ISO/IEC 42001

AI Management System: AI lifecycle documentation, supply chain controls for AI systems.


Short name	ISO 42001
Region	International
Country or scope	International
Sector	AI
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ISO 42001

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for ISO 42001.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for ISO 42001 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ISO42001-A4-RES` AI Resource Documentation	Resources used by AI systems, including tooling and software components, must be identified and documented (ISO/IEC 42001:2023 Annex A, resources for AI systems)	Scan
`ISO42001-A10-SUP` Supplier and Third-Party Management	Responsibilities with suppliers and third parties contributing to the AI system must be allocated and their services controlled, presupposing known suppliers for components (ISO/IEC 42001:2023 Annex A, third-party and customer relationships)	Scan
`ISO42001-A6-LIFECYCLE` AI Lifecycle Documentation	AI system lifecycle stages must produce identifiable, dated documentation, satisfied by an SBOM with document identity and timestamp (ISO/IEC 42001:2023 Annex A, AI system life cycle)	Scan
`ISO42001-REPRO-VER` Version Records for Reproducibility	Traceability and reproducibility of AI system behavior require recorded versions of the frameworks and libraries used (ISO/IEC 42001:2023 Annex A, AI system documentation and traceability)	Scan
`ISO42001-PROV` Component Provenance	The provenance of AI system elements must be recorded to support accountability for AI outcomes, including who produced the composition documentation (ISO/IEC 42001:2023 Annex A, provenance and accountability provisions)	Scan
`ISO42001-INTEGRITY` AI Supply Chain Integrity	Controls over the AI supply chain include verifying that acquired components are unmodified, supported by integrity hashes (ISO/IEC 42001:2023 Annex A, AI supply chain controls)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ISO42001-4.1`	AI Context and Organisational Understanding
`ISO42001-5.2`	AI Policy
`ISO42001-6.1`	AI Risk Assessment
`ISO42001-6.2`	AI Objectives and Planning
`ISO42001-8.2`	AI System Impact Assessment
`ISO42001-8.4`	AI Lifecycle Management
`ISO42001-A.2.2`	AI Data Governance
`ISO42001-A.3.2`	AI Model Documentation
`ISO42001-A.5.2`	Responsible Use of AI
`ISO42001-A.6.2`	AI Supply Chain Controls
`ISO42001-A.7.2`	AI System Performance Monitoring
`ISO42001-A.8.2`	Transparency and Explainability
`ISO42001-A.9.2`	AI Incident Management
`ISO42001-A.10.2`	AI Human Oversight

Policy templates

Written for ISO 42001:

AI Management System (AIMS) Policy
AI Risk Assessment and Impact Assessment Policy
AI Lifecycle Management Policy
AI Supply Chain and Third-Party AI Policy

And 22 from the standard set, adapted to ISO 42001.