Who builds this, and why
ISO 27091 Checker is published by The Art of Service. It exists because the privacy guidance for AI is in the awkward period between a final draft and a published document: too late to ignore, too early to rebuild a certified system around. The site holds the controls that apply today, reads the public 27091 record honestly, and sells the work product that turns both into a plan.
The control record is read from the published ISO/IEC 42001:2023 Annex A set, the same record the compliance library uses. The privacy layer is the ISO standard page 56582, its abstract and its stage feed, with the lifecycle stage names from ISO/IEC 22989:2022. Where the record is silent, the page says so. The site does not reproduce the standard and does not have the draft text.
Who it is for
The CISO or ISMS manager at an organization that develops or uses AI systems with personal data, the consultant who is asked what the draft means for a client, and the privacy lead who has to answer a board question before the text is published. It is written for someone who has to hand an answer to a manager or a client, not for someone who wants a summary to skim.
Byline
Gerard Blokdyk, founder of The Art of Service. Contact support@theartofservice.com. The Art of Service Pty Ltd, theartofservice.com.
The control interpretations and the evidence lists are the publisher's reading, bylined here. We do not name a reviewer we have not engaged. If a named, credentialed reviewer is added, the name and credentials will appear here and on the methodology page.
This is an independent reference. It is not affiliated with, endorsed by or published by ISO or IEC. ISO, IEC and ISO/IEC 42001 are trademarks of the International Organization for Standardization and the International Electrotechnical Commission.
What the site does not do
It does not certify, audit, give legal advice or replace a certification body. It does not claim the draft is final or that it can be certified against. It does not sell the ISO text. It does not promise that a certificate will transfer, because the draft is guidance and changes no certificate.
Editorial record
Last updated: . The record's change date is the same date. The sources were retrieved on 22 October 2026. Corrections go to support@theartofservice.com and are made in the record, not patched on a page.
The rules this is built from
Read from the real rules, not invented. The 38 control pages are the ISO/IEC 42001:2023 Annex A controls, read from the standards library: 101 evidence lines and 80 common failure lines, each cited to its control. The privacy layer is read from the public ISO/IEC FDIS 27091 record, the ISO abstract and the stage feed. The draft text is not public and is not reproduced.
ISO/IEC 42001:2023, Annex A
Each page states the control in our words, the evidence an auditor asks for, the common gaps and the privacy work the draft points at.
Open the control indexWhat the draft covers
Scope and role, the lifecycle, the evaluation of consequences, treatment, operation and evidence.
Read the public recordThe role and the four markets
Controller or processor, the lifecycle stages, and the instruments named for the US, EU, UK and Australia.
Open the referenceThe ISO/IEC FDIS 27091 text is not public and is not reproduced. The ISO/IEC 42001:2023 text is not reproduced either. Every source.