Cross-reference
ISO/IEC 42001
65 items: 48 met directly by a control at Level 3, 17 partly, 0 deliberately out of scope.
| Ref | Item (our description) | Controls | Note |
|---|---|---|---|
| 4.1 | Understand the organisation's context and the issues that affect its AI aims | STR-05 partial, STR-01 partial | Horizon scanning and strategy alignment cover external and internal issues; no control asks for an explicit context analysis for AI governance. |
| 4.2 | Identify interested parties and their requirements | STR-07 direct, RSK-04 partial | |
| 4.3 | Define the scope of AI governance | GOV-01 direct, STR-02 partial | GOV-01 Level 3 requires the policy to state what AI governance covers. |
| 4.4 | Establish and run the AI management system as a whole | GOV-04 partial, MON-07 partial | Met by operating the framework as a whole rather than by one control. |
| 5.1 | Top management commitment and support | GOV-02 direct, STR-03 partial | |
| 5.2 | Set and communicate an AI policy | GOV-01 direct | |
| 5.3 | Make clear who does what in AI governance, and with what authority | GOV-02 direct, GOV-05 direct, GOV-03 partial | |
| 6.1.1 | Address risks and opportunities; set AI risk criteria | RSK-01 direct, RSK-02 partial | |
| 6.1.2 | Assess AI risks | RSK-02 direct | |
| 6.1.3 | Treat AI risks and justify the controls chosen | RSK-02 direct, RSK-07 partial | RSK-02 Level 3 requires the treatment and the controls applied to be recorded with reasons, which serves as the statement of applicability. |
| 6.1.4 | Have a process for AI system impact assessment | RSK-03 direct | |
| 6.2 | Set measurable AI objectives and plan to achieve them | STR-01 direct, STR-06 partial, MON-01 partial | |
| 6.3 | Plan changes to the management system in a controlled way | STR-08 partial | Strategy review covers changing direction; no control covers controlled change to the governance arrangements themselves. |
| 7.1 | Provide the resources needed | STR-03 direct, OPM-01 partial | |
| 7.2 | Ensure competence | PPL-04 direct, PPL-05 direct, PPL-03 partial | |
| 7.3 | Ensure awareness of the policy and of each person's part in it | PPL-01 direct, CUL-02 partial | |
| 7.4 | Plan internal and external communication | CUL-02 direct, GOV-09 partial | |
| 7.5 | Keep governance records current, approved and findable | GOV-01 direct, DAT-06 partial | GOV-01 Level 3 requires governance documents to be approved, version-controlled and retained; DAT-06 covers AI records. |
| 8.1 | Plan and control operational processes | POR-04 direct, GOV-03 partial, OPM-07 partial | |
| 8.2 | Carry out AI risk assessments at planned intervals and on change | RSK-02 direct, MON-05 partial | |
| 8.3 | Implement the risk treatment plan | RSK-02 direct, RSK-07 partial | Covered through RSK-02's treatment record, as for 6.1.3. |
| 8.4 | Assess the effects of each AI system on people and society | RSK-03 direct | |
| 9.1 | Check how well AI governance is working, using evidence | MON-01 direct, MON-02 direct, MON-03 partial | |
| 9.2 | Audit the management system internally | MON-05 direct, MON-07 partial | MON-05 Level 3 requires the AI governance arrangements as a whole to be independently audited on a set cycle, with findings owned and tracked; MON-07 re-runs this assessment. |
| 9.3 | Top management reviews the management system | MON-08 direct, GOV-04 partial | |
| 10.1 | Improve continually | MON-07 direct, GOV-08 partial | |
| 10.2 | Fix failures to follow the system, and their causes | GOV-08 partial, MON-04 partial | Exceptions and incidents are covered; no control requires root-cause analysis and corrective action for nonconformities generally. |
| A.2.2 | Document an AI policy | GOV-01 direct | |
| A.2.3 | Align the AI policy with other organisational policies | GOV-07 direct | |
| A.2.4 | Review the AI policy | GOV-01 direct | |
| A.3.2 | Define and allocate AI roles and responsibilities | GOV-05 direct, GOV-02 partial | |
| A.3.3 | A route to report concerns about AI | CUL-04 direct | |
| A.4.2 | Document the resources AI activities need | GOV-06 partial, OPM-01 partial, STR-06 partial | The inventory records each use and links it to its models, data sets and integrations (GOV-06), and the roadmap names the capability, data and technology capacity planned uses depend on (STR-06); documenting the other resources per system and lifecycle stage (tooling, compute, people) is system-level detail. |
| A.4.3 | Document data resources | GOV-06 direct, DAT-08 partial, DAT-04 partial | GOV-06 Level 3 links each inventory entry to the data sets it uses, and DAT-08 records each data set's source, collection method, rights and use limits, so the data resources of each use are documented; DAT-04 catalogues meaning, coverage and limits. |
| A.4.4 | Document tooling resources | TEC-01 partial | TEC-01 lists approved tools, where AI is built in house, the environments and toolchains used to build, test and run it, each with an owner and support. Recording which tooling each system uses is system-level and not required. |
| A.4.5 | Document system and computing resources | TEC-02 partial, TEC-03 partial, STR-06 partial | Architecture and hosting are governed (TEC-02, TEC-03), and the roadmap names the compute and storage capacity planned uses depend on (STR-06); per-system compute records are system-level. |
| A.4.6 | Document people and competences involved | PPL-04 partial, GOV-05 partial | Skills are assessed by role (PPL-04) and owners are named (GOV-05); per-system records of the people and competences involved are system-level. |
| A.5.2 | A process to assess impacts on people and society | RSK-03 direct | |
