International · international standard
ISO/IEC 42001 · Annex A: what it asks, and the records to keep
Annex A lists 38 reference controls grouped under 9 control objectives (A.2 to A.10), from AI policy through data, lifecycle and third-party relationships. It is the auditable control surface of a 42001 certification: organizations pick the controls their AI risk treatment needs and record the choices in a Statement of Applicability.
01 / What it asks
What ISO/IEC 42001 · Annex A asks
Organizations operating an ISO/IEC 42001 AI management system, which must compare their risk treatment against these controls and justify any exclusions.
- 01Compare AI risk treatment against all Annex A controls and record included and excluded controls with justification.
- 02Maintain AI policies and internal roles (A.2, A.3) and document resources: data, tools, compute, people (A.4).
- 03Assess impacts of AI systems on individuals, groups and society, and document the assessments (A.5).
- 04Define and document the AI system lifecycle: requirements, design, verification and validation, deployment, operation and monitoring (A.6).
- 05Manage data for AI systems: acquisition, quality, provenance and preparation (A.7).
- 06Inform interested parties, govern intended use of AI systems, and manage supplier and customer responsibilities (A.8–A.10).
02 / AI work
Where it touches AI work
AI-specific. Each control addresses an AI concern such as impact assessment, model verification and validation, data provenance, or responsible use of AI systems.
03 / Dates
The dates that matter
Annex A published with ISO/IEC 42001:2023
ISO/IEC 42006:2025 published for certification bodies
04 / Enforcement
Who enforces it
None; voluntary. Certification auditors test implemented controls; a missing or unjustified control is a nonconformity.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Statement of Applicability covering all 38 Annex A controls
- 02AI system impact assessment documents
- 03Lifecycle records: verification and validation results, deployment and monitoring plans
- 04Data provenance and data quality records for training and evaluation data
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
How does ISO 42001 Annex A map to an AI audit?+
Annex A is the control list a certification auditor checks an AI management system against. In the commonly reported count it has 9 control objectives (A.2 to A.10) and 38 controls, covering AI policy, internal organization, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party relationships. The organization must compare its risk treatment with every control and justify any exclusion. The auditor tests the controls it includes; a missing or unjustified control is a nonconformity. Only an accredited certification body can certify. Read the full answer
SOURCES
Go back to the source
IEC Webstore (ISO/IEC JTC 1/SC 42)
International Organization for Standardization
RiskProfs
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: ISO/IEC 42001 · SLSA v1.0 · SCITT · GMLP