ISO 42001 technical controls are the runtime mechanisms and records that prove an AI management system works in practice, not just on paper. ISO/IEC 42001:2023 is the first certifiable standard for managing artificial intelligence, and it is written as a management system rather than a checklist of technical requirements. An auditor still expects working evidence: a live inventory of the AI in use, enforced policy, data protection inside the interaction flow, governed agent tool calls, and conversation-level audit logs.

Most ISO 42001 programs fail their first audit not because the Annex A binder is thin, but because the documented controls cannot produce runtime evidence that policy fired at the moment an employee or agent touched AI. Clause 9 performance evaluation asks for live inventory records, conversation-level logs, and inline enforcement artifacts that no policy document generates. This guide maps what the standard requires on paper, what it requires at runtime, and how to close the distance between the two.

Last updated: June 2026.

ISO/IEC 42001 Requires a Management System, Not a Control Checklist

ISO/IEC 42001:2023 was published in December 2023 as the first certifiable AI management system standard (ISO, 2023). It follows the same Harmonized Structure as ISO 27001, so its requirement clauses run from Clause 4 through Clause 10: context, leadership, planning, support, operation, performance evaluation, and improvement.

The standard adds Annex A, a set of 38 reference controls grouped under 9 control objectives that cover AI policy, internal organization, resources, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, responsible use, and third-party relationships. These controls are principle-based. They tell you what governance outcome to achieve, not which logging format or enforcement engine to deploy.

You select applicable controls in a Statement of Applicability and justify each inclusion or exclusion against your AI system impact assessment. Documented information is the evidence the standard names. That is where most programs stop, and it is where audits get uncomfortable. For the wider set of frameworks this standard sits inside, see our guide to AI compliance frameworks.

ISO 42001 Names Five Classes of Documented Information You Must Maintain

ISO 42001 requires documented information across its clauses and Annex A controls, and an auditor expects to find all of it before evaluating whether the controls work. The standard uses the phrase “documented information” deliberately: it covers both the documents that define the system and the records that prove it ran.

Five classes carry most of the audit weight, and each maps to a clause or Annex A objective. Treat this as the paper layer the runtime layer later has to evidence.

The first four classes are documents you author once and revise. The fifth class is different in kind. Clause 9 performance evaluation asks you to monitor, measure, analyze, and evaluate the AI management system, and that demand cannot be satisfied by a document you wrote in advance. It requires records generated while the system operated. That distinction is where most programs discover their gap.

Annex A Control Objectives Demand Records No Policy Binder Produces

Several Annex A control objectives require documented information that only exists if a control ran in the live AI path, not if a policy described it. The objectives covering the AI system life cycle, data for AI systems, and responsible use each presume operational records as their evidence base.

Map each objective to the documented information it implies, and the runtime requirement becomes explicit. A life-cycle control that governs AI applications in use needs an inventory that reflects current reality, not a spreadsheet last edited two quarters ago. A data control that governs information flowing into AI tools needs classification records from the actual flow. A responsible-use control needs evidence that policy acted on real interactions.

The pattern is consistent. The document defines the control; the record proves it operated. ISO 42001 asks for both, and the second one is the one a binder cannot produce.

Documented Controls Are Not Working Controls

A policy document does not detect a prompt, classify a file, or block an upload. It describes intent. The gap between written intent and enforced behavior is where AI governance programs fail their first real test.

The data shows the gap is wide. Only 38% of organizations have a formal, comprehensive AI policy, up from 28% a year earlier, even though 90% report employees using AI (ISACA, 2026). Confidence in handling failures is moving the wrong way: the share of organizations rating their AI incident response as excellent fell from 28% to 18% in a single year (Stanford HAI, 2026).

The cost of weak enforcement is now a forecast, not a theory. Gartner predicts that by 2030, half of AI agent deployment failures will trace to insufficient runtime enforcement of agent capabilities and multisystem interoperability (Gartner, 2026). An ISO 42001 auditor reads those numbers the same way. The question is not whether you wrote a policy. The question is whether the policy acts at the point where an employee or an agent touches AI.

Clause 7.2 Expects Documented Competence, Not Just an Org Chart

ISO 42001 Clause 5.3 and Clause 7.2 require documented evidence of who owns each part of the AI management system and proof that those people are competent to run it. An org chart names the boxes; the standard wants the responsibility assignments and the competence records behind them.

Three documentation obligations sit under this requirement, and audits probe each one. First, role and responsibility definitions: who owns AI policy, who approves new AI tools, who reviews incidents, and who signs the Statement of Applicability. Second, competence evidence: training records, certifications, or demonstrated experience showing each role-holder can perform the function. Third, awareness records: evidence that the wider workforce knows the AI policy and their obligations under it.

This matters because enforcement decisions carry accountability. When inline policy coaches a user, grants a limited-time exception, or blocks an upload, an auditor asks who authorized that policy and who is competent to tune it. Tie the runtime control back to a named, documented owner, and Clause 7.2 is satisfied. Leave the control ownerless, and the evidence chain breaks even if the technical control works.

