BY NEURABYTE
FRAMEWORKS/AI/ISO 42001
42001
AI · ISO / IEC

ISO 42001

The first certifiable AI management system standard.

Published in December 2023, ISO/IEC 42001 specifies requirements for an AI management system (AIMS). It follows the same high-level structure as ISO 27001, so organizations can integrate the two. Annex A lists 38 controls on policy, roles, resources, impact assessment, lifecycle, data, and third parties.

AT A GLANCE
ISSUERISO / IEC REGIONInternational CATEGORYAI CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Organizations that want a certificate for AI governance
02Companies already running ISO 27001 who can extend the management system
03Vendors answering AI due diligence from regulated customers
02. KEY REQUIREMENTS

The parts of ISO 42001 that touch what agents do.

A.6.2.6 Operation and monitoring
AI systems are operated and monitored according to defined criteria, with logging.
A.9.2 Responsible use
Processes ensure AI is used responsibly, including human oversight.
A.7.4 Data quality and provenance
Data used by AI systems has documented provenance and quality criteria.
A.5 Impact assessment
Impacts on individuals and society are assessed and documented.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against ISO 42001. Where there is no evidence, the report says gap.

LORE CONTROL ISO 42001 REFERENCE
Signed, hash-chained receiptsA.6.2.6, A.6.2.8
Maker–checker approvalA.9.2, A.9.4
Context disclosure recordA.7.4, A.7.5
Provable deletionA.7.6 data retention and disposal
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

The management system, impact assessments, and management review are organizational.
Many Annex A controls address policy and culture, and are marked out of scope rather than passed.
05. QUESTIONS
Can we certify today?
Accredited certification bodies exist, but the ecosystem is young. Expect it to mature through 2027.
Does 42001 satisfy the EU AI Act?
Not on its own. It is expected to be referenced by harmonized standards, which would make it a strong foundation.
Why is this planned rather than live?
Because most of its clauses are organizational. We are scoping the crosswalk carefully so it does not overstate what software can evidence.
← PREVIOUSNIST AI RMF ALL FRAMEWORKS NEXT →AARM
ISO 42001 · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for ISO 42001 tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.