The policy
A new customer commitment needs a manager’s approval.
An AI policy should show up in everyday work.
The business connects company rules to actions, approvals and their outcomes. Its operating record can inform an ISO 42001 review, alongside the wider work of running an AI management system.
A policy becomes useful when it changes the work.
One proposed customer promise connects the rule, the action and the record a reviewer can return to.
Northgate delivery noteIllustrative
The work
A note promising the revised delivery date is held. Nothing sent.
The review
The rule, the held draft and any later decision can be examined together.
One recorded action can inform a management review. It does not establish that the whole management system is effective.
A management system needs evidence of how it operates.
ISO/IEC 42001 addresses an organization’s AI management system. Policies and responsibilities need to connect with the way AI is developed or used. Selected operational records can support that assessment, alongside the wider management-system documentation and review process.
Review the selected Annex A references.
The descriptions below explain product evidence associated with the current catalog references. They are not quotations from the standard or a complete assessment of its requirements.
ReferenceWhat the record contributesWhat still needs review
Annex A.6.2.8
What the record contributesReceipts record each action in order, which gives the review an event history.
What still needs reviewCoverage is limited to activity captured in the relevant scope and time window.
Annex A.9.2
What the record contributesHolds and recorded human approvals provide evidence of oversight.
What still needs reviewThe review must assess the wider processes for responsible AI use. Observed activity alone does not prove intervention.
Annex A.6.2.7
What the record contributesA named responsible person for each agent and an evidence packet for the agreed scope give the review its documentation.
What still needs reviewA packet does not replace the management system’s complete documentation and records.
Mapping version 2026.09.3. Selected references support a review; they do not establish compliance or certification. Packet availability is confirmed for your deployment.
Keep the management system larger than its event log.
Use operational evidence to inform your management-system work, with the standard and your assessment scope as the authority.
Receipts & verification- 01
Organizational context, leadership, and AI policy
- 02
Risk and impact assessment, objectives, and control selection
- 03
Internal audit, management review, and continual improvement
Questions about ISO 42001?
Does this certify our organization to ISO 42001?
No. Certification requires an independent assessment of the organization’s AI management system. Selected catalog mappings and evidence exports support preparation, not certification.
Are all Annex A controls mapped?
No. The current catalog includes three selected references. Use the licensed standard and the organization’s assessment scope to determine the full set of applicable requirements and controls.
Can we review one agent rather than the whole organization?
Where packet generation is available, a review can cover one registered agent and a defined period. That narrower record does not redefine the scope of the company’s AI management-system assessment.
Go back to the source.
The authoritative framework and the scope of your review remain the reference points.