Question · ISO/IEC 42001 · Annex A
How does ISO 42001 Annex A map to an AI audit?
Annex A lists 38 reference controls grouped under 9 control objectives (A.2 to A.10), from AI policy through data, lifecycle and third-party relationships.
01 / The answer
The short answer
Annex A is the control list a certification auditor checks an AI management system against. In the commonly reported count it has 9 control objectives (A.2 to A.10) and 38 controls, covering AI policy, internal organization, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party relationships. The organization must compare its risk treatment with every control and justify any exclusion. The auditor tests the controls it includes; a missing or unjustified control is a nonconformity. Only an accredited certification body can certify.
02 / The rule
What ISO/IEC 42001 · Annex A requires
Annex A lists 38 reference controls grouped under 9 control objectives (A.2 to A.10), from AI policy through data, lifecycle and third-party relationships. It is the auditable control surface of a 42001 certification: organizations pick the controls their AI risk treatment needs and record the choices in a Statement of Applicability.
- 01Compare AI risk treatment against all Annex A controls and record included and excluded controls with justification.
- 02Maintain AI policies and internal roles (A.2, A.3) and document resources: data, tools, compute, people (A.4).
- 03Assess impacts of AI systems on individuals, groups and society, and document the assessments (A.5).
- 04Define and document the AI system lifecycle: requirements, design, verification and validation, deployment, operation and monitoring (A.6).
03 / Records
Records to keep
- 01Statement of Applicability covering all 38 Annex A controls
- 02AI system impact assessment documents
- 03Lifecycle records: verification and validation results, deployment and monitoring plans
- 04Data provenance and data quality records for training and evaluation data
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
IEC Webstore (ISO/IEC JTC 1/SC 42)
International Organization for Standardization
RiskProfs
RELATED