AI policy and objectives
Drafted against the requirement rather than from a blank page, then versioned as they are revised and approved.
ISO/IEC 42001
The management system for AI.
The first certifiable standard for governing artificial intelligence: a management system covering how you decide what to build, how you control it in production, and how you prove both.
Coverage
What ships with the platform.
- 38
- Controls
- ISO/IEC 42001 control library
- 31
- Document requirements
- Mapped to the controls they satisfy
- Yes
- Crosswalked
- Evidence credits equivalent controls in the other frameworks
- Yes
- Document review
- Grade an existing document against this framework
In short
What it actually asks for.
ISO/IEC 42001 asks for an AI management system — the same shape as ISO 27001 for security or ISO 9001 for quality. Clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement; Annex A carries the controls.
It is a process standard rather than a technical one. Certification turns on whether you can show the system runs — that impact assessments happen, that roles are assigned, that decisions are recorded and reviewed — rather than on the internals of any one model.
Where the platform helps
The obligations that take the most work.
Impact assessment
Assessments tied to the systems in your inventory, and re-raised when a system changes materially rather than on a calendar.
Roles and accountability
Ownership recorded against controls and evidence, so "who is responsible" has an answer that survives staff turnover.
Operational control
Connector scans turn what is actually running into evidence at control level, continuously.
Performance evaluation
Coverage and effectiveness recalculated as evidence lands, with an audit simulation to rehearse the real thing.
Continual improvement
Gaps become draft policies and remediation entries with owners, so findings turn into work rather than a register.
Policies are drafted for all 38 Annex A controls. Evidence gathered here also credits the mapped ISO 27001 controls automatically.
Alongside
Rarely the only framework you run.
Evidence is credited across every framework that asks for the same proof, so overlapping programmes cost far less than running them separately.
Next / evaluate the platform
Bring your frameworks.
See the operating system.
We will walk through the platform against your own governance and compliance needs, and what getting to audit-ready would take.