What ISO/IEC 42001 asks of your AI software
ISO/IEC 42001 sets requirements for an organization's AI management system. Learn what auditors may ask of your AI tools and what evidence software can supply for that system.
By Halo Research Team
ISO/IEC 42001, published in 2023, is a standard for an AI management system, the set of policies, roles, processes, and controls that an organization uses to manage its AI responsibly. Organizations can be audited and certified against it.
Certification applies to the management system of an organization. A software product plays a supporting role, by producing records and applying controls that the management system depends on.
That makes the useful question about any AI tool a practical one. What evidence can it supply?
This article offers a general overview, and nothing in it is legal or certification advice. Your certification body and advisors interpret the standard for your scope.
What a management system standard asks
Like other ISO management system standards, ISO/IEC 42001 organizes requirements around the context of the organization, leadership, planning, support, operation, performance evaluation, and improvement. In plain terms, it asks an organization to do the following.
- Define the scope of the AI management system and who it serves.
- Set an AI policy and assign roles and responsibilities.
- Assess AI risks and impacts, and plan how to treat them.
- Provide the resources, competence, and documented information the system needs.
- Operate controls over AI systems across their life cycle, including data and suppliers.
- Monitor, measure, audit internally, and review results with management.
- Correct problems and improve over time.
The standard also includes reference controls that organizations consider when they plan how to treat AI risks.
Where your AI software shows up in an audit
Auditors sample evidence. They ask how the organization knows what AI it has, who approved it, how it is controlled, and what happened when something went wrong. Your AI software is one source for those answers.
| Area | A question you may hear | Evidence software can supply |
|---|---|---|
| Scope and inventory | Which AI systems are in scope, and who owns them? | An AI inventory export with classification, source, and confidence |
| Policy and roles | Which policy applies, and who approved it? | Versioned policy bundles and configuration change records |
| Operation and controls | How are controls applied to AI systems in use? | Gateway decisions with allow, deny, and alert outcomes and explanations |
| Oversight | Who approved higher-impact actions? | Approval and denial records |
| Third parties | Which providers and tools do you depend on? | An AI BOM listing models and tools |
| Monitoring | How do you measure activity and cost? | Dashboards with audit statistics, decision timeseries, and cost analytics |
| Incidents and improvement | What happened, and what changed afterward? | Audit logs and configuration change history |
Software supplies records. The management system, and the judgment inside it, stays with your organization.
An example of an audit sample
For example, an auditor might ask how your team approved a new AI tool last quarter. The team exports the inventory entry with its classification and source, the policy version that applied, and the approval record. The auditor then follows that trail back to the management system's own risk assessment and the person who signed off.
The tool supplied the dated records, and the team supplied the reasoning. Both are needed for the sample to hold up.
Decide the scope first
Scope controls how much evidence you need. A management system can cover one product line, one business unit, or the whole organization, and the choice shapes which AI systems and tools fall inside it.
Record the boundary, the reasoning, and the date. Then mark each inventory entry as in scope or out of scope, so an auditor can see the line and the reason for it.
Keep life cycle records
The standard asks organizations to manage AI systems across their life cycle. For software you use, that translates into change records.
Note when a model, a tool, or a policy changed, who approved the change, and whether a fresh review followed. Configuration change history and versioned policies make those records easier to produce.
What software cannot supply
Some parts of the management system live in people and documents. Leadership sets and approves the AI policy. The organization defines its risk criteria, decides its scope, runs impact assessments, trains staff, conducts internal audits, and holds management reviews.
Those activities belong to people, and a tool can feed them with data.
Questions to ask any AI software vendor
Use these questions when AI software falls inside the scope of your management system.
- Can I export the records in a format my auditor can read, such as CSV or JSON?
- Can I show which policy version applied on a given date?
- Does a record name the agent, the user, the tool, and the decision?
- What happens to evidence when a control is offline or returns an error?
- How long are records kept, and who can read them?
- If the vendor cites a certification, which organization holds it, what does it cover, and who issued it?
The post on what happens when an AI control goes offline is a good companion for the fourth question.
Build the records you will need
Start with the few records that the others depend on.
- Inventory. It comes first, since scope depends on it.
- Policy record. Versions and owners come second.
- Decision log. It comes third and ties actions to those policies.
With those in place, impact assessments, supplier reviews, and internal audits have something to cite. Keep each record dated and scoped to a system and version. Note when a record stops applying, such as when an agent gains a new tool.
How Halo helps
Halo records evidence that supports governance programs aligned to ISO/IEC 42001. It provides an AI inventory with AI BOM export, policy as code with versioned bundles, approvals, and audit logs that export as CSV and JSON. Halo does not automate compliance mapping or make an organization certified or compliant, so the management system and its decisions stay with your team. Read about ISO/IEC 42001 and AI compliance evidence.