Planisphere Download for Mac

Medicine · ISO/IEC 42001 · Annex A

ISO/IEC 42001 · Annex A for clinical AI workflows

ISO/IEC 42001 · Annex A in clinical AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceVoluntary; normative for organizations certifying to ISO/IEC 42001
Applies from18 Dec 2023
SectorMedicine
Checked21 Oct 2026

01 / The rule

What ISO/IEC 42001 · Annex A requires

Organizations operating an ISO/IEC 42001 AI management system, which must compare their risk treatment against these controls and justify any exclusions.

  1. 01Compare AI risk treatment against all Annex A controls and record included and excluded controls with justification.
  2. 02Maintain AI policies and internal roles (A.2, A.3) and document resources: data, tools, compute, people (A.4).
  3. 03Assess impacts of AI systems on individuals, groups and society, and document the assessments (A.5).
  4. 04Define and document the AI system lifecycle: requirements, design, verification and validation, deployment, operation and monitoring (A.6).
  5. 05Manage data for AI systems: acquisition, quality, provenance and preparation (A.7).
  6. 06Inform interested parties, govern intended use of AI systems, and manage supplier and customer responsibilities (A.8–A.10).

02 / In this sector

In a clinical AI workflow

AI-specific. Each control addresses an AI concern such as impact assessment, model verification and validation, data provenance, or responsible use of AI systems.

Usually asked by

Clinical committees and health system AI governance.

Named alongside

HHS §1557 · HIPAA · FDA PCCP.

Sector pagePlanisphere for medicine

03 / Records

Records to keep

  1. 01Statement of Applicability covering all 38 Annex A controls
  2. 02AI system impact assessment documents
  3. 03Lifecycle records: verification and validation results, deployment and monitoring plans
  4. 04Data provenance and data quality records for training and evaluation data

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

SECONDARY

RELATED

Related: ISO/IEC 42001 · Annex A: the full guide · ISO/IEC 42001 · Annex A for defense · ISO/IEC 42001 · Annex A for law · ISO/IEC 42001 · Annex A for education