Skip to main content

ISO/IEC 42001 Alignment Matrix

Document Type: Compliance Mapping
Standard Reference: ISO/IEC 42001:2023 - Artificial Intelligence Management System (AIMS)
Framework Version: AI Governance Framework v2.0
Assessment Date: 2026-01-15

1. Executive Summary​

1.1 Alignment Overview​

This matrix demonstrates how the AI Governance Framework aligns with ISO/IEC 42001:2023, the world's first international standard for AI Management Systems (AIMS).

Overall Alignment Score: 95%

ISO/IEC 42001 SectionAlignmentStatus
Clause 4: Context95%✓ Aligned
Clause 5: Leadership100%✓ Aligned
Clause 6: Planning95%✓ Aligned
Clause 7: Support90%✓ Aligned
Clause 8: Operation95%✓ Aligned
Clause 9: Performance Evaluation95%✓ Aligned
Clause 10: Improvement90%✓ Aligned
Annex A Controls (38 total)95%✓ Aligned

1.2 Certification Readiness​

Readiness LevelDescriptionCurrent Status
ReadyAll requirements addressedMost clauses
PartialMinor gaps to addressSome Annex A controls
GapSignificant work neededNone

2. Clause-by-Clause Mapping​

Clause 4: Context of the Organization​

ISO 42001 RequirementFramework ArtifactSectionStatus
4.1 Understanding the organization and its contextOperating Model§1, §2✓
4.2 Understanding needs and expectations of interested partiesCharter§3, §6✓
4.3 Determining the scope of the AIMSOperating Model§2.1, §2.2✓
4.4 AI management systemOperating Model§3, §4, §5✓

Clause 5: Leadership​

ISO 42001 RequirementFramework ArtifactSectionStatus
5.1 Leadership and commitmentCharter§2✓
5.2 AI policyEnterprise PolicyFull document✓
5.3 Organizational roles, responsibilities and authoritiesOperating Model§4, §5✓

Clause 6: Planning​

ISO 42001 RequirementFramework ArtifactSectionStatus
6.1 Actions to address risks and opportunitiesAIA, Risk MatrixFull documents✓
6.1.1 GeneralRisk Matrix§1, §2✓
6.1.2 AI risk assessmentRisk Matrix, AIAFull documents✓
6.1.3 AI risk treatmentAIA§8✓
6.1.4 AI system impact assessmentAIA§2-7✓
6.2 AI objectives and planning to achieve themImplementation Plan§1-3✓

Clause 7: Support​

ISO 42001 RequirementFramework ArtifactSectionStatus
7.1 ResourcesImplementation Plan§4✓
7.2 CompetenceImplementation Plan§3.2✓
7.3 AwarenessEnterprise Policy§5, §6✓
7.4 CommunicationImplementation Plan§3.3✓
7.5 Documented informationSystem Card, AI-BOMFull documents✓

Clause 8: Operation​

ISO 42001 RequirementFramework ArtifactSectionStatus
8.1 Operational planning and controlOperating Model§6✓
8.2 AI system life cycle processesOperating Model§6.1-6.8✓
8.3 Third-party and customer relationshipsThird-Party AI RiskFull document✓
8.4 AI system impact assessmentAIAFull document✓

Clause 9: Performance Evaluation​

ISO 42001 RequirementFramework ArtifactSectionStatus
9.1 Monitoring, measurement, analysis and evaluationContinuous MonitoringFull document✓
9.2 Internal auditOperating Model§9.1✓
9.3 Management reviewOperating Model§9.1✓

Clause 10: Improvement​

ISO 42001 RequirementFramework ArtifactSectionStatus
10.1 Continual improvementImplementation Plan§5✓
10.2 Nonconformity and corrective actionOperating Model§10✓

3. Annex A Control Mapping​

A.2 Policies for AI​

ControlDescriptionFramework CoverageStatus
A.2.2AI policyEnterprise Policy✓
A.2.3Responsible AI useEnterprise Policy §3, §5✓
A.2.4AI ethical principlesCharter §6✓

A.3 Internal Organization​

ControlDescriptionFramework CoverageStatus
A.3.2Roles and responsibilities for AIOperating Model §5✓
A.3.3Reporting relationshipsOperating Model §4✓
A.3.4AI competenceImplementation Plan §3.2✓

