ISO/IEC 42001:2023: every control, and what you already have

79 controls 132 frameworks share controls with it International verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

ISO/IEC 42001:2023 AI Management System Evidence & Implementation Kit

79 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
NIST SP 800-53 Rev 5	68	measure it →
SOC 2	67	measure it →
ISO 27001:2022	64	measure it →
ISO 27002:2022	63	measure it →
NIST Cybersecurity Framework 2.0	61	measure it →
EU AI Act	38	measure it →
NIST AI Risk Management Framework (AI RMF 1.0)	38	measure it →
ISO 22301:2019	33	measure it →
PCI DSS 4.0	33	measure it →
ISO 14001:2015	28	measure it →
ISO 22000:2018	27	measure it →
ISO 37301:2021	27	measure it →

Every control

Code	Control	Also in
`10.1`	Continual improvement	40
`10.2`	Nonconformity and corrective action	44
`4.1`	Understanding the organization and its context	29
`4.2`	Understanding the needs and expectations of interested parties	27
`4.3`	Determining the scope of the management system	19
`4.4`	Management system	20
`5.1`	Leadership and commitment	40
`5.2`	Policy	17
`5.3`	Roles, responsibilities and authorities	37
`6.1`	Actions to address risks and opportunities	32
`6.1.2`	Risk assessment	45
`6.1.3`	Risk treatment	23
`6.1.4`	AI system impact assessment	6
`6.2`	Objectives and planning to achieve them	19
`6.3`	Planning of changes	3
`7.1`	Resources	15
`7.2`	Competence	24
`7.3`	Awareness	24
`7.4`	Communication	48
`7.5`	Documented information	35
`7.5.2`	Creating and updating	21
`7.5.3`	Control of documented information	21
`8.1`	Operational planning and control	29
`8.2`	AI risk assessment	22
`8.3`	AI risk treatment	23
`8.4`	AI system impact assessment	15
`9.1`	Monitoring, measurement, analysis and evaluation	40
`9.2`	Internal audit	44
`9.2.2`	Internal audit programme	13
`9.3`	Management review	39
`9.3.2`	Management review inputs	4
`9.3.3`	Management review results	2
`A.10`	Third-party and customer relationships	8
`A.10.2`	Allocating responsibilities	14
`A.10.3`	Suppliers	21
`A.10.4`	Customers	3
`A.2`	Policies related to AI	5
`A.2.2`	AI policy	10
`A.2.3`	Alignment with other organizational policies	7
`A.2.4`	Review of the AI policy	9
`A.3`	Internal organization	10
`A.3.2`	AI roles and responsibilities	30
`A.3.3`	Reporting of concerns	10
`A.4`	Resources for AI systems	27
`A.4.2`	Resource documentation	9
`A.4.3`	Data resources	9
`A.4.4`	Tooling resources	6
`A.4.5`	System and computing resources	15
`A.4.6`	Human resources	19
`A.5`	Assessing impacts of AI systems	3
`A.5.2`	AI system impact assessment process	10
`A.5.3`	Documentation of AI system impact assessments	7
`A.5.4`	Assessing AI system impact on individuals or groups	9
`A.5.5`	Assessing societal impacts of AI systems	4
`A.6`	AI system life cycle	10
`A.6.1.2`	Objectives for responsible development of AI systems	6
`A.6.1.3`	Processes for responsible design and development of AI systems	14
`A.6.2.2`	AI system requirements and specification	8
`A.6.2.3`	Documentation of AI system design and development	12
`A.6.2.4`	AI system verification and validation	15
`A.6.2.5`	AI system deployment	8
`A.6.2.6`	AI system operation and monitoring	16
`A.6.2.7`	AI system technical documentation	10
`A.6.2.8`	AI system event logging	15
`A.7`	Data for AI systems	6
`A.7.2`	Data for development and enhancement of AI systems	6
`A.7.3`	Acquisition of data	8
`A.7.4`	Quality of data for AI systems	8
`A.7.5`	Data provenance	11
`A.7.6`	Data preparation	7
`A.8`	Information for interested parties of AI systems	4
`A.8.2`	System documentation and information for users	13
`A.8.3`	External reporting	10
`A.8.4`	Communication of incidents	45
`A.8.5`	Information for interested parties	9
`A.9`	Use of AI systems	6
`A.9.2`	Processes for responsible use of AI systems	7
`A.9.3`	Objectives for responsible use of AI system	8
`A.9.4`	Intended use of the AI system	5

Tell me when ISO/IEC 42001:2023 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Risk-based audit programme with frequency, methods and responsibilities
Audit plans with criteria and scope per audit
Auditor independence records
Audit reports to management and tracking of findings to closure
documented audit programme with frequency and methods
auditor independence declarations

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Auditors auditing their own work named by 3 frameworks

What this page is

A control-level reference for ISO/IEC 42001:2023, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition