Governance and Policy ManagementHow Complyan helps you achieve ISO/IEC 42001 compliance
ISO/IEC 42001 asks organizations to prove something more difficult than having an AI policy. They need an operating Artificial Intelligence Management System (AIMS) with defined accountability, documented risk decisions, measurable objectives and evidence that AI governance continues after deployment.
ISO describes ISO/IEC 42001:2023 as the first international management system standard for organizations that develop, provide or use AI-based products and services. It requires organizations to establish, implement, maintain and continually improve an AIMS.
That creates a practical GRC problem. AI inventories may sit with technology teams, supplier reviews with procurement and evidence in shared folders. Risks are then tracked somewhere else.
Complyan brings those activities into one compliance structure. ISO/IEC 42001 is available within Complyan’s framework library, allowing organizations to assign requirements, connect controls to evidence and track readiness from one platform.
ISO/IEC 42001 Compliance Starts With an AIMS
ISO/IEC 42001 follows the structure used across ISO management system standards. Clauses 4 through 10 address organizational context, leadership, planning, support, operation, performance evaluation and improvement.
The standard also requires AI risk assessment and treatment. Organizations need a Statement of Applicability showing which controls have been selected or excluded and the reasoning behind those decisions. ISO
This means ISO 42001 compliance cannot be completed by importing a control list and marking requirements complete.
The organization needs to demonstrate how the requirements operate through real processes.
What an Auditor Asks to See
ISO/IEC 42001 uses the same clause structure as ISO 27001, with Clauses 4 to 10 defining the management system and Annex A adding 38 controls across nine areas. The practical question for each requirement is what record proves it.
Requirement | Typical evidence | How Complyan holds it |
Clause 4, context and AIMS scope | Scope statement, list of AI systems and stakeholders | AI inventory recording purpose, owner, model, data sources, life cycle stage, and risk tier |
Clause 5, leadership and AI policy | Approved AI policy, assigned roles | Policy approvals and staff attestations |
Clause 6, risk, treatment, and AI system impact assessment | Risk register, impact records | Risk and impact assessment per AI system, with an AI threat library |
Clause 8, operation | Proof treatments were carried out | Life cycle activity records and an AI incident register |
Clause 9, performance evaluation | Internal audit, management review | Audit workspace and leadership reporting |
Clause 10, improvement | Corrective actions | Findings turned into actions with owners and due dates |
Annex A, third-party relationships | Supplier due diligence | AI vendors linked to third-party risk assessments |
The right column reflects capabilities Complyan describes for its AI governance work. The standard’s text governs what an assessor tests.
Why This Matters More Than a New Certification Line Item
Most organizations adopted AI tools faster than they built any governance around them. A team spins up a model for one workflow, another team licenses a different vendor’s assistant for something unrelated, and within a year the organization has a scattered collection of AI capabilities with no shared standard for risk, oversight, or performance measurement. This is precisely the gap CMMI AIM was built to close.
A real case study makes the mechanism concrete: GTSC applied CMMI AIM to convert a fragmented set of AI initiatives into a governed, scalable, value-driven enterprise program, giving leadership a single maturity baseline to measure AI capability against rather than a patchwork of disconnected pilots. This is the same discipline traditional CMMI has always applied to software delivery, now pointed at AI specifically: assess where capability genuinely stands, identify the gaps, and appraise progress against a recognized standard rather than an internal, self-graded claim.
Bring AI Suppliers Into the AIMS
ISO 42001 explicitly recognizes the role of suppliers, partners and third parties involved in providing or developing AI systems. ISO
That is important because many organizations do not build their own foundation models.
A single AI service may rely on a model provider or cloud infrastructure while introducing further subprocessors. Compliance teams need to know what data the provider receives, how the service is governed and whether security documentation remains current.
Complyan Third-Party Risk Management provides a central vendor inventory with risk assessments, questionnaires and ongoing monitoring.
Complyan AI can also assist with vendor document review and security questionnaires, with answers tied back to supporting documentation.
This reduces the amount of supplier assurance work performed manually while keeping the assessment record available for review.
