FULL CONTENTS · 39 FILES
Every file in the ISO 42001 Compliance Suite.
Each file mapped to its ISO/IEC 42001 clauses and Annex A controls. Filter by type, search by name or code, click any row for the detail. Nothing is here unless a clause requires it or an applicable control implies it.
View the suite & pricing →Showing 39 of 39 files
| Type | Document | ClauseISO/IEC 42001 | Annex A controlISO/IEC 42001 | |
|---|---|---|---|---|
| AIMS Core | AIMS Manual and Scope AIMS-01 | 4.1; 4.2; 4.3; 4.4; 5.1 | — | |
| The scope of the AI management system, the context including the climate determination, and the process interactions carried through to where each one lands. | ||||
| Register | AI System Inventory AIMS-01-M1 | 4.3; 8.4 | A.4.2 | |
| Required record. Every AI system in scope with its intended purpose, owner, the role held — provider or deployer — and the status of its impact assessment. | ||||
| Policy | AI Policy AIMS-02 | 5.2 | A.2.2; A.2.3; A.2.4 | |
| What the organisation commits to on AI, aligned with the other policies rather than duplicating them. | ||||
| Form | Exception Request and Decision AIMS-02-M1 | — | A.2.4 | |
| | ||||
| AIMS Core | AI Objectives and Planning AIMS-03 | 6.2; 6.3 | A.6.1.2; A.9.3 | |
| Objectives that take applicable requirements into account, drawn from the register in AIMS-16. | ||||
| Form | Change Planning Record AIMS-03-M1 | 6.3 | — | |
| | ||||
| Register | Objectives Register AIMS-03-M2 | 6.2 | A.6.1.2 | |
| Required record. | ||||
| Procedure | Documented Information and Communication AIMS-04 | 7.4; 7.5 | — | |
| Document and record control, with the master list of all 39 files and the communication plan. | ||||
| Procedure | Competence and AI Resources AIMS-05 | 7.1; 7.2; 7.3 | A.4.2 to A.4.6 | |
| Competence, plus the resource categories specific to AI: data, tooling, computing and human oversight. If the resources are not available, the system specification is revised rather than proceeding in hope. | ||||
| Register | AI Resources Register AIMS-05-M1 | — | A.4.2 to A.4.6 | |
| Required record. Data, tooling, computing and human resources recorded per system. | ||||
| Register | Competence Register AIMS-05-M2 | 7.2 (d) | A.4.6 | |
| Required record. | ||||
| Procedure | AI Risk Management AIMS-06 | 6.1.1; 6.1.2; 6.1.3; 8.2; 8.3 | — | |
| The a-to-h sequence of clause 6.1.3, with Annex A used as a completeness check rather than a menu. Consequence assessed for the organisation and for people, the higher of the two driving the level. | ||||
| Register | AI Risk Register and Treatment Plan AIMS-06-M1 | 6.1.2; 6.1.3; 8.2; 8.3 | — | |
| Required record. Three consequence columns — organisation, individuals, societies — and a reference to the impact assessment that produced each risk. | ||||
| Register | Statement of Applicability AIMS-06-M2 | 6.1.3 | All | |
| Required record. All 38 Annex A controls, decided and justified, including the exclusions. | ||||
| Procedure | AI System Impact Assessment AIMS-07 | 6.1.4; 8.4 | A.5.2 to A.5.5 | |
| The consequences for individuals, groups and societies of the system working as designed. Performed before deployment, with at least one assessor who did not build the system, and performed in short form even for low-impact systems. | ||||
| Form | AI System Impact Assessment Record AIMS-07-M1 | 8.4 | A.5.4; A.5.5 | |
| Required record. One per system, with separate parts for individuals and groups, and for societies. | ||||
| Procedure | AI System Life Cycle AIMS-08 | 8.1 | A.6.1; A.6.2 | |
| Four stage gates from requirements to retirement, with third-party systems, retraining and decommissioning treated explicitly. | ||||
| Form | AI System Life Cycle Record AIMS-08-M1 | 8.1 | A.6.2 | |
| | ||||
| Procedure | Operation, Monitoring and Logging AIMS-09 | 8.1; 9.1 | A.6.2.6; A.6.2.8 | |
