ISO/IEC 42001 Crosswalk
Purpose: Let a team that is building or auditing an AI management system under ISO/IEC 42001 find the wiki control objectives, evidence and test cases that support each Annex A control.
Audience: AI management system owners, internal auditors, certification leads, GRC teams.
Using the two together: Use ISO/IEC 42001 for the management system and its certification. Use this wiki for the security control objectives, evidence and tests that sit under the Annex A controls.
About the standard and this page
ISO/IEC 42001:2023 sets requirements for an AI management system. Its Annex A lists 38 controls, numbered from A.2.2 to A.10.4, and its main clauses 4 to 10 hold the management system requirements. The standard is sold by ISO and its text is copyrighted.
The tables are generated each time the site is built. They are read from the ISO/IEC 42001 field of each control in the AI Security Control Objectives Library. To change a mapping, edit the control; this page follows on the next build.
Verify before use. Control numbers and titles are given as the control library cites them and were not checked against a copy of the standard for this page. The list of 38 Annex A numbers was written from the structure of the standard. Check every number and title against your own copy before quoting it in a statement of applicability or an audit. A wiki control citing an Annex A control means it supports that control, not that it satisfies it.
How to read the tables
- Wiki controls are the control objectives whose record cites the Annex A control or clause.
- Test cases under those controls counts the distinct test cases that test at least one of those controls.
- An Annex A control with no name and "None" in the next column is not cited by any wiki control.
Annex A and clauses to wiki controls
33 of the 38 Annex A controls are cited by at least one wiki control.
Annex A controls
| Annex A control | Name | Wiki controls | Test cases under those controls |
|---|---|---|---|
| A.2.2 | AI policy | AI-CTRL-010; AI-CTRL-012 | 33 |
| A.2.3 | None | 0 | |
| A.2.4 | Review of the AI policy | AI-CTRL-012 | 7 |
| A.3.2 | AI roles and responsibilities | AI-CTRL-012 | 7 |
| A.3.3 | Reporting of concerns | AI-CTRL-035 | 39 |
| A.4.2 | Resource documentation | AI-CTRL-001; AI-CTRL-006; AI-CTRL-011; AI-CTRL-031 | 85 |
| A.4.3 | Data resources | AI-CTRL-017 | 31 |
| A.4.4 | Tooling resources | AI-CTRL-004; AI-CTRL-024 | 31 |
| A.4.5 | System and computing resources | AI-CTRL-007; AI-CTRL-027; AI-CTRL-032; AI-CTRL-036; AI-CTRL-040 | 94 |
| A.4.6 | Human resources | AI-CTRL-044 | 1 |
| A.5.2 | AI system impact assessment process | AI-CTRL-011; AI-CTRL-013; AI-CTRL-033; AI-CTRL-042 | 62 |
| A.5.3 | Documentation of AI system impact assessments | AI-CTRL-013; AI-CTRL-042 | 40 |
| A.5.4 | Assessing AI system impact on individuals or groups of individuals | AI-CTRL-013; AI-CTRL-041; AI-CTRL-042 | 43 |
| A.5.5 | Assessing societal impacts of AI systems | AI-CTRL-042 | 1 |
| A.6.1.2 | None | 0 | |
| A.6.1.3 | None | 0 | |
| A.6.2.2 | AI system requirements and specification | AI-CTRL-022; AI-CTRL-033 | 24 |
| A.6.2.3 | Documentation of AI system design and development | AI-CTRL-030 | 16 |
| A.6.2.4 | AI system verification and validation | AI-CTRL-005; AI-CTRL-020; AI-CTRL-021; AI-CTRL-028; AI-CTRL-033; AI-CTRL-034; AI-CTRL-039; AI-CTRL-041 | 153 |
| A.6.2.5 | AI system deployment | AI-CTRL-027; AI-CTRL-030; AI-CTRL-033 | 32 |
| A.6.2.6 | AI system operation and monitoring | AI-CTRL-005; AI-CTRL-006; AI-CTRL-009; AI-CTRL-020; AI-CTRL-025; AI-CTRL-026; AI-CTRL-028; AI-CTRL-035; AI-CTRL-040 | 177 |
| A.6.2.7 | None | 0 | |
| A.6.2.8 | AI system recording of event logs | AI-CTRL-008; AI-CTRL-009 | 43 |
| A.7.2 | Data for development and enhancement of AI system | AI-CTRL-029 | 16 |
| A.7.3 | Acquisition of data | AI-CTRL-019; AI-CTRL-029 | 28 |
| A.7.4 | Quality of data for AI systems | AI-CTRL-019; AI-CTRL-029 | 28 |
| A.7.5 | Data provenance | AI-CTRL-019; AI-CTRL-029; AI-CTRL-031; AI-CTRL-046 | 54 |
| A.7.6 | Data preparation | AI-CTRL-017 | 31 |
| A.8.2 | System documentation and information for users | AI-CTRL-039; AI-CTRL-041 | 10 |
| A.8.3 | External reporting | AI-CTRL-035; AI-CTRL-043 | 40 |
| A.8.4 | Communication of incidents | AI-CTRL-035 | 39 |
| A.8.5 | Information for interested parties | AI-CTRL-043 | 1 |
| A.9.2 | Processes for responsible use of AI systems | AI-CTRL-002; AI-CTRL-003; AI-CTRL-004; AI-CTRL-010; AI-CTRL-023; AI-CTRL-045 | 71 |
| A.9.3 | Objectives for responsible use of AI system | AI-CTRL-023; AI-CTRL-045 | 9 |
| A.9.4 | Intended use of the AI system | AI-CTRL-011 | 18 |
| A.10.2 | Allocating responsibilities | AI-CTRL-014 | 24 |
| A.10.3 | Suppliers | AI-CTRL-007; AI-CTRL-014; AI-CTRL-024; AI-CTRL-031; AI-CTRL-046 | 77 |
| A.10.4 | None | 0 |
Management system clauses
| Clause | Name | Wiki controls | Test cases under those controls |
|---|---|---|---|
| Clause 4.2 | Understanding the needs and expectations of interested parties | AI-CTRL-043 | 1 |
| Clause 6.1.2 | AI risk assessment | AI-CTRL-037 | 10 |
| Clause 6.1.3 | AI risk treatment | AI-CTRL-037 | 10 |
| Clause 7.2 | Competence | AI-CTRL-044 | 1 |
| Clause 7.3 | Awareness | AI-CTRL-044 | 1 |
| Clause 9.1 | Monitoring, measurement, analysis and evaluation | AI-CTRL-038 | 17 |
| Clause 9.2 | Internal audit | AI-CTRL-038 | 17 |
| Clause 9.3 | Management review | AI-CTRL-038 | 17 |
| Clause 10.2 | Nonconformity and corrective action | AI-CTRL-038 | 17 |
Annex A controls that no wiki control cites
A.2.3, A.6.1.2, A.6.1.3, A.6.2.7, A.10.4.
Attribution
ISO/IEC 42001:2023 is published by ISO and IEC. This page cites control numbers and titles only and does not reproduce the text of the standard.