ISO/IEC 42001:2023 (AI management system)
Version: 2023
ISO/IEC 42001 specifies requirements for an artificial intelligence management system (AIMS) for organizations that develop, provide or use AI systems. This catalog covers the management system clauses 4 to 10 and the 38 Annex A reference controls.
Where we stand
Controls
95%
Evidence
8%
Policies
54%
24 of 65 clauses mapped to adopted controls
As of (just now)
Percentages are over clauses mapped to at least one adopted control. Unmapped clauses are listed below and never count as passing. A known gap is a clause that applies to us and that no control covers yet.
Clause-by-clause readiness
| Clause | Title | Controls | Evidence | Policies | Last tested |
|---|---|---|---|---|---|
| 4 Context of the organization | |||||
| 4.1 | Understanding the organization and its context | Unmapped | Unmapped | Unmapped | Not yet |
| 4.2 | Understanding the needs and expectations of interested parties | Unmapped | Unmapped | Unmapped | Not yet |
| 4.3 | Determining the scope of the AI management system | Unmapped | Unmapped | Unmapped | Not yet |
| 4.4 | AI management system Controls: BIZ-14 | Passing | Not current | Not approved | Not yet |
| 5 Leadership | |||||
| 5.1 | Leadership and commitment Controls: BIZ-12 | Passing | Not current | Approved | Not yet |
| 5.2 | AI policy | Unmapped | Unmapped | Unmapped | Not yet |
| 5.3 | Roles, responsibilities and authorities Controls: BIZ-15 | Passing | Not current | Not approved | Not yet |
| 6.1 Actions to address risks and opportunities | |||||
| 6.1.1 | General Controls: BIZ-04, BIZ-05 | Passing | Not current | Not approved | (4 mo ago) |
| 6.1.2 | AI risk assessment Controls: BIZ-04 | Passing | Not current | Not approved | Not yet |
| 6.1.3 | AI risk treatment Controls: BIZ-05, BIZ-07 | Passing | Not current | Not approved | (4 mo ago) |
| 6.1.4 | AI system impact assessment | Unmapped | Unmapped | Unmapped | Not yet |
| 6 Planning | |||||
| 6.2 | AI objectives and planning to achieve them | Unmapped | Unmapped | Unmapped | Not yet |
| 6.3 | Planning of changes | Unmapped | Unmapped | Unmapped | Not yet |
| 7 Support | |||||
| 7.1 | Resources | Unmapped | Unmapped | Unmapped | Not yet |
| 7.2 | Competence | Unmapped | Unmapped | Unmapped | Not yet |
| 7.3 | Awareness Controls: PEOPLE-04, PEOPLE-06 | Not passing | Current | Approved | (8 h ago) |
| 7.4 | Communication | Unmapped | Unmapped | Unmapped | Not yet |
| 7.5 | Documented information | Unmapped | Unmapped | Unmapped | Not yet |
| 8 Operation | |||||
| 8.1 | Operational planning and control Controls: BIZ-07, BIZ-08, PDP-02 | Passing | Not current | Not approved | (23 d ago) |
| 8.2 | AI risk assessment | Unmapped | Unmapped | Unmapped | Not yet |
| 8.3 | AI risk treatment Controls: BIZ-05, BIZ-09 | Passing | Not current | Not approved | (4 mo ago) |
| 8.4 | AI system impact assessment | Unmapped | Unmapped | Unmapped | Not yet |
| 9 Performance evaluation | |||||
| 9.1 | Monitoring, measurement, analysis and evaluation Controls: BIZ-08 | Passing | Not current | Approved | Not yet |
| 9.2 | Internal audit | Unmapped | Unmapped | Unmapped | Not yet |
| 9.3 | Management review | Unmapped | Unmapped | Unmapped | Not yet |
| 10 Improvement | |||||
| 10.1 | Continual improvement Controls: BIZ-09 | Passing | Not current | Approved | Not yet |
| 10.2 | Nonconformity and corrective action Controls: BIZ-09 | Passing | Not current | Approved | Not yet |
| A.2 Policies related to AI | |||||
| A.2.2 | AI policy | Unmapped | Unmapped | Unmapped | Not yet |
| A.2.3 | Alignment with other organizational policies Controls: IT-01 | Passing | Not current | Approved | Not yet |
| A.2.4 | Review of the AI policy | Unmapped | Unmapped | Unmapped | Not yet |
