ISO/IEC 42001:2023 · AIMS documentation
ISO 42001 required documents & audit evidence checklist
Which documents does ISO/IEC 42001 actually require? Use this clause-mapped checklist to organize documented information, audit records, and evidence for an Artificial Intelligence Management System (AIMS).
For AI governance, internal audit, technology risk, compliance and assurance teams.
The short answer
ISO 42001 requires documented information—not a fixed stack of templates.
An AIMS needs a defined scope, policy, risk and impact assessment processes, risk treatment and a Statement of Applicability, objectives, and records showing that assessments, operations, audits, management reviews and corrective actions actually occurred.
Clause 7.5 also requires organizations to maintain the other documented information necessary for the effectiveness of their AI management system. The number of files and their format depend on the organization and its AI activities. An item may exist within an approved register or platform rather than as a separate PDF. See the official ISO/IEC 42001 standard record.
01 / Clauses 4–10
Core ISO 42001 documented information checklist
The tables separate current management-system information from records of performance. One repository can hold both. Check a row only after locating the evidence and confirming its scope, version and use.
Policies, processes and plans
| Check | Required information or record | Clause | What the reviewer verifies |
|---|---|---|---|
| AIMS scopeDefine organizational boundaries, activities, AI uses, interested parties, and relevant external dependencies. | 4.3 | Confirm the version and scope match the AI operations actually reviewed. | |
| Documented AIMS and process interactionsExplain how the Artificial Intelligence Management System operates and how its processes connect. | 4.4 | Trace at least one governance decision from intake to monitoring. | |
| AI policyKeep an accessible policy approved through appropriate leadership arrangements and linked to AI objectives. | 5.2 | Check communication, alignment and responsibility for policy maintenance. | |
| Actions on risks and opportunitiesRetain the actions taken to identify and address AI risks and opportunities. | 6.1.1 | Find decisions, action owners, follow-up and evidence of evaluation. | |
| AI risk assessment processKeep a repeatable assessment method aligned with the AI policy, objectives and risk criteria. | 6.1.2 | Check whether two comparable assessments would use consistent criteria. | |
| AI risk treatment processDescribe how treatment options and necessary controls are selected and reviewed. | 6.1.3 | Trace assessed risks to treatment selection and implementation. | |
| Statement of Applicability (SoA)Identify necessary controls and justify inclusion and exclusion of Annex A reference controls and additional controls. | 6.1.3 | Check reasons, scope and links to implementation evidence. | |
| Risk treatment plan and necessary controlsKeep treatment decisions and the necessary controls available as documented information. | 6.1.3 | Confirm management approval of treatment and residual-risk acceptance. | |
| AI system impact assessment processDefine how effects on individuals, groups and societies are examined, including intended and foreseeable misuse. | 6.1.4 | Confirm the method considers affected parties, context and jurisdictions. | |
| AI objectivesRecord objectives and implementation planning: owner, resources, measures and timeframes. | 6.2 | Examine monitoring against the organization’s stated objectives. | |
| Competence evidenceMaintain appropriate records showing personnel are competent for AIMS-related work. | 7.2 | Sample evidence for reviewers, decision-makers and AI operators. |
Completed records and results
| Check | Required information or record | Clause | What the reviewer verifies |
|---|---|---|---|
| Impact assessment findingsDocument the assessed consequences and how findings inform the AI risk assessment. | 6.1.4 | Compare the dated findings with the current system and use case. | |
| Operational-process evidenceHave enough documented information to give confidence that planned AIMS processes occurred. | 8.1 | Sample approvals, changes, evaluations and operating controls; format varies. | |
| AI risk assessment resultsRetain results of assessments at planned intervals and relevant significant changes. | 8.2 | Check coverage, decisions, version, date and reassessment trigger. | |
| AI risk treatment resultsRetain results and verification of applied treatments, including revised treatment where needed. | 8.3 | Compare the plan with actual implementation and effectiveness testing. | |
| AI impact assessment resultsRetain results from impact assessments performed at planned intervals or significant changes. | 8.4 | Check affected parties and whether impact findings affect risk treatment. | |
| Monitoring and measurement resultsPreserve evidence from selected AIMS performance measures and analysis. | 9.1 | Confirm time periods, methods and follow-up of outliers. | |
| Internal audit programme and resultsKeep records that show the audit programme was performed and what audits concluded. | 9.2.2 | Check audit scope, criteria, independence, sampling, findings and follow-up. | |
| Management review resultsMaintain evidence of top-management review and improvement or change decisions. | 9.3.3 | Look for prior actions, audit findings, metrics, decisions and owners. | |
| Nonconformity and corrective-action resultsKeep evidence of problems, action taken and evaluation of corrective-action effectiveness. | 10.2 | Trace at least one finding to root cause, closure and verified effectiveness. |
Clause 8.1 requires documented information to the extent needed to have confidence in planned execution; it does not prescribe one universal “operational-control manual.” The two impact-assessment rows represent the documented planning process and the separate results generated under Clauses 6.1.4 and 8.4.
