ISO 42001:2023 Annex A — all 38 controls
A plain-English line on what every control of the AI management system standard is asking for. Free to read — generate your Statement of Applicability in minutes with StandardOS.
Already running ISO 27001? Clauses 4 to 10 are the Harmonized Structure — the same spine — so most of your management-system records count towards both. See what we cover, clause by clause.
Policies for AI · 3
Roles and internal governance · 2
Resources behind an AI system · 5
Effects on people and society · 4
The life of an AI system · 9
- A.6.1.2What responsible development means here, stated as objectives
- A.6.1.3Design and development processes that carry those objectives
- A.6.2.2Writing down what the AI system must do before building it
- A.6.2.3A record of how the system was designed and built
- A.6.2.4Testing that the system does what was specified
- A.6.2.5Releasing an AI system deliberately rather than by default
- A.6.2.6Watching a live AI system, and acting when it drifts
- A.6.2.7Technical documentation for the people who need to understand it
- A.6.2.8Logging what an AI system did, so it can be reconstructed