The Runtime Evidence an ISO 42001 Audit Needs, Mapped to Framework Obligations

ISO 42001 does not hand you a control list, so you map its clauses and Annex A objectives onto evidence you can actually produce. Two neighboring frameworks make the mapping concrete. The NIST AI Risk Management Framework organizes AI risk work into four functions: govern, map, measure, and manage (NIST, 2023). The European Union AI Act goes further for high-risk systems and requires technical documentation under Article 11 and automatic event logging across the system lifetime under Article 12 (EU AI Act, 2024). The table below ties each evidence category to the framework hooks it satisfies and the runtime control that generates it.

Every credible piece of evidence comes from a control that acts in the interaction path, not from a report assembled after the fact.

Records Retention Turns Runtime Evidence Into Audit Evidence

Runtime evidence only counts at audit if you retain it under a defined schedule, and ISO 42001 Clause 7.5 requires documented information to be controlled, available, and protected for as long as the management system needs it. The standard does not name a number of months; it requires you to set, document, and follow a retention period proportionate to your risk and obligations.

Set retention by the obligation the record satisfies, not by storage convenience. Conversation-level audit logs that evidence Clause 9 monitoring need to span at least a full evaluation cycle so an auditor can see trend, not a snapshot. Records tied to regulated processes inherit the retention floor of that regulation: a banking or insurance interaction log follows the institution’s existing recordkeeping schedule, and an EU AI Act high-risk system carries the Article 12 logging-retention expectation. Document the schedule, define who can access archived records, and protect them from alteration, or the evidence loses its value the moment it is questioned.

The operational point is concrete. A platform that captures conversation-level interaction records governs them with role-based access control and retains them on schedule, so the record an auditor asks for in month eleven is still there, still intact, and still attributable to a named policy decision.

From a Paper Management System to Runtime Evidence, Step by Step

Turning Annex A intent into audit-ready evidence is a sequence, not a single project. Aurascape automatically discovers and understands the full context of tens of thousands of AI applications in use and in build (Aurascape, 2026), which gives the sequence a factual starting point rather than a guess.

1. Build a live inventory. Discover the AI applications, copilots, coding assistants, agents, and MCP servers already in use, including the long tail of embedded AI, and attribute risk to each.
2. Write policy that can be enforced. Express each rule as an action the system can take in the moment: allow, coach, warn, block, or redact.
3. Enforce inline. Apply that policy on the live AI exchange, across browser, desktop, and command-line paths, so the rule fires before sensitive data leaves.
4. Govern the tool calls. Sign approved agent tool calls, block unsigned ones, and keep cross-call data lineage so a chained action is traceable end to end.
5. Record the interaction. Keep conversation-level interaction records for audit and effectiveness, governed by role-based access control for privacy, and retain them on a documented schedule.
6. Map and review. Tie each control and its records back to the relevant ISO 42001 clause, then review effectiveness and feed corrective action into the management system.

Aurascape runs the detect, classify, and protect steps in real time across AI interactions, with patented workflow automation for real-time coaching and limited-time exceptions and agent-driven incident management (Aurascape, 2026). That is the difference between a control you can describe and one you can evidence.

Agent Tool Calls Are the Evidence Frameworks Assume Away

Most governance frameworks were written for a human-in-the-loop world. They assume a person reads an answer and decides what to do next. Agents break that assumption.

The distinction matters for evidence. Human-to-AI usage produces a prompt and a response a control can inspect. Human-to-agent delegation hands a task to an agent that then reasons and acts on its own through tool calls that read data, write changes, and trigger downstream systems. The OWASP Top 10 for LLM Applications names this risk directly as Excessive Agency, entry LLM06 (OWASP, 2025).

Prompt-and-response inspection cannot see that action layer, so the audit trail stops exactly where the risk starts. Aurascape closes the gap with two channels: an AI Proxy that governs the intelligence channel of prompts and responses, and a Zero-Bypass MCP Gateway that governs the tool-execution channel by cryptographically signing approved tool calls and blocking unsigned ones (Aurascape, 2026). MCP is one mechanism inside that tool-execution story, not the whole of it. The result is an execution path that produces evidence instead of a blind spot. For the full design, see our breakdown of agentic AI security architecture.

Documented Controls Versus Working Controls Decides the First Audit

ISO 42001 certification turns on whether your documented controls produce working evidence, and the first audit is where the two are reconciled. A program with a complete binder and no runtime records passes the document review and stalls at performance evaluation. This is the landing the whole standard builds toward: Clause 9 is satisfied by records, not by prose.

Read the standard’s own demand back to itself. It asks you to monitor, measure, analyze, and evaluate the AI management system. None of those four verbs describes a document. Each describes an activity that leaves a record only if a control ran in the live AI path. The program that treats Annex A as a writing exercise has written the wrong artifact.