02 / Reference controls
Which Annex A documents do you need?
Annex A provides 38 reference controls across nine areas. Not every control must be implemented. Determine necessary controls from risk treatment, compare them with Annex A, and document the reasons for including or excluding controls in the SoA.
AI policy, accountability and concerns
Policy reviews, role allocations, escalation or concern-reporting records.
AI resources
Resource inventory: data, tools, computing systems, people and competencies.
AI impact controls
Impact assessment process, recorded results and people/society effects.
AI lifecycle
Requirements, design, test criteria, deployment plan, monitoring and technical documentation.
AI event logs
Document the lifecycle stages where logging is enabled; retain applicable event records.
Data governance
Data acquisition, quality requirements, provenance and preparation methodology.
User and interested-party information
Instructions, incident communications and external reporting obligations.
Responsible AI use
Authorized use, responsible-use processes, operating objectives and use guidance.
Suppliers and customers
Responsibility allocation, supplier-control process and customer expectations.
These are illustrative evidence groups—not 38 mandatory standalone documents. The SoA should address individual control applicability; do not use the nine groups above as a substitute for control-level analysis. Annex B provides implementation guidance rather than a second checklist of universally mandatory controls.
03 / Practical audit preparation
High-value artifacts that make an AIMS easier to audit
These formats are recommended for a usable evidence library. They are not each independently required by the standard; use them where they add clarity or demonstrate a selected control.
AI systems inventory
List deployed and planned AI uses, owners, suppliers, intended purposes, versions and oversight points.
Evidence register
Index control, claim, evidence source, owner, review period, and reviewer conclusion.
Supplier assurance file
Record what a supplier actually covers, scope limits, date, independence and change triggers.
AI evaluation dossier
Tie benchmarks and human-review tests to the actual model/version, population, acceptance criteria and outcomes.
Documentation control register
Track owners, approval, current versions, access, changes and retention rules.
04 / Auditing in practice
Follow one AI decision through its evidence.
Example: an organization uses a supplier-hosted AI assistant to classify incoming customer complaints. The company does not own the model, but its AIMS must address how staff use the service and how relevant externally provided services are controlled.
AIMS scope names the complaint workflow, business owner and supplier dependency.
Risk and impact reviews consider missed urgent cases, customer effects and uncertain performance.
The SoA links human escalation, supplier obligations and testing to treated risks.
Dated tests, exception logs and staff review samples show whether safeguards operated.
Auditor documents evidence limitations, exceptions, residual concerns and follow-up.
Example finding
Certificate received; evidence still incomplete.
The supplier provides a certification covering its AIMS, but not the customer’s complaint-prioritization configuration or performance in that workflow. The customer records what the certificate covers, tests the local use case, and identifies any gaps that remain. A supplier’s certificate does not replace evidence of the customer’s controls.