A.4 Resources for AI Systems​

ControlDescriptionFramework CoverageStatus
A.4.2Resource managementImplementation Plan §4✓
A.4.3Data managementSystem Card §3✓
A.4.4Tools and systemsOperating Model §8✓
A.4.5Computing resourcesAI-BOM §5.3✓

A.5 Assessing AI Systems​

ControlDescriptionFramework CoverageStatus
A.5.2AI system inventoryIntake Form, AI-BOM✓
A.5.3AI system classificationRisk Matrix✓
A.5.4Third-party relationshipsThird-Party AI Risk✓

A.6 AI System Development​

ControlDescriptionFramework CoverageStatus
A.6.2AI system life cycle managementOperating Model §6✓
A.6.3Requirements specificationIntake Form §3✓
A.6.4Data for AI systemsSystem Card §3✓
A.6.5AI system verification and validationAIA, System Card §5✓
A.6.6AI model selectionRisk Matrix §3✓

A.7 Data for AI Systems​

ControlDescriptionFramework CoverageStatus
A.7.2Data qualitySystem Card §3.1✓
A.7.3Data provenanceAI-BOM §4✓
A.7.4Data preparationSystem Card §3.2✓

A.8 AI System Operation​

ControlDescriptionFramework CoverageStatus
A.8.2Operational proceduresOperating Model §6.5-6.7✓
A.8.3Monitoring and loggingContinuous Monitoring✓
A.8.4Change managementOperating Model §6.6✓
A.8.5AI system retirementOperating Model §6.8✓

A.9 Third-Party and Customer Relationships​

ControlDescriptionFramework CoverageStatus
A.9.2Third-party provider managementThird-Party AI Risk✓
A.9.3Supply chain managementAI-BOM, Third-Party AI Risk✓
A.9.4Customer relationshipsOperating Model §4.3✓

A.10 Use of AI Systems​

ControlDescriptionFramework CoverageStatus
A.10.2Acceptable useEnterprise Policy §5✓
A.10.3AI system guidanceEnterprise Policy §4, §5✓
A.10.4User trainingImplementation Plan §3.2✓

4. Integration with Other Standards​

4.1 ISO/IEC 27001 Integration​

ISO 27001 ControlAI ExtensionFramework Coverage
A.5 Information security policiesAI-specific policiesEnterprise Policy
A.6 Organization of information securityAI governance structureOperating Model
A.8 Asset managementAI system inventoryAI-BOM, Intake Form
A.12 Operations securityAI monitoringContinuous Monitoring
A.14 System developmentAI development lifecycleOperating Model §6
A.15 Supplier relationshipsAI vendor managementThird-Party AI Risk

4.2 SOC 2 Integration​

SOC 2 Trust ServiceAI ConsiderationsFramework Coverage
SecurityAI-specific threatsGenAI Addendum §2-3
AvailabilityAI system reliabilityContinuous Monitoring
Processing IntegrityAI output accuracySystem Card §5
ConfidentialityTraining data protectionEnterprise Policy §4
PrivacyAI and personal dataAIA §5

5. Gap Analysis​

5.1 Fully Addressed Requirements​

CategoryCountPercentage
Management System Clauses10/10100%
Annex A Controls36/3895%
Total46/4896%

5.2 Partial Gaps (Minor)​

RequirementGap DescriptionRemediation
A.6.7 AI model testingFormal testing protocolEnhance System Card testing section
A.10.5 Human oversightExplicit override proceduresOperating Model Section 8 ✓

5.3 Remediation Plan​

GapActionOwnerDue Date
A.6.7Enhance testing documentationAI Risk Officer2026-03-15
A.10.5Document override proceduresOperations2026-01-15 ✓ Complete

6. Certification Preparation​

6.1 Certification Pathway​

┌─────────────────────────────────────────────────────────────┐
│ STAGE 1: GAP ASSESSMENT                                     │
│ • Current state analysis (this document)                    │
│ • Gap remediation                                           │
│ Timeline: 1-2 months                                        │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│ STAGE 2: IMPLEMENTATION                                     │
│ • Implement remaining controls                              │
│ • Staff training                                            │
│ • Process deployment                                        │
│ Timeline: 2-4 months                                        │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│ STAGE 3: INTERNAL AUDIT                                     │
│ • Conduct internal AIMS audit                               │
│ • Address findings                                          │
│ • Management review                                         │
│ Timeline: 1 month                                           │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│ STAGE 4: CERTIFICATION AUDIT                                │
│ • Stage 1 audit (documentation review)                      │
│ • Stage 2 audit (implementation verification)               │
│ • Certification decision                                    │
│ Timeline: 1-2 months                                        │
└─────────────────────────────────────────────────────────────┘