| A.5.3 | Document and retain impact assessment results | RSK-03 partial, DAT-06 partial | RSK-03 requires the assessment; keeping documented results for a defined period is implied, not explicit (DAT-06 covers AI records generally). |
| A.5.4 | Assess impacts on individuals and groups | RSK-03 direct, RSK-06 partial | |
| A.5.5 | Weigh effects on society and the environment | RSK-03 direct | RSK-03 widened to societal and environmental effects. |
| A.6.1.2 | Goals that steer how AI is built responsibly | RSK-05 partial, OPM-06 partial | Adopted principles (RSK-05) and delivery standards (OPM-06) guide development; documented objectives for responsible development are not explicit. |
| A.6.1.3 | Defined processes for responsible design and development | OPM-06 direct, POR-04 partial | |
| A.6.2.2 | Specify requirements for new or materially changed systems | POR-05 partial, OPM-06 partial | The business case (POR-05) and delivery standards (OPM-06) capture the need; documented system requirements are system-level. |
| A.6.2.3 | Document design and development | OPM-06 partial, TEC-05 partial, POR-04 partial | Delivery standards and release control imply design records, and POR-04 keeps a record of key design decisions and assumptions for each use, updated at each gate; full design and development documentation for each system is system-level. |
| A.6.2.4 | Verification and validation measures and criteria | TEC-06 direct | |
| A.6.2.5 | Deployment plan and pre-deployment requirements | POR-04 partial, POR-07 partial, TEC-05 partial | Stage gates (POR-04), pilot-to-production criteria (POR-07) and release control (TEC-05) cover go-live; a documented deployment plan is not explicit. |
| A.6.2.6 | Operation and monitoring, repairs, updates and support | OPM-07 direct, MON-02 direct, TEC-05 partial | |
| A.6.2.7 | Technical documentation for each kind of interested party | TEC-05 direct, RSK-08 partial, GOV-09 partial | TEC-05 Level 3 requires documentation for each version suited to users, operators and regulators. |
| A.6.2.8 | Keep event logs, at least when in use | MON-02 direct, DAT-06 partial | MON-02 Level 3 requires event logging while in use. |
| A.7.2 | Data management processes for development | DAT-01 direct, DAT-08 partial, DAT-02 partial, DAT-03 partial | DAT-01 Level 3 backs the data strategy with an approved data architecture covering how data used by AI is taken in, stored, organised and maintained, with shared definitions, and DAT-08 records provenance and the preparation and labelling steps applied to each data set. Ownership (DAT-02) and quality requirements (DAT-03) complete the documented data management processes. |
| A.7.3 | Record how data is acquired and selected | DAT-08 direct | |
| A.7.4 | Data quality requirements met | DAT-03 direct | |
| A.7.5 | Record data provenance | DAT-08 direct | |
| A.7.6 | Criteria and methods for data preparation | DAT-08 direct, DAT-03 partial | DAT-08 Level 3 records the preparation and labelling steps applied to each data set used to train, tune or test AI, and how synthetic and augmented data were generated and checked; DAT-03 quality requirements for each use give the criteria the prepared data must meet. Choosing particular preparation techniques is system-level. |
| A.8.2 | Give users the information they need | TEC-05 direct, RSK-08 partial, PPL-08 partial, GOV-09 partial | TEC-05 Level 3 requires documentation for each version, suited to users, stating intended purpose and users, how it works, inputs and outputs, known limitations and where it must not be relied on, and PPL-08 tool guidance states limitations, failure modes and residual risks. RSK-08 explains to affected people and GOV-09 publishes records. |
| A.8.3 | A way for others to report adverse impacts | MON-06 partial, RSK-08 partial | Feedback (MON-06) and challenge (RSK-08) give routes in; a route specifically for reporting adverse impacts is not explicit. |
| A.8.4 | A plan for telling users about incidents | MON-09 direct | MON-09 Level 3 includes a plan for telling affected people about serious incidents, alongside notification routes for suppliers and regulators. Telling users about lesser incidents is not explicit. |
| A.8.5 | Know and meet reporting obligations to interested parties | RSK-04 direct, GOV-09 partial | |
| A.9.2 | Ways of working that keep use of AI responsible | GOV-01 partial, PPL-08 partial, RSK-05 partial | Policy, principles and staff support shape responsible use; documented processes for responsible use are spread across controls rather than explicit. |
| A.9.3 | Goals that steer how AI is used responsibly | RSK-05 partial, STR-02 partial | Principles (RSK-05) and strategic boundaries (STR-02), which name the kinds of decision that must always be taken by a person, set direction; documented objectives for responsible use are not explicit. |
| A.9.4 | Use AI only as intended | MON-02 direct, TEC-06 partial, GOV-03 partial | MON-02 Level 3 monitors each use against its defined operating conditions, as well as AI from others against the provider's instructions for use; TEC-06 defines those conditions and enforces them by limits, and GOV-03 approval sets the purpose. |
| A.10.2 | Allocate responsibilities with partners, suppliers and customers | OPM-04 direct, GOV-05 partial | |
| A.10.3 | Suppliers align with the responsible approach | RSK-09 direct, OPM-05 partial | |
| A.10.4 | Consider customer expectations and needs | CUL-08 partial, MON-06 partial | Public and customer trust (CUL-08) and feedback (MON-06) consider expectations; building customer needs into the responsible approach is not explicit. |
References and short descriptions only; see the source publication for its own text. The cross-reference is the author's interpretation and is not endorsed by the publisher. See notices.