Automate Evidence Collection Without Automating Accountability
ISO certification depends heavily on evidence.
A policy needs approval history. Training needs records. Risk treatment needs proof of completion. Controls need evidence showing that the process operates as described.
Collecting that manually shortly before an audit creates predictable problems: expired screenshots, missing records and evidence that cannot be tied to a requirement.
Complyan’s integrations connect cloud, identity and security tools with compliance tests so evidence can be collected directly from relevant systems. The platform currently lists hundreds of integrations across security and business technology categories.
Automation helps maintain the evidence trail. Accountability still remains with the control owner.
What ISO/IEC 42001 Adds to an ISO 27001 Program
The two standards share a management-system skeleton, so policies, roles, awareness, supplier management, incident handling, and internal audit overlap. Complyan’s ISO 27001 guide covers that base. What ISO/IEC 42001 adds is AI-specific:
AI system impact assessment: a look at the effect of each system on individuals, groups, and society, beyond the organization’s own risk.
Life cycle control: design, data, deployment, monitoring, and retirement each need defined controls.
Data for AI systems: training and operating data need documented provenance and quality checks.
Third-party and customer relationships: models and services bought from others still need assessment, because responsibility stays with the organization using them.
Cross mapping lets evidence collected for ISO 27001 count toward ISO/IEC 42001 wherever a control overlaps, so teams work on the genuinely new requirements rather than repeating the shared ones.
Where the Platform Helps and Where People Decide
A platform keeps the inventory, assessments, policies, and evidence in one place, reminds owners, and re-tests controls on a schedule. Complyan’s AI agents chase evidence and draft documents, and each agent action is approved by a person and logged.
People still decide the judgment calls: what is in scope, which risks are accepted, what an impact assessment concludes, and whether a policy reflects how the organization really works. Auditors test those decisions, so they need named owners and recorded reasoning.
A Practical Path
Scope: register every AI system and set the boundaries of the AIMS.
Assess: run risk and impact assessments for each system and set measurable objectives.
Map: load the standard, reuse existing ISO 27001 evidence, and list the gaps.
Implement: Complyan’s governance and policy management tools hold the AI policy, approvals, and attestations, while Complyan’s cyber risk management platform keeps AI risks alongside the rest of the register.
Extend to suppliers: Complyan’s third-party risk management assesses AI vendors through the same questionnaires and scoring as other suppliers.
Audit: Complyan’s audit and compliance management platform gives auditors a workspace to test controls and sample evidence, and Complyan’s executive and board reporting supports management review.
Conclusion: Make ISO 42001 a Working Management System
ISO/IEC 42001 compliance becomes difficult when AI governance is spread across policy documents, risk registers and supplier files with no reliable connection between them.
A stronger AIMS connects the requirement to an owner, the owner to a control and the control to current evidence.
That is where Complyan provides practical value: ISO/IEC 42001 requirements can be managed alongside AI risks, supplier assessments and evidence while existing controls are reused across other frameworks.
The result is a compliance programme that can answer the questions an ISO 42001 audit will eventually ask: What AI do you govern? What risks have you identified? What controls address them? Who owns those controls? And what evidence proves they are working?
When those answers already exist in the GRC programme, ISO/IEC 42001 readiness becomes far easier to maintain.
Frequently Asked Questions
What is ISO/IEC 42001?
It is the first international standard for AI management systems, published in December 2023, according to ISO.
Do we need ISO 27001 first?
ISO/IEC 42001 is its own certifiable standard, a sibling of ISO 27001 under a shared management-system template. Existing ISO 27001 work carries over, but confirm certification prerequisites with your certification body.
Is ISO/IEC 42001 available in Complyan?
Per Complyan, the standard is preloaded in its framework library with its clauses and Annex A controls, and each control has an owner, evidence, and a status.
Can AI agents replace the compliance team?
No. Complyan’s agents draft and chase, and a person approves and logs each action.
How do we start?
Run Complyan’s cyber maturity assessment to find your baseline, then register your AI systems.