The evidence behind an AI management system. Kept current, not assembled for the audit.
ISO/IEC 42001:2023 is the certifiable international standard for AI management systems. GhostAudit holds the records it expects: what AI you have, how you assessed it, which controls apply and what changed.
| 4.1 | Context of the organisation Internal and external issues relevant to the AI management system are determined. |
| 5.2 | AI policy Top management establishes an AI policy appropriate to the organisation's purpose. |
| 6.1.2 | AI risk assessment A defined, repeatable AI risk assessment process is applied. |
| 6.1.4 | AI system impact assessment Potential consequences of AI systems for individuals and societies are assessed. |
| 9.2 | Internal audit Internal audits of the AI management system are conducted at planned intervals. |
| A.2 | Policies related to AI Annex A: management direction and support for AI via documented policies. |
| A.3 | Internal organisation Annex A: roles, responsibilities and reporting of concerns for AI are defined. |
| A.6 | AI system lifecycle Annex A: objectives and processes for responsible design, development, verification, deployment and monitoring. |
| A.7 | Data for AI systems Annex A: data acquisition, quality, provenance and preparation are managed. |
| A.8 | Information for interested parties Annex A: users and affected parties receive the information they need about the AI system. |
| A.10 | Third-party and customer relationships Annex A: responsibilities across suppliers, partners and customers are allocated. |
- Standard
- ISO/IEC 42001:2023
- Published
- December 2023
- In Europe
- EN ISO/IEC 42001:2026
- Status
- Voluntary, certifiable
A management system, like ISO 27001, for AI.
ISO/IEC 42001 specifies requirements for an AI management system (AIMS): an AI policy, risk and impact assessment, a set of controls in Annex A, and continual improvement. It has been adopted in Europe as EN ISO/IEC 42001:2026. Certification bodies are accredited under ISO/IEC 42006:2025.
In outline, the standard asks an organization to:
- define the scope of its AIMS, its AI policy, roles and objectives;
- perform AI risk assessments and AI system impact assessments;
- implement the applicable Annex A controls and maintain a statement of applicability;
- run internal audits and management reviews, and keep improving.
It is voluntary. In practice it is often requested by enterprise customers as evidence of AI governance, in the way ISO 27001 is requested as evidence of security management.
Scope begins with knowing which AI systems you have.
An auditor will ask how you know your AIMS scope is complete. "We asked each department" is a weak answer.
GhostAudit's inventory is fed by discovery from code repositories, single sign-on, browsers and desktops, so the list of systems reflects what is in use and not only what was reported. Each system has an owner, a purpose, a data classification and a risk tier, which is the information scope and risk decisions depend on.
Example workspace. Names and figures are illustrative.
| System | Owner | Risk tier | Status | |
|---|---|---|---|---|
Candidate screening HireVue | People operations | Restricted | High | Sanctioned |
ChatGPT Enterprise OpenAI | IT | Confidential | Limited | Sanctioned |
Support assistant Intercom | Customer support | Confidential | Limited | Sanctioned |
Claude Anthropic | Engineering | Internal | Limited | Under review |
Cursor Anysphere | Unassigned | Confidential | Limited | Unsanctioned |
Grammarly Grammarly | Marketing | Internal | Minimal | Sanctioned |
Risk assessments and impact assessments, per system.
The standard distinguishes AI risk assessment, clause 6.1.2, from AI system impact assessment, clause 6.1.4. GhostAudit has a template for each:
- the AI risk assessment produces a per-system risk register with likelihood and impact scoring, existing controls, residual risk and a dated treatment plan;
- the algorithmic impact assessment covers impacts on individuals and groups, including fairness, privacy, transparency, oversight and safety, with a mitigation plan.
The ISO/IEC 42001 assessment in GhostAudit walks each system through management-system clauses and Annex A control areas, recording status and evidence for each.
- Algorithmic impact assessmentRisk and impact · one systemPer-system assessment of impacts on individuals and groups: fairness, privacy, transparency, oversight, safety; applicability screening (FRIA, DPIA, ADMT laws) and mitigation plan.Basis: EU AI Act Art. 27; GDPR Art. 35; ISO/IEC 42001 6.1.4, A.5; NIST AI RMF MAP 5; Colorado SB 26-189; CCPA ADMT
- AI risk assessmentRisk and impact · one systemPer-system risk register with likelihood x impact scoring, existing controls, residual risk and dated treatment plan.Basis: NIST AI RMF MAP 4, MEASURE 1-3, MANAGE 1; NIST AI 600-1; ISO/IEC 42001 6.1.2; EU AI Act Art. 26
- AI system cardSystem documentation · one systemModel / AI system card: intended and out-of-scope uses, model and data, evaluation, limitations, oversight, monitoring and change log.Basis: ISO/IEC 42001 A.6.2.7, A.8.2; NIST AI RMF MAP 2-3, MEASURE 2; EU AI Act Art. 26
- Third-party AI vendor assessmentThird-party risk · one systemDue-diligence assessment of an AI vendor across all its services in use: criticality, evidence requests, contract clauses and monitoring.Basis: ISO/IEC 42001 A.10; NIST AI RMF GOVERN 6, MANAGE 3; EU AI Act Art. 26
All 38 Annex A controls, with justification and status.
The statement of applicability is the document a certification auditor reads first. GhostAudit generates a summary SoA that covers all 38 Annex A controls: whether each applies, the justification, the implementation status and the evidence, drawn from your inventory and assessments.
It is a working draft for your management system, to be reviewed and approved through the document workflow. As your assessments change, you regenerate it, and the previous versions remain on file.
A note on what GhostAudit is not: it is not a certification body, and using it does not certify you. Certification is granted by an accredited body after an audit. You will also need your own licensed copy of the standard.
Example workspace. Documents share one review and approval workflow.
The system ranks applicants for customer-support roles against the posted job requirements. A recruiter reviews every ranked list before any candidate is contacted; no application is rejected without human review.
Records that exist because the work happened in the tool.
Management systems are audited on evidence of operation: that reviews took place, that changes were controlled, that nonconformities were followed up.
Because inventory changes, assessments, document approvals and status decisions all happen in GhostAudit, the audit log is that evidence. It records who did what and when, and can be exported. Review cadences on systems and documents show what is due. Open gaps carry remediation plans with owners.
Read the official texts
- ISO/IEC 42001: official textiso.org
Dates and statuses on this page were last checked against these sources on 10 November 2026. This is orientation, not legal advice.
Questions
- Does GhostAudit certify us to ISO/IEC 42001?
No. Certification is issued by a certification body accredited under ISO/IEC 42006:2025, after an audit. We help you build and maintain the evidence that audit examines.
- Is GhostAudit itself certified to ISO/IEC 42001 or ISO 27001?
No. We do not hold those certifications today, and we say so on our security page.
- Does the product include the text of the standard?
No. ISO standards are licensed. The product references clauses and Annex A control areas and describes what is expected in our own words; you need your own copy of the standard.
See what is in use before you decide anything.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.