The fix is not more documentation. It is a control layer that acts where employees and agents touch AI and emits the inventory records, enforcement artifacts, and conversation-level logs the audit asks for. Write the policy, then make the policy fire, then keep what firing produced. An ISO 42001 program does not fail because the binder was incomplete; it fails because the binder was the only thing that existed.

How Aurascape Compares to the Tools Your Security Team Already Runs

ISO 42001 evidence has to come from somewhere in your stack, and the options cluster around two approaches: extend a legacy web or data control to cover AI, or run an AI-native layer that inspects the interaction itself. The table compares each on the control signal it reads, where it enforces, how it handles agent tool calls, and the AI-interaction evidence it can produce.

Aurascape is an additive layer that runs alongside the secure service edge, data loss prevention, and data security tools you already operate, with no rip and replace. The incumbents report on their native domains; the AI-interaction evidence an ISO 42001 audit asks for comes from the layer that inspects the AI exchange itself.

Frequently Asked Questions About ISO 42001 Technical Controls

Does ISO 42001 require specific technical logging?

ISO 42001 is principle-based and asks for documented information and effective controls proportionate to your impact assessment, not a named log format. Specific technical logging is required elsewhere: the EU AI Act mandates automatic event logging for high-risk systems under Article 12, and in practice conversation-level logs are how you evidence the ISO 42001 monitoring clauses.

How long do we have to retain ISO 42001 records?

ISO 42001 Clause 7.5 requires you to control, protect, and retain documented information for as long as the management system needs it, but it sets no fixed number. You define a retention period proportionate to your risk and any regulation that governs the underlying process, then document and follow it.

What documented information does ISO 42001 require before an audit?

At minimum you need a signed AI policy with measurable objectives, a Statement of Applicability covering all 38 Annex A controls, an AI system impact assessment, role and competence records, and operational and performance records. The first four are documents; the last is runtime evidence that controls actually ran.

How is ISO 42001 different from the NIST AI RMF?

The NIST AI RMF is a voluntary methodology built around four functions: govern, map, measure, and manage. ISO 42001 is a certifiable management system you can be audited against, so the two pair well: use the NIST AI RMF to structure the risk work and ISO 42001 to formalize and certify the system around it.

What documented evidence of roles and competence does an auditor expect?

Clause 5.3 and Clause 7.2 expect defined ownership for each part of the AI management system plus competence records for the people in those roles. An org chart names the boxes; the standard wants the responsibility assignments, training or certification evidence, and workforce awareness records behind them.

Can a security platform make us ISO 42001 compliant?

No single tool grants certification, because an accredited auditor certifies the management system and counsel interprets your regulatory obligations. A platform like Aurascape operationalizes the technical controls and generates the runtime evidence, which is what shortens the path to a successful audit.

What technical evidence should we produce first?

Start with a live inventory of the AI applications, agents, and MCP servers in use, since every later control depends on knowing what exists. Then enforce policy inline and keep the records, govern agent tool calls, retain conversation-level audit logs under role-based access control, and map each artifact back to the relevant ISO 42001 clause.

How Aurascape Turns Annex A Controls Into Audit-Ready Runtime Evidence

ISO 42001 programs fail their first audit when documented controls cannot produce runtime evidence, and Aurascape is built to close exactly that gap. The platform discovers the AI applications, agents, and MCP servers in use and in build, attributes risk to each, and enforces policy inline on the live AI exchange so the inventory record and the enforcement artifact exist as a byproduct of the control running, not as a document written afterward.

For the agent layer the frameworks assume away, Aurascape governs both legs of execution: the AI Proxy inspects the intelligence channel of prompts and responses, and the Zero-Bypass MCP Gateway governs the tool-execution channel by signing approved tool calls and blocking unsigned ones, with cross-call data lineage. Conversation-level interaction records are governed by role-based access control and retained on a documented schedule, which is how Clause 9 performance evaluation and the EU AI Act Article 12 logging expectation get evidenced rather than described.

The proof shows up in regulated deployments. At The Police Credit Union, deploying Aurascape in a two-phase rollout of visibility first and enforcement second produced an audit-ready position for National Credit Union Administration guidance and the NIST AI Risk Management Framework, a projected 27% productivity gain, and a projected 83% reduction in AI-related risk (Aurascape, 2026). One honest boundary: no platform makes you ISO 42001 certified, because certification is a determination made by an accredited auditor and the legal reading of any regulation belongs with your counsel. What a platform does is operationalize the controls and produce the evidence those assessments depend on.

---

Aurascape is the control layer that makes ISO 42001 policy fire at the moment an employee or agent touches AI, so Clause 9 is satisfied by records instead of prose. In a short working session we can map your ISO 42001 controls to the runtime evidence your next audit will ask for.

See how Aurascape turns AI governance into audit-ready evidence →