| A.3 Internal organization | |||||
| A.3.2 | AI roles and responsibilities Controls: BIZ-15 | Passing | Not current | Not approved | Not yet |
| A.3.3 | Reporting of concerns | Unmapped | Unmapped | Unmapped | Not yet |
| A.4 Resources for AI systems | |||||
| A.4.2 | Resource documentation | Unmapped | Unmapped | Unmapped | Not yet |
| A.4.3 | Data resources | Unmapped | Unmapped | Unmapped | Not yet |
| A.4.4 | Tooling resources | Unmapped | Unmapped | Unmapped | Not yet |
| A.4.5 | System and computing resources Controls: IT-05 | Passing | Not current | Not approved | Not yet |
| A.4.6 | Human resources | Unmapped | Unmapped | Unmapped | Not yet |
| A.5 Assessing impacts of AI systems | |||||
| A.5.2 | AI system impact assessment process | Unmapped | Unmapped | Unmapped | Not yet |
| A.5.3 | Documentation of AI system impact assessments | Unmapped | Unmapped | Unmapped | Not yet |
| A.5.4 | Assessing AI system impact on individuals or groups of individuals | Unmapped | Unmapped | Unmapped | Not yet |
| A.5.5 | Assessing societal impacts of AI systems | Unmapped | Unmapped | Unmapped | Not yet |
| A.6.1 Management guidance for AI system development | |||||
| A.6.1.2 | Objectives for responsible development of AI system | Unmapped | Unmapped | Unmapped | Not yet |
| A.6.1.3 | Processes for responsible AI system design and development | Unmapped | Unmapped | Unmapped | Not yet |
| A.6.2 AI system life cycle | |||||
| A.6.2.2 | AI system requirements and specification Controls: PDP-01 | Passing | Not current | Approved | (4 mo ago) |
| A.6.2.3 | Documentation of AI system design and development Controls: PDP-06 | Passing | Current | Approved | (4 mo ago) |
| A.6.2.4 | AI system verification and validation | Unmapped | Unmapped | Unmapped | Not yet |
| A.6.2.5 | AI system deployment Controls: PDP-02, PDP-05 | Passing | Not current | Not approved | (23 d ago) |
| A.6.2.6 | AI system operation and monitoring Controls: CUST-01 | Passing | Not current | Approved | (4 mo ago) |
| A.6.2.7 | AI system technical documentation Controls: CUST-03 | Passing | Not current | Approved | Not yet |
| A.6.2.8 | AI system recording of event logs | Unmapped | Unmapped | Unmapped | Not yet |
| A.7 Data for AI systems | |||||
| A.7.2 | Data for development and enhancement of AI system | Unmapped | Unmapped | Unmapped | Not yet |
| A.7.3 | Acquisition of data | Unmapped | Unmapped | Unmapped | Not yet |
| A.7.4 | Quality of data for AI systems | Unmapped | Unmapped | Unmapped | Not yet |
| A.7.5 | Data provenance | Unmapped | Unmapped | Unmapped | Not yet |
| A.7.6 | Data preparation | Unmapped | Unmapped | Unmapped | Not yet |
| A.8 Information for interested parties of AI systems | |||||
| A.8.2 | System documentation and information for users Controls: CUST-03 | Passing | Not current | Approved | Not yet |
| A.8.3 | External reporting Controls: CUST-01 | Passing | Not current | Approved | (4 mo ago) |
| A.8.4 | Communication of incidents | Unmapped | Unmapped | Unmapped | Not yet |
| A.8.5 | Information for interested parties | Unmapped | Unmapped | Unmapped | Not yet |
| A.9 Use of AI systems | |||||
| A.9.2 | Processes for responsible use of AI systems | Unmapped | Unmapped | Unmapped | Not yet |
| A.9.3 | Objectives for responsible use of AI system | Unmapped | Unmapped | Unmapped | Not yet |
| A.9.4 | Intended use of the AI system | Unmapped | Unmapped | Unmapped | Not yet |
| A.10 Third-party and customer relationships | |||||
| A.10.2 | Allocating responsibilities Controls: CUST-02 | Passing | Not current | Approved | Not yet |
| A.10.3 | Suppliers Controls: VEND-03 | Passing | Not current | Not approved | Not yet |
| A.10.4 | Customers | Unmapped | Unmapped | Unmapped | Not yet |