ISO/IEC 42001:2023 AI management system¶

This page covers ISO_IEC_42001, a pack of 65 requirements: the management-system clauses 4 to 10 and the Annex A controls of ISO/IEC 42001:2023. The standard is voluntary and has no legal application dates. Nothing here is an audit, a certification or a legal assessment.

What it is¶

A native pack. Each row has the clause or control id as printed, a short heading and a one-line note in this project's own words, starting Evidence that. The standard's text is not reproduced; buy the standard for it. Links to the EU AI Act, ISO/IEC 27001 and NIST AI RMF are the project's own judgement at low confidence.

Does it apply to you¶

The pack asks four questions in the manifest under framework_inputs.ISO_IEC_42001:

With no answers the pack reads voluntary. Confirm with your adviser.

How rows are decided¶

Every row takes a provider attestation. 39 of 65 requirements checked from evidence as well: files and conventions in the repository corroborate the attestation. 26 of 65 are attestation only. The target is 28 of 65; the pack is above it. A scaffold left unfilled does not count as evidence. A row reads Met, Partial, Missing or Unverified.

Requirements¶

Scaffolds¶

Starting documents are written into the repository on request: a management-system scope statement, an AI policy, an objectives record and a statement of applicability. Templates cover data records, lifecycle evidence and management-system records, and an impact assessment section. The impact assessment scaffold is shared with the other packs of the ai_lifecycle family. They have _fill in_ placeholders and are drafts, not legal advice.

Timeline¶

This pack has no timeline: a standard without legal application dates.

Gate in CI¶

opencomplai check --target ISO_IEC_42001 --gate ISO_IEC_42001 --gate-fail-on missing --repo-root .

The command exits 1 and lists the requirement ids when a row at the chosen level is found.

What stays attested and why¶

26 rows have no evidence a tool can read, and only a person can vouch for them. They are the rows where the evidence is a decision, a role, a meeting or a judgement rather than a file:

• Management-system clauses: 4.1, 4.2, 4.4, 5.1, 5.3, 6.1.1, 6.3, 7.1, 7.3, 7.4, 7.5, 8.1, 10.1 (context, interested parties, leadership, roles, planning of changes, resources, awareness, communication, documented information, operational control, improvement).
• Annex A controls: A.2.3, A.2.4, A.3.2, A.3.3, A.4.4, A.4.5, A.6.1.3, A.6.2.5, A.7.6, A.8.3, A.9.3, A.10.2, A.10.4 (policy alignment and review, roles and reporting of concerns, tooling and computing resources, deployment, data preparation, external reporting, responsible-use objectives, allocation of responsibilities and customers).

Review status¶

Every row is flagged mapping not yet reviewed. No flag has been cleared.

Disclaimer¶

Evidence found gives Met, Partial or Missing, not a legal conclusion. This pack is not an audit, a certification or legal advice; ask a qualified lawyer about your own duties.