| What is monitored after release, what is logged, and how drift is detected before somebody else notices it. | ||||
| Procedure | Data Management for AI Systems AIMS-10 | — | A.7.2 to A.7.6 | |
| Acquisition, quality for the intended population, provenance and rights of use, preparation, and personal data. Almost everything that goes wrong in an AI system is decided before the model is trained. | ||||
| Form | Data Provenance and Quality Record AIMS-10-M1 | — | A.7.3; A.7.4 | |
| | ||||
| Procedure | Transparency and Information AIMS-11 | — | A.8.2 to A.8.5 | |
| Two audiences with different needs: users get documentation, people affected by outputs get to know a system was involved and how to question it. | ||||
| Form | AI System Technical Documentation AIMS-11-M1 | — | A.6.2.7 | |
| | ||||
| Form | Information for Users AIMS-11-M2 | — | A.8.2 | |
| | ||||
| Procedure | Concerns and AI Incidents AIMS-12 | — | A.3.3; A.8.4 | |
| One channel open from outside the organisation as well as inside, with protection from retaliation and the rule that an anonymous reporter is not identified. | ||||
| Form | Concern and Incident Record AIMS-12-M1 | — | A.8.4 | |
| | ||||
| Procedure | Third Parties, Suppliers and Customers AIMS-13 | — | A.10.2; A.10.3; A.10.4 | |
| Who answers for what along the value chain, including the question of who responds when a person affected by a decision asks why. | ||||
| Register | Supplier and Responsibility Allocation Register AIMS-13-M1 | — | A.10.2; A.10.3 | |
| Required record. Eight allocation columns, because A.10.2 requires the allocation itself to be documented. | ||||
| Procedure | Performance, Audit and Management Review AIMS-14 | 9.1; 9.2; 9.3 | — | |
| One loop, with the three arrangements that satisfy auditor objectivity in an organisation too small to have an independent function. | ||||
| Register | Internal Audit Programme and Report AIMS-14-M1 | 9.2 | — | |
| Required record. | ||||
| Form | Management Review Minutes AIMS-14-M2 | 9.3 | — | |
| Required record. | ||||
| Procedure | Nonconformity and Improvement AIMS-15 | 10.1; 10.2 | — | |
| Correction distinguished from corrective action, with the rule that the cause is almost never the person: if somebody forgot, the cause is that the process depended on memory. | ||||
| Register | Nonconformity and Corrective Action Register AIMS-15-M1 | 10.2 (f); 10.2 (g) | — | |
| Required record. | ||||
| Procedure | Legal, Regulatory and Contractual Requirements AIMS-16 | 4.2; 6.2; 8.1 | A.2.3; A.8.3; A.10.4 | |
| AI Act, data protection, intellectual property in training data, sector rules and contracts — tied to the role held for each system, and recording obligations that are not yet in application with their date. | ||||
| Register | Legal and Contractual Requirements Register AIMS-16-M1 | 4.2; 6.2 | — | |
| One row per obligation per role, with what it obliges you to do in operational terms rather than quoted legal text. | ||||
| AIMS Core | Implementation Guide AIMS-G01 | — | — | |
| The ninety-day sequence, what transfers if you already run ISO 27001, and the mistakes that cost time. | ||||
| AIMS Core | Glossary AIMS-G02 | — | — | |
| Terms defined in plain words, with the note that the authoritative source is ISO/IEC 22989. | ||||
| AIMS Core | Requirements to Documents Map AIMS-G03 | — | — | |
| Every clause and all 38 controls mapped to the file that satisfies it, with the column marking where the standard requires retention. | ||||
| AIMS Core | Cross-Mapping to ISO 27001 and the EU AI Act AIMS-G04 | — | — | |
| What transfers from an ISMS rated Full, Partial or New, and where the AI Act asks for something the standard does not. | ||||
No files match your filters.
References are to ISO/IEC 42001 — management-system clauses (4–10) and Annex A controls.
Ready to deploy the full ISO 42001 AI management system?
View the suite & pricing →