In this article
- What Is ISO 42001 Annex A?
- What Are the 38 ISO 42001 Annex A Controls?
- What Does Annex B Add?
- How Do the Annex A Controls Relate to the EU AI Act?
- ISO 42001 vs EU AI Act: no presumption of conformity
- ISO 42001 vs ISO 27001: How Do the Controls Compare?
- How Should You Use Annex A in ISO 42001 Implementation?
- What Does an Annex A Internal Audit Check?
- Which Documents Does Annex A Drive?
- How AnnexOps Helps
- Ready to Manage ISO 42001 Annex A Controls?
- Related Reading
- Author: Nitin Grover
ISO 42001 Annex A is a list of 38 reference controls in nine areas, numbered A.2 to A.10. It is normative, but you do not have to implement every control. You select the controls you need through your AI risk treatment (clause 6.1.3) and record the decision in a Statement of Applicability. Annex B gives implementation guidance. None of this replaces the EU AI Act, which is binding law.
This guide is part of our series on EU AI Act and ISO 42001 compliance. It covers the control list, how to select controls, how they relate to the EU AI Act and ISO 27001, and how to prepare for an internal audit. For the supplier side of Annex A (A.10), start with our pillar guide on AI vendor risk management for EU AI Act compliance.
Mapping Annex A to your evidence?
AnnexOps tracks ISO/IEC 42001 as 65 requirements: clauses 4 to 10 and the 38 Annex A controls.
What Is ISO 42001 Annex A?
ISO/IEC 42001:2023, published in December 2023, sets requirements in clauses 4 to 10 and has four annexes. Annex A is the reference set of controls.
| Annex | Status | Purpose |
| A | Normative | Reference control objectives and controls |
| B | Normative | Implementation guidance for the controls |
| C | Informative | Potential AI-related objectives and risk sources |
| D | Informative | Use of the AI management system across sectors and with other standards |
“Normative” does not mean “mandatory for every control.” The organisation determines which controls are necessary for its AI risk treatment. Annex A also allows you to design and implement other controls.
What Are the 38 ISO 42001 Annex A Controls?
The controls sit in nine areas. This is the ISO 42001 controls list at the level of control names. The standard’s full text and wording are sold by ISO and national standards bodies, and this guide does not reproduce them.
| Area | Controls | What they cover |
| A.2 Policies related to AI | 3 (A.2.2 to A.2.4) | AI policy, alignment with other policies, policy review |
| A.3 Internal organization | 2 (A.3.2, A.3.3) | AI roles and responsibilities, reporting of concerns |
| A.4 Resources for AI systems | 5 (A.4.2 to A.4.6) | Resource documentation, data, tooling, computing and human resources |
| A.5 Assessing impacts of AI systems | 4 (A.5.2 to A.5.5) | Impact assessment process and documentation, impact on individuals and on society |
| A.6 AI system life cycle | 9 (A.6.1.2, A.6.1.3, A.6.2.2 to A.6.2.8) | Responsible development, requirements, design, verification, deployment, monitoring, technical documentation, event logs |
| A.7 Data for AI systems | 5 (A.7.2 to A.7.6) | Data for development, acquisition, quality, provenance, preparation |
| A.8 Information for interested parties | 4 (A.8.2 to A.8.5) | Documentation for users, external reporting, communication of incidents, information for interested parties |
| A.9 Use of AI systems | 3 (A.9.2 to A.9.4) | Responsible use processes, objectives, intended use |
| A.10 Third-party and customer relationships | 3 (A.10.2 to A.10.4) | Allocating responsibilities, suppliers, customers |
Do You Have to Implement All 38 Controls?
No. Clause 6.1.3 sets the logic. You determine the controls necessary for your AI risk treatment options, compare them with Annex A to check that no necessary control is missing, and consider the Annex B guidance when you implement them. The result is a Statement of Applicability, which records the controls you selected.
This is also why a fixed “percentage covered” claim is unreliable. Coverage depends on your risk treatment and your evidence, not on the list alone. In AnnexOps, a framework card computes coverage from your evidence. It can be low.
What Does Annex B Add?
Annex B follows the Annex A areas and gives implementation guidance for each control. You must consider it when implementing the controls you choose, but you may extend it, change it or use another method.
How Do the Annex A Controls Relate to the EU AI Act?
