EN
Book an expert call

AnnexOps Compliance

ISO/IEC 42001 Evidence Automation: Write Once, Count Twice

AnnexOps tracks ISO/IEC 42001 as 65 requirements: clauses 4 to 10 and the 38 Annex A controls. Requirement coverage rolls up from the AI inventory, model cards, oversight designs and AI-literacy records you already keep for the EU AI Act. Versioned impact assessments. Evidence your certification body can verify.

Book an ISO 42001 expert call

All 38 Annex A controls · Versioned AI impact assessments · Reuses EU AI Act evidence

How ISO 42001 automation works

Derived from facts, signed by people

Rules as data

Every ISO/IEC 42001 requirement, 4.1 to 10.2 and A.2.2 to A.10.4, is a versioned rule that cites its clause identifier. A second auditor re-running a check gets the same answer. No LLM decides a verdict.

Derivation, not judgment

The platform derives which requirements each recorded fact evidences: an AI system in the inventory, a model card, an oversight design. Applicability in the Statement of Applicability and the outcome of an impact assessment stay your decisions.

Agents draft, you sign

Agents draft suggestions; they never change a record on their own. Suggestions land in Approvals, where a named person accepts or rejects them. Every decision becomes an audit event, so your management review (clause 9.3) has a trail to cite.

Evidence you can verify

Connectors read configuration metadata only. Evidence is collected read-only, stored append-only and hash-chained, so tampering is detectable. Point-in-time evidence packages give your certification body something it can re-verify at the annual surveillance audits and again at recertification in year three.

Core capabilities

Built for an AI management system, not bolted onto the ISMS

All 65 requirements, Annex A included

Clauses 4 to 10 and the 38 Annex A controls (A.2 to A.10) tracked as 65 requirements, linked to the shared control library (50 of 211 controls). Official clause text is referenced by identifier, because the standard is licensed. Applicability of each Annex A control is recorded in the Statement of Applicability.

Write it once, count it twice

The AI inventory, Art 13 model cards, Art 14 oversight designs and AI-literacy records you keep for the EU AI Act already evidence Annex A controls. The same records count toward resources, life cycle, information for interested parties and use. Evidence attaches to the control, not the framework: 211 shared controls, 50 linked to ISO 42001.

Read-only evidence, continuously checked

Continuum connectors for GitHub, AWS and Microsoft Entra ID collect configuration metadata only, append-only and hash-chained per connection. The 743 automated checks are graded against each framework you hold. Where a linked control carries an automated check, the requirement behind it shows live status, not a screenshot. Other controls rest on recorded evidence.

Audit Room for your certification body

Invite the certification body into a read-only Audit Room scoped to ISO 42001 alone, ending on a date you set. The body sees your ISO 42001 records for the stage 1 and stage 2 audits and the surveillance audits that follow, and nothing from any other framework.

Versioned AI impact assessments

Clause 6.1.4 requires a process to assess the impact of AI systems on individuals, groups and society; clause 8.4 requires it to be performed and documented. AnnexOps keeps one versioned assessment per AI system: a change produces a new version, not an overwritten form.

An AIMS cycle of its own

ISO 42001 is its own management system, not an ISMS annex. AnnexOps keeps a separate scope (4.3), AI objectives (6.2), internal audit programme (9.2) and management review (9.3) for the AIMS. The controls underneath are shared with ISO 27001, SOC 2, NIS2 and DORA.

Integrations

Works With Your Existing Stack

  • GitHub
  • Amazon Web Services
  • Microsoft Entra ID
  • Jira (ticketing)
  • SharePoint (document links)
  • GitLab (coming soon)
  • Microsoft Azure (coming soon)
  • Google Cloud (coming soon)
  • Okta (coming soon)
  • Workday (coming soon)
  • OpenAI (coming soon)
  • Anthropic (coming soon)

FAQs

Some Frequently Asked Questions and Their Answers

Who issues the ISO/IEC 42001 certificate, AnnexOps or a certification body?

A certification body does. AnnexOps is not a certification body and does not certify anyone. Bodies that certify AI management systems work under ISO/IEC 42006:2025 and ISO/IEC 17021-1: a two-stage initial audit, surveillance audits at least once a year and recertification in year three. Check that the body is accredited. AnnexOps prepares and organises your evidence against all 65 requirements and gives the body a read-only Audit Room scoped to ISO 42001.

Does ISO/IEC 42001 certification make us compliant with the EU AI Act?

No. ISO/IEC 42001 is a voluntary management-system standard, not a harmonised standard under Regulation (EU) 2024/1689. The Commission’s standardisation FAQ says its goals and definitions are not aligned with the quality management system the AI Act requires (Art 17). EN 18286:2026 was written for that purpose, and it confers presumption of conformity only once its reference is cited in the Official Journal. AnnexOps runs both over one body of evidence, so the AIMS supports, but does not replace, your AI Act obligations.

How much of our ISO/IEC 27001 ISMS already counts toward ISO/IEC 42001?

The clause 4 to 10 skeleton is shared, because both standards follow the ISO Harmonised Structure. The 38 Annex A controls are AI-specific and differ from the 93 in ISO 27001:2022, and ISO 42001 needs its own scope, objectives, internal audits and management reviews. In AnnexOps, 50 of the 211 shared controls link to ISO 42001 requirements. A locked framework card shows the percentage your existing evidence already covers, computed for your organisation. It can be low.

Has the ISO/IEC 42001 requirement content in AnnexOps been reviewed?

It is AnnexOps-authored and specialist review is in progress; the product shows that label on screen. EU AI Act and GDPR content is already reviewed by counsel. Official clause text is referenced by identifier only, because ISO licenses the standard. Status comes from versioned rules, not from a language model, and the percentage you see is assessed requirement coverage, indicative by design. It is not a measure of compliance, legal advice or a prediction of the certification decision.

News & Articles

Prepare your AIMS from evidence you already hold

Book an expert call: one framework, one read-only connection, then a read-only Audit Room for your certification body.

Book an ISO 42001 expert callTalk to us
AI Analyzer