Framework
ISO/IEC 42001:2023 (AI)
ISO/IEC 42001:2023 Annex A (AI Management System)
38 requirements · 14 connected unified controls
Open ISO/IEC 42001:2023 (AI) in the mapRequirements and control mappings
“Full” and “Partial” describe the catalog mapping to a unified control. A partial mapping includes the remaining requirement. These mappings do not establish an organization’s implementation or certification.
Policies related to AI
| Requirement | Unified control and mapping |
|---|---|
| A.2.2AI policy | |
| A.2.3Alignment with other organizational policies | |
| A.2.4Review of the AI policy |
Internal organization
| Requirement | Unified control and mapping |
|---|---|
| A.3.2AI roles and responsibilities | |
| A.3.3Reporting of concerns |
Resources for AI systems
| Requirement | Unified control and mapping |
|---|---|
| A.4.2Resource documentation | |
| A.4.3Data resources | |
| A.4.4Tooling resources | |
| A.4.5System and computing resources | |
| A.4.6Human resources |
Assessing impacts of AI systems
| Requirement | Unified control and mapping |
|---|---|
| A.5.2AI system impact assessment process | |
| A.5.3Documentation of AI system impact assessments | |
| A.5.4Assessing AI system impact on individuals or groups of individuals | |
| A.5.5Assessing societal impacts of AI systems |
AI system life cycle
| Requirement | Unified control and mapping |
|---|---|
| A.6.1.2Objectives for responsible development of AI systems | |
| A.6.1.3Processes for responsible AI system design and development | |
| A.6.2.2AI system requirements and specification | |
| A.6.2.3Documentation of AI system design and development | |
| A.6.2.4AI system verification and validation | |
| A.6.2.5AI system deployment | |
| A.6.2.6AI system operation and monitoring | |
| A.6.2.7AI system technical documentation | |
| A.6.2.8AI system recording of event logs |
Data for AI systems
| Requirement | Unified control and mapping |
|---|---|
| A.7.2Data for development and enhancement of AI systems | |
| A.7.3Acquisition of data | |
| A.7.4Data quality for AI systems | |
| A.7.5Data provenance | |
| A.7.6Data preparation |
Information for interested parties of AI systems
| Requirement | Unified control and mapping |
|---|---|
| A.8.2System documentation and information for users | |
| A.8.3External reporting | |
| A.8.4Communication of incidents | |
| A.8.5Information for interested parties |
Use of AI systems
| Requirement | Unified control and mapping |
|---|---|
| A.9.2Processes for responsible use of AI systems | |
| A.9.3Objectives for responsible use of AI systems | |
| A.9.4Intended use of the AI system |
Third-party and customer relationships
| Requirement | Unified control and mapping |
|---|---|
| A.10.2Allocating responsibilities | |
| A.10.3Suppliers | |
| A.10.4Customers |