The role question and the four markets
The draft reaches organizations that build AI systems or use them, in every sector. What follows is the reference layer: what the public record states, how to settle the role the organization plays, and the instruments named for the four markets a buyer usually brings into the question. The law is named here, not stated.
What the public record states
The ISO page publishes the title, edition, page count, committee, ICS, stage, stage date and the abstract.
Read the pageRole: controller or processor, and why it decides the duty
The draft applies to organizations that build AI systems or use them.
Read the pageThe AI system lifecycle, stage by stage
The abstract asks for privacy risk to be identified throughout the lifecycle.
Read the pageUnited States: the instruments named
A US organization that develops or uses AI systems with personal data meets a sector patchwork, not one federal privacy statute.
Read the pageEuropean Union: the instruments named
In the EU the GDPR sets the general privacy duty and the AI Act adds duties for certain AI systems.
Read the pageUnited Kingdom: the instruments named
The UK GDPR and the Data Protection Act 2018 set the privacy duty, and the regulator has published guidance on AI and data protection.
Read the pageAustralia: the instruments named
The Privacy Act 1988 (Cth) sets the federal privacy duty through the Australian Privacy Principles, and the reform programme has added and proposed AI-specific duties.
Read the pageThe rules this is built from
Read from the real rules, not invented. The 38 control pages are the ISO/IEC 42001:2023 Annex A controls, read from the standards library: 101 evidence lines and 80 common failure lines, each cited to its control. The privacy layer is read from the public ISO/IEC FDIS 27091 record, the ISO abstract and the stage feed. The draft text is not public and is not reproduced.
ISO/IEC 42001:2023, Annex A
Each page states the control in our words, the evidence an auditor asks for, the common gaps and the privacy work the draft points at.
Open the control indexWhat the draft covers
Scope and role, the lifecycle, the evaluation of consequences, treatment, operation and evidence.
Read the public recordThe role and the four markets
Controller or processor, the lifecycle stages, and the instruments named for the US, EU, UK and Australia.
Open the referenceThe ISO/IEC FDIS 27091 text is not public and is not reproduced. The ISO/IEC 42001:2023 text is not reproduced either. Every source.