ISO/IEC 42001 Annex A, one page each
The control that applies today, the evidence an auditor asks for, the ways it commonly fails and the privacy work the draft points at. The privacy overlay column is the public 27091 theme that touches the control; no 27091 clause number is claimed. Every page names its source.
A.2 A.2 Policies related to AI
| Control | Control record | Privacy overlay | Basis |
|---|---|---|---|
| A.2.2 | AI policy | Scope, role and who answers | Public scope |
| A.2.3 | Alignment with other organizational policies | Scope, role and who answers | Reading |
| A.2.4 | Review of the AI policy | Evidence, review and the date | Reading |
A.3 A.3 Internal organization
| Control | Control record | Privacy overlay | Basis |
|---|---|---|---|
| A.3.2 | AI roles and responsibilities | Scope, role and who answers | Public scope |
| A.3.3 | Reporting of concerns | Operating, monitoring and telling people | Reading |
A.4 A.4 Resources for AI systems
| Control | Control record | Privacy overlay | Basis |
|---|---|---|---|
| A.4.2 | Resource documentation | The lifecycle and where privacy risk enters | Public scope |
| A.4.3 | Data resources | The lifecycle and where privacy risk enters | Public scope |
| A.4.4 | Tooling resources | The lifecycle and where privacy risk enters | Reading |
| A.4.5 | System and computing resources | The lifecycle and where privacy risk enters | Reading |
| A.4.6 | Human resources | Scope, role and who answers | Reading |
A.5 A.5 Assessing impacts of AI systems
| Control | Control record | Privacy overlay | Basis |
|---|---|---|---|
| A.5.2 | AI system impact assessment process | Evaluating the consequences | Public scope |
| A.5.3 | Documentation of AI system impact assessments | Evaluating the consequences | Public scope |
| A.5.4 | Assessing AI system impact on individuals or groups of individuals | Evaluating the consequences | Public scope |
| A.5.5 | Assessing societal impacts of AI systems | Evaluating the consequences | Reading |
A.6.1 A.6 AI system life cycle
| Control | Control record | Privacy overlay | Basis |
|---|---|---|---|
| A.6.1.2 | Objectives for responsible development of AI system | The lifecycle and where privacy risk enters | Reading |
| A.6.1.3 | Processes for responsible design and development of AI systems | The lifecycle and where privacy risk enters | Public scope |
A.6.2 A.6 AI system life cycle
| Control | Control record | Privacy overlay | Basis |
|---|---|---|---|
| A.6.2.2 | AI system requirements and specification | The lifecycle and where privacy risk enters | Public scope |
| A.6.2.3 | Documentation of AI system design and development | Evidence, review and the date | Reading |
| A.6.2.4 | AI system verification and validation | The lifecycle and where privacy risk enters | Reading |
| A.6.2.5 | AI system deployment | Operating, monitoring and telling people | Public scope |
| A.6.2.6 | AI system operation and monitoring | Operating, monitoring and telling people | Public scope |
| A.6.2.7 | AI system technical documentation | Evidence, review and the date | Reading |
| A.6.2.8 | AI system recording of event logs | Operating, monitoring and telling people | Reading |
A.7 A.7 Data for AI systems
| Control | Control record | Privacy overlay | Basis |
|---|---|---|---|
| A.7.2 | Data for development and enhancement of AI system | Treating the risk: data and third parties | Reading |
| A.7.3 | Acquisition of data | Treating the risk: data and third parties | Reading |
| A.7.4 | Quality of data for AI systems | Treating the risk: data and third parties | Reading |
| A.7.5 | Data provenance | Treating the risk: data and third parties | Reading |
| A.7.6 | Data preparation | Treating the risk: data and third parties | Reading |
A.8 A.8 Information for interested parties of AI systems
| Control | Control record | Privacy overlay | Basis |
|---|---|---|---|
| A.8.2 | System documentation and information for users | Operating, monitoring and telling people | Reading |
| A.8.3 | External reporting | Operating, monitoring and telling people | Reading |
| A.8.4 | Communication of incidents | Operating, monitoring and telling people | Reading |
| A.8.5 | Information for interested parties | Evidence, review and the date | Reading |
A.9 A.9 Use of AI systems
| Control | Control record | Privacy overlay | Basis |
|---|---|---|---|
| A.9.2 | Processes for responsible use of AI systems | Operating, monitoring and telling people | Public scope |
| A.9.3 | Objectives for responsible use of AI system | Operating, monitoring and telling people | Reading |
| A.9.4 | Intended use of the AI system | Operating, monitoring and telling people | Reading |
A.10 A.10 Third-party and customer relationships
| Control | Control record | Privacy overlay | Basis |
|---|---|---|---|
| A.10.2 | Allocating responsibilities | Scope, role and who answers | Public scope |
| A.10.3 | Suppliers | Treating the risk: data and third parties | Reading |
| A.10.4 | Customers | Treating the risk: data and third parties | Reading |
"Public scope" means the point rests on the published abstract of the draft. "Reading" means it is our reading of the direction the abstract gives, without a draft requirement. The control numbers are the ISO/IEC 42001:2023 Annex A numbers. The reference pages carry the role question and the four markets.
The rules this is built from
Read from the real rules, not invented. The 38 control pages are the ISO/IEC 42001:2023 Annex A controls, read from the standards library: 101 evidence lines and 80 common failure lines, each cited to its control. The privacy layer is read from the public ISO/IEC FDIS 27091 record, the ISO abstract and the stage feed. The draft text is not public and is not reproduced.
ISO/IEC 42001:2023, Annex A
Each page states the control in our words, the evidence an auditor asks for, the common gaps and the privacy work the draft points at.
Open the control indexWhat the draft covers
Scope and role, the lifecycle, the evaluation of consequences, treatment, operation and evidence.
Read the public recordThe role and the four markets
Controller or processor, the lifecycle stages, and the instruments named for the US, EU, UK and Australia.
Open the referenceThe ISO/IEC FDIS 27091 text is not public and is not reproduced. The ISO/IEC 42001:2023 text is not reproduced either. Every source.