Regulation (EU) 2024/1689 sets legal requirements for high-risk AI systems. Annex A is organisational. The overlap is real, but it is partial. The table shows where the topics meet. It is indicative and does not prove compliance.
| ISO 42001 Annex A | Related AI Act provision | Note |
| A.2, A.3 (policy, roles) | Article 17, quality management system | Article 17 requires an accountability framework |
| A.5, A.6.2.4 (impact, verification) | Article 9, risk management; Article 15, accuracy, robustness, cybersecurity | The legal tests are set by the Regulation |
| A.7 (data) | Article 10, data and data governance | Training, validation and testing data |
| A.6.2.3, A.6.2.7 (documentation) | Article 11 and Annex IV, technical documentation | Annex IV sets the required content |
| A.6.2.8 (event logs) | Article 12, record-keeping; Article 26, deployer logs | Deployers keep logs for at least six months |
| A.8.2 (user information) | Article 13, transparency to deployers | Instructions for use |
| A.8.3, A.8.4 (reporting) | Article 73, serious incidents | Legal reporting duties apply to providers |
| A.9 (use of AI) | Article 26, deployer duties | Annex A has no control named human oversight. Annex B guidance mentions it, and Article 14 requires it |
| A.10 (third parties) | Articles 25 and 53 | See our guide on AI vendor risk management |
ISO 42001 vs EU AI Act: no presumption of conformity
ISO/IEC 42001 is voluntary and is not a harmonised standard under the Regulation. Article 40(1) gives a presumption of conformity only for standards whose references are published in the Official Journal. The European Commission states in its standardisation FAQ that the goals and definitions of ISO/IEC 42001:2023 are not aligned with the quality management system the AI Act requires. The standard written for Article 17 is EN 18286:2026, published in July 2026. At the time of writing, we have found no Official Journal citation, so check before relying on it.
Dates also moved. Under Regulation (EU) 2026/1744, high-risk obligations apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I products). Annex A work done now builds the evidence you will need then.
ISO 42001 vs ISO 27001: How Do the Controls Compare?
Both standards use the ISO harmonised structure, and ISO 42001 Annex D says that using them together has value. The control sets differ. ISO/IEC 27001:2022 has 93 Annex A controls in four themes. ISO 42001 has 38 AI-specific controls. A team moving from ISO 27001 to ISO 42001 starts with a head start in structure, not in controls. That is the basis of an integrated management system for AI and information security: share the shell, keep the scopes, objectives and control selections separate.
How Should You Use Annex A in ISO 42001 Implementation?
- Build the AI inventory. You cannot select controls for systems you have not listed.
- Run the AI risk assessment and impact assessments (clauses 6.1.2 and 6.1.4).
- Select the necessary controls (6.1.3) and compare them with Annex A.
- Write the Statement of Applicability. Record which controls apply and why.
- Implement with Annex B in view, and attach evidence to each control.
- Audit and review. Run an internal audit and a management review for the AI management system.
What Does an Annex A Internal Audit Check?
An auditor works control by control against your Statement of Applicability. Build one checklist row per selected control: owner, what the control requires of you, the evidence, the date of the last review, and open findings. Controls you excluded need a clear reason. Treat the internal audit as your ISO 42001 audit readiness check before the certification body arrives.
Which Documents Does Annex A Drive?
The documents you will need to show include the AIMS scope (clause 4.3), AI objectives (6.2), the AI risk assessment and treatment results (6.1.2 and 6.1.3), the AI system impact assessments (6.1.4), and the Statement of Applicability. Your selected controls add the policies, procedures, and records they call for.
How AnnexOps Helps
AnnexOps is ISO 42001 compliance software and an AI governance platform. It links evidence to controls, not to a single framework. In the Common Control Library, 50 of 211 shared controls link to ISO 42001 requirements, so a record you collect once can count toward several frameworks. Your certification body gets a read-only Audit Room scoped to one framework. Coverage percentages are indicative. They are not a measure of compliance or a prediction of a certification decision. Need hands-on help? Talk to our ISO 42001 consulting team.
Ready to Manage ISO 42001 Annex A Controls?
Centralise AI risk assessments, control documentation, and audit-ready evidence with AnnexOps.
Related Reading
- ISO 42001 framework page
- ISO 27001 framework page
- AI Vendor & Third-Party Risk Management for EU AI Act Compliance
- ISO 27001 and ISO 42001: How to Integrate Both Standards
Author: Nitin Grover
Nitin Grover is an AI compliance strategist and writer focused on EU AI Act compliance, AI governance, Annex IV documentation, AI risk management, and AI compliance operations for AI startups, SaaS companies, and enterprise AI teams across Europe.
