ISO 42001 Annex A

The 38 AI-specific controls that make ISO 42001 auditable — the AI analogue of ISO 27001 Annex A.

Annex A of ISO/IEC 42001:2023 is a reference set of 38 controls organised across 9 control objectives (A.2 through A.10): AI policies, internal organisation, resources, impact assessment, lifecycle, data, information for interested parties, use of AI systems, and third-party relationships. Each control is implemented or justified-as-not-applicable in the Statement of Applicability. Annex A mirrors the structure of ISO 27001 Annex A so an auditor already fluent in ISO management-system work can navigate it quickly — the difference is the subject matter: model lifecycle, dataset documentation, transparency obligations, human oversight.

Examples

  • →A.6.2.4 (verification and validation): evaluation reports for each model release, covering accuracy, robustness and bias dimensions.
  • →A.7.3 (acquisition of data): dataset data-sheets documenting source, licence, consent basis and quality metrics for every training corpus.
  • →A.10.2 (suppliers): a vendor-DPA + usage-policy pack for every LLM API provider in production.

Common mistakes

  • ✗Treating Annex A as a checklist. It is a reference set — the standard requires you to also consider risks and implement controls Annex A does not list if they apply.
  • ✗Scoping Annex A to models only. Many controls (A.5 impact assessment, A.8 transparency, A.9 use) are about how the organisation deploys and oversees AI, not about the model itself.

How LowerPlane handles it

LowerPlane maps every Annex A control to an implementation task with evidence requirements, and generates the Statement of Applicability from the current status of those tasks.

Authoritative sources

Related reading on LowerPlane

Related terms

  • ISO/IEC 42001 — International standard for an Artificial Intelligence Management System (AIMS).
  • AIMS (AI Management System) — The policy, process and control stack that ISO 42001 certifies — the AI-governance analogue of an ISMS.
  • Statement of Applicability (SoA) — A required ISO management-system document listing every Annex A control, whether it applies, and the justification.
  • AI Impact Assessment (AIIA) — A structured review of an AI system's potential harms, benefits and affected parties — required by ISO 42001 Annex A.
← Back to the full glossary