

Define data-quality requirements relevant to AI systems and establish means to assess whether data meets those requirements.

Statements
  • iso42001-A.7.4.1

    Define data-quality requirements relevant to AI systems and establish means to assess whether data meets those requirements.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.7.5A.7.5 Data provenance
Objective

Establish and document processes for recording the origin, history, transformations and movement of data used by AI systems.

Statements
  • iso42001-A.7.5.1

    Establish and document processes for recording the origin, history, transformations and movement of data used by AI systems.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.7.6A.7.6 Data preparation
Objective

Define and document criteria and methods used to prepare data for AI-system development, evaluation or operation.

Statements
  • iso42001-A.7.6.1

    Define and document criteria and methods used to prepare data for AI-system development, evaluation or operation.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.

Annex A — Information for interested parties

A.8 — user information, external reporting, incident communication and stakeholder information.

iso42001-A.8.2A.8.2 System documentation and information for users
Objective

Provide users with information and documentation needed to understand and use AI systems appropriately, including relevant capabilities and limitations.

Statements
  • iso42001-A.8.2.1

    Provide users with information and documentation needed to understand and use AI systems appropriately, including relevant capabilities and limitations.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.8.3A.8.3 External reporting
Objective

Provide mechanisms for relevant external parties to report adverse impacts, concerns or other issues associated with AI systems.

Statements
  • iso42001-A.8.3.1

    Provide mechanisms for relevant external parties to report adverse impacts, concerns or other issues associated with AI systems.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.8.4A.8.4 Communication of incidents
Objective

Define processes for communicating AI-related incidents to relevant interested parties in a timely and appropriate manner.

Statements
  • iso42001-A.8.4.1

    Define processes for communicating AI-related incidents to relevant interested parties in a timely and appropriate manner.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.8.5A.8.5 Information for interested parties
Objective

Determine and provide information about AI systems needed by relevant interested parties, taking account of their roles and requirements.

Statements
  • iso42001-A.8.5.1

    Determine and provide information about AI systems needed by relevant interested parties, taking account of their roles and requirements.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.

Annex A — Use of AI systems

A.9 — responsible-use processes/objectives and adherence to intended use.

iso42001-A.9.2A.9.2 Processes for responsible use of AI systems
Objective

Define and document processes governing responsible use of AI systems within the organisation.

Statements
  • iso42001-A.9.2.1

    Define and document processes governing responsible use of AI systems within the organisation.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.9.3A.9.3 Objectives for responsible use of AI system
Objective

Identify and document objectives for responsible use of AI systems and incorporate them into operational use.

Statements
  • iso42001-A.9.3.1

    Identify and document objectives for responsible use of AI systems and incorporate them into operational use.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.9.4A.9.4 Intended use of the AI system
Objective

Ensure AI systems are used consistently with their defined intended use and accompanying documentation, and address foreseeable misuse as appropriate.

Statements
  • iso42001-A.9.4.1

    Ensure AI systems are used consistently with their defined intended use and accompanying documentation, and address foreseeable misuse as appropriate.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.

Annex A — Third-party and customer relationships

A.10 — allocation of responsibilities and governance of suppliers and customers.

iso42001-A.10.2A.10.2 Allocating responsibilities
Objective

Allocate and document responsibilities across the AI system life cycle between the organisation and relevant partners, suppliers, customers and other third parties.

Statements
  • iso42001-A.10.2.1

    Allocate and document responsibilities across the AI system life cycle between the organisation and relevant partners, suppliers, customers and other third parties.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.10.3A.10.3 Suppliers
Objective

Establish processes ensuring supplier-provided AI-related products, services and materials align with the organisation’s responsible-AI approach and requirements.

Statements
  • iso42001-A.10.3.1

    Establish processes ensuring supplier-provided AI-related products, services and materials align with the organisation’s responsible-AI approach and requirements.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.
iso42001-A.10.4A.10.4 Customers
Objective

Establish processes addressing customer responsibilities and expectations where the organisation provides AI systems, products or services to customers.

Statements
  • iso42001-A.10.4.1

    Establish processes addressing customer responsibilities and expectations where the organisation provides AI systems, products or services to customers.

Recommendations
  • Select or exclude this reference control through AI risk treatment and record the decision and justification in the Statement of Applicability.
  • Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline where the control is selected.