The rules this is built from, and the law around them
The product reads the ISO/IEC 42001:2023 Annex A control set in full. The four markets below are the jurisdictions a buyer usually brings into an AI privacy question. Their law is named here only: this product does not state the text of a statute it does not cover. The reference pages carry the jurisdiction detail, and the clause in your own system where the finding is recorded is the one your auditor tests.
The 38 control records that apply today
A.2 A.2 Policies related to AI
A.3 A.3 Internal organization
A.4 A.4 Resources for AI systems
- A.4.2 Resource documentation
- A.4.3 Data resources
- A.4.4 Tooling resources
- A.4.5 System and computing resources
- A.4.6 Human resources
A.5 A.5 Assessing impacts of AI systems
- A.5.2 AI system impact assessment process
- A.5.3 Documentation of AI system impact assessments
- A.5.4 Assessing AI system impact on individuals or groups of individuals
- A.5.5 Assessing societal impacts of AI systems
A.6.1 A.6 AI system life cycle
- A.6.1.2 Objectives for responsible development of AI system
- A.6.1.3 Processes for responsible design and development of AI systems
A.6.2 A.6 AI system life cycle
- A.6.2.2 AI system requirements and specification
- A.6.2.3 Documentation of AI system design and development
- A.6.2.4 AI system verification and validation
- A.6.2.5 AI system deployment
- A.6.2.6 AI system operation and monitoring
- A.6.2.7 AI system technical documentation
- A.6.2.8 AI system recording of event logs
A.7 A.7 Data for AI systems
- A.7.2 Data for development and enhancement of AI system
- A.7.3 Acquisition of data
- A.7.4 Quality of data for AI systems
- A.7.5 Data provenance
- A.7.6 Data preparation
A.8 A.8 Information for interested parties of AI systems
- A.8.2 System documentation and information for users
- A.8.3 External reporting
- A.8.4 Communication of incidents
- A.8.5 Information for interested parties
A.9 A.9 Use of AI systems
- A.9.2 Processes for responsible use of AI systems
- A.9.3 Objectives for responsible use of AI system
- A.9.4 Intended use of the AI system
A.10 A.10 Third-party and customer relationships
Four markets, named
FTC Act, sector statutes and state law
The Federal Trade Commission Act section 5 on unfair or deceptive practices, the sector statutes where they apply, the state comprehensive privacy laws and the state AI rules. Named only. Record the instrument for each system and each population. The US page.
GDPR and the AI Act
The General Data Protection Regulation 2016/679, the AI Act Regulation (EU) 2024/1689 and the national implementations. Named only. Record the lawful basis and the AI Act class for each system. The EU page.
UK GDPR and the Data Protection Act 2018
The UK GDPR, the Data Protection Act 2018 and the ICO guidance on AI and data protection. Named only. Record the basis and the impact assessment for each system used on UK residents. The UK page.
Privacy Act 1988 and the APPs
The Privacy Act 1988 (Cth), the Australian Privacy Principles, the Notifiable Data Breaches scheme and state law. Named only. Record the APP basis and check the automated decision rules. The Australia page.
The rules this is built from
Read from the real rules, not invented. The 38 control pages are the ISO/IEC 42001:2023 Annex A controls, read from the standards library: 101 evidence lines and 80 common failure lines, each cited to its control. The privacy layer is read from the public ISO/IEC FDIS 27091 record, the ISO abstract and the stage feed. The draft text is not public and is not reproduced.
ISO/IEC 42001:2023, Annex A
Each page states the control in our words, the evidence an auditor asks for, the common gaps and the privacy work the draft points at.
Open the control indexWhat the draft covers
Scope and role, the lifecycle, the evaluation of consequences, treatment, operation and evidence.
Read the public recordThe role and the four markets
Controller or processor, the lifecycle stages, and the instruments named for the US, EU, UK and Australia.
Open the referenceThe ISO/IEC FDIS 27091 text is not public and is not reproduced. The ISO/IEC 42001:2023 text is not reproduced either. Every source.