ISO/IEC 42001:2023 · Annex A
The ISO 42001 controls list: all 38 Annex A controls
A plain-language line on what every control of the AI management system standard is asking for. Free to read. Generate your Statement of Applicability in minutes with StandardOS.
Already running ISO 27001? Clauses 4 to 10 are the Harmonized Structure, the same spine, so most of your management-system records count towards both. See what we cover, clause by clause.
Policies for AI
3The controls about writing down the organization's position on AI: what it will and will not use AI for, and how that position stays current as the systems change.
Roles and internal governance
2The controls about who inside the organization is accountable for AI, and how decisions about it get made and escalated.
Resources behind an AI system
5The controls about what an AI system is built from: the data, the tooling, the compute and the people, and knowing what you actually depend on.
Effects on people and society
4The controls about consequences to people and to society, as distinct from consequences to the organization. This is the group with no ISO 27001 counterpart, and the reason a 42001 risk assessment asks questions a security one does not.
The life of an AI system
9The controls about an AI system from design through to retirement: how it is specified, verified, released, monitored in use, and eventually withdrawn.
- A.6.1.2What responsible development means here, stated as objectives
- A.6.1.3Design and development processes that carry those objectives
- A.6.2.2Writing down what the AI system must do before building it
- A.6.2.3A record of how the system was designed and built
- A.6.2.4Testing that the system does what was specified
- A.6.2.5Releasing an AI system deliberately rather than by default
- A.6.2.6Watching a live AI system, and acting when it drifts
- A.6.2.7Technical documentation for the people who need to understand it
- A.6.2.8Logging what an AI system did, so it can be reconstructed
Data used by AI systems
5The controls about the data an AI system learns from and operates on: where it came from, what quality it is, and what it is permitted to be used for.
What you tell people outside
4The controls about what the organization tells people outside it: what a system does, how it was built, and how somebody affected by it can raise a concern.
Using AI responsibly
3The controls about using AI responsibly once it is running: what it may be used for, who may use it, and what oversight sits between the system and a decision that affects somebody.
Suppliers and customers
3The controls about AI you did not build and AI you supply to others: what you require of a provider, and what your own customers are entitled to know.
Every one of the 38 in your Statement of Applicability
Adopt ISO 42001 and all 38 Annex A controls land in your Statement of Applicability. Each carries a justification drafted from your own risk register, where a risk names that control. It stays marked as a draft until you have made it yours. Clauses 4 to 10 are the Harmonized Structure, so the records you keep for ISO 27001 count towards both.