Related analysis: Third-party AI under ISO/IEC 42001.
05 / Auditor’s workpaper
Six questions for an ISO 42001 evidence review
Scope
Which AI systems, decisions, teams, suppliers and sites fall within the AIMS?
Criteria
Which exact ISO clause, selected control, policy or obligation is being tested?
Provenance
Who produced each piece of evidence, what period does it cover, and is it complete?
Testing
What independent inspection, reperformance or sampling supports the claimed control operation?
Limits
Where does evidence rely on suppliers, assumptions, unsampled systems or outdated results?
Decision
What is the conclusion, what remains unresolved, and who owns the next action?
Research on AI auditability identifies practical difficulties with evaluation measures, technical visibility, and the combination of skills needed in AI audits. A robust workpaper therefore records how a conclusion was reached—not merely whether a document was supplied. Li & Goel (2025).
Common questions
ISO 42001 documentation FAQ
What are the mandatory documents for ISO 42001?
The core standard explicitly requires documented information for the AIMS scope, management system, AI policy, risk and impact assessment processes, risk treatment and Statement of Applicability, AI objectives, competence, specified operational evidence, and results from assessments, monitoring, internal audits, management reviews and corrective actions. A separate file is not required for each topic where combined documentation remains clear and controlled.
Is a Statement of Applicability mandatory under ISO/IEC 42001?
Yes. Clause 6.1.3 requires an SoA identifying necessary controls and explaining inclusion and exclusion. It should account for relevant Annex A controls as well as necessary additional controls identified by the organization.
Are all Annex A controls and supporting documents mandatory?
No. Annex A is a reference set. Control selection follows the risk-treatment process. If a control is selected, its relevant documentation and operating evidence should be available; exclusions require clear justification in the SoA.
Do I need a model card or AI inventory to pass an AIMS audit?
Neither term is a universal standalone document prescribed by ISO 42001. Both can help demonstrate system understanding, technical documentation, responsible use and oversight. The necessary detail depends on scope, selected controls, risks and applicable external requirements.
Can an organization using only third-party AI comply with ISO 42001?
Yes. The standard addresses organizations that develop, provide or use AI. An organization using supplier-hosted systems still needs to assess its own use, manage relevant supplier relationships, allocate responsibilities and obtain evidence suitable for its controls.
How long should ISO 42001 records be retained?
There is no single retention period for every AIMS record prescribed by the standard. Set periods using operational needs, applicable law, contracts, audit requirements and the controls selected; ensure records remain retrievable and protected under Clause 7.5.3.
Does ISO 42001 certification prove that each AI model is accurate or safe?
No. Certification assesses conformity of the AIMS within its certified scope; it does not independently validate every claim about every AI model and deployment. ISO/IEC 42006 specifies additional requirements for bodies auditing and certifying AIMS.
Documentation basis
Standards and research
Clause mappings were checked against ISO/IEC 42001:2023. The checklist is an editorial implementation aid, not a reproduction of the standard. Peer-reviewed work informs audit practice; it does not add ISO requirements.
- ISO/IEC 42001:2023. Artificial intelligence management system requirements. Official ISO record · IEC record
- ISO/IEC 42005:2025. AI system impact assessment guidance. Official ISO record
- ISO/IEC 42006:2025. Requirements for AIMS audit and certification bodies. Official ISO record
- NIST AI Risk Management Framework Playbook. Voluntary operational practices for AI risk management. NIST resource
- McIntosh et al. (2024). From COBIT to ISO 42001: evaluating cybersecurity frameworks for LLM-related opportunities, risks and compliance. Computers & Security. DOI
- Li and Goel (2025). Artificial intelligence auditability and auditor readiness for auditing AI systems. International Journal of Accounting Information Systems. DOI
- Mitchell et al. (2019). Model Cards for Model Reporting. FAT* 2019. DOI