6.2 Evidence Requirements​

ClauseEvidence RequiredLocation
4.1Context documentationOperating Model §2
5.2AI PolicyEnterprise Policy
6.1Risk assessment recordsRisk Matrix, AIA
7.5Document control recordsEvidence Repository
8.2Lifecycle recordsSystem Cards
9.1Monitoring recordsContinuous Monitoring logs
9.2Internal audit reportsAudit Repository
9.3Management review minutesMeeting records
10.2Corrective action recordsIncident log

6.3 Certification Bodies​

Accredited ISO/IEC 42001 Certification Bodies:

  • BSI (UKAS and RvA accredited)
  • DNV
  • SGS
  • Bureau Veritas
  • TÜV (various)
  • A-LIGN (ANAB accredited)
  • NSF

7. Maintenance and Surveillance​

7.1 Ongoing Requirements​

ActivityFrequencyOwner
Internal auditAnnual minimumInternal Audit
Management reviewAnnual minimumAI Governance Board
Policy reviewAnnualAI Risk Officer
Risk assessment updateAnnual or on changeAI Risk Officer
Surveillance auditAnnual (by certification body)External

7.2 Continuous Improvement​

InputOutputAction
Internal audit findingsCorrective actionsProcess improvements
Incident reportsPreventive actionsControl enhancements
Performance metricsImprovement targetsKPI optimization
Regulatory changesPolicy updatesCompliance maintenance
Technology evolutionProcess updatesCapability enhancement

8. Framework to ISO 42001 Quick Reference​

Framework DocumentISO 42001 ClausesAnnex A Controls
Operating Model4, 5.3, 8.1, 8.2, 9.1A.3, A.6.2, A.8
Charter5.1, 5.3A.2.4, A.3.2
Risk Matrix6.1.2, 6.1.3A.5.3, A.6.6
Intake Form8.2A.5.2, A.6.3
Enterprise Policy5.2, 7.3A.2.2, A.2.3, A.10.2
System Card7.5, 8.2A.6.4, A.6.5, A.7
AIA6.1.4, 8.4A.5.3
Implementation Plan6.2, 7.1, 7.2, 10.1A.3.4, A.4.2
GenAI Addendum8.1A.6.5, A.8.2
AI-BOM7.5, 8.2A.5.2, A.7.3, A.9.3
Third-Party AI Risk8.3A.9.2, A.9.3
Continuous Monitoring9.1A.8.3

Document Control​

Version History​

VersionDateAuthorChanges
1.02025-06-15AI Governance OfficeInitial mapping

Approvals​

RoleNameDate
AI Risk Officer
Quality Manager
Internal Audit

Appendix A: ISO/IEC 42001 Annex A Control Checklist​

For audit preparation, verify each control:

ControlImplementedEvidence LocationNotes
A.2.2[ ]
A.2.3[ ]
A.2.4[ ]
A.3.2[ ]
A.3.3[ ]
A.3.4[ ]
A.4.2[ ]
A.4.3[ ]
A.4.4[ ]
A.4.5[ ]
A.5.2[ ]
A.5.3[ ]
A.5.4[ ]
A.6.2[ ]
A.6.3[ ]
A.6.4[ ]
A.6.5[ ]
A.6.6[ ]
A.6.7[ ]
A.7.2[ ]
A.7.3[ ]
A.7.4[ ]
A.8.2[ ]
A.8.3[ ]
A.8.4[ ]
A.8.5[ ]
A.9.2[ ]
A.9.3[ ]
A.9.4[ ]
A.10.2[ ]
A.10.3[ ]
A.10.4[ ]
A.10.5[x]Operating Model Section 8Human Oversight and Override Procedures

Classification: Internal
Review Frequency: Annual (aligned with surveillance audit cycle)

CODITECT AI Risk Management Framework

Document ID: AI-RMF-18 | Version: 2.0.0 | Status: Active

AZ1.AI Inc. | CODITECT Platform

Framework Alignment: NIST AI RMF 2.0 | EU AI Act | ISO/IEC 42001

This document is part of the CODITECT AI Risk Management Framework. For questions or updates, contact the AI Governance Office.

Repository: coditect-ai-risk-management-framework Last Updated: 2026-01-15 Owner: AZ1.AI Inc. | Lead: Hal Casteel