ISO/IEC 42001 asks for about sixteen pieces of documented information in its clauses, plus records for the Annex A controls you apply. You do not need a separate procedure for every clause. This article lists what the standard actually requires, and what you can leave out.
When organisations start on ISO/IEC 42001, the first question is often “which documents do we need?”. The answer is shorter than most templates suggest. The standard asks for documented information in specific clauses. Everything else is your choice, under clause 7.5, based on what your teams need to work well.
Documents the clauses require
| Clause | Documented information | Type |
|---|---|---|
| 4.3 | Scope of the AI management system | Document |
| 5.2 | AI policy | Document |
| 6.1.2 | AI risk assessment process | Document |
| 6.1.3 | AI risk treatment process and the Statement of Applicability | Document |
| 6.1.4 | AI system impact assessment process | Document |
| 6.2 | AI objectives | Document |
| 7.2 | Evidence of competence | Record |
| 8.1 | Evidence that processes ran as planned | Record |
| 8.2 | Results of AI risk assessments | Record |
| 8.3 | Results of AI risk treatment | Record |
| 8.4 | Results of AI system impact assessments | Record |
| 9.1 | Monitoring and measurement results | Record |
| 9.2 | Internal audit programme and audit results | Record |
| 9.3 | Results of management reviews | Record |
| 10.2 | Nonconformities, actions taken and results of corrective action | Record |
| 7.5 | Any other documented information you decide you need | Your choice |
Records for the Annex A controls
Annex A has 38 controls. You decide which apply in your Statement of Applicability. The controls you apply then need evidence. The ones that most often need written records are:
- A.5 impact assessment. The completed AI system impact assessments for each system.
- A.6.2.2 and A.6.2.3 requirements and design. What each AI system must do, and how it was designed and built.
- A.6.2.4 verification and validation. Test plans and results before release.
- A.6.2.7 technical documentation. What users and other teams need to know about the system.
- A.6.2.8 event logs. Logs of system operation, kept for a defined period.
- A.7.5 data provenance. Where training and operational data came from.
- A.10.3 suppliers. Due diligence on the AI vendors you rely on.
What you can leave out
The standard does not ask for a procedure per clause, a separate AI manual, or a new document set beside your ISMS. If you hold ISO/IEC 27001, you can extend its processes for document control, internal audit, management review and corrective action to cover the AI management system. Annex D of ISO/IEC 42001 expects the two systems to work together.
We built the KPMG in India AI management system this way. We kept to the documented information the standard requires and used the procedures and records the teams already had. The implementation took about seven weeks, and SGS certified it. Read the KPMG case study.
What auditors check first
- Scope and inventory agree. Every AI system in scope appears in your inventory, and the inventory is current.
- The Statement of Applicability is justified. Each excluded control has a reason that matches your risk assessment.
- Records are real. Risk and impact assessments are dated, signed off and linked to actual systems.
- Life cycle evidence exists. Test results and logs show the system was verified before release and monitored after.
The last point decides most timelines. A policy can be written in a day. Test and monitoring records take time to build up. See ISO 42001 certification cost and timeline in India for how this drives the schedule.
Frequently asked questions
Is there a mandatory document list for ISO 42001?
The standard does not publish a single list. The list above collects every place where the clauses ask for documented information. Annex A records depend on the controls you apply.
Can we use templates?
Templates help with structure, but auditors look for evidence that the process runs in your organisation. A template filled with generic text is a common reason for findings at stage 1.
Do we need a separate AI risk register?
Not necessarily. You can hold AI risks in your existing risk register, if the AI risk assessment method and criteria are clear.
Need help deciding what to write? Start with an ISO/IEC 42001 gap assessment, or see our ISO/IEC 42001 consulting.