ISO/IEC 42001:2023 · AI management system
ISO/IEC 42001
ISO/IEC 42001 is the international standard for an AI management system (AIMS): the governance an organization puts around the AI it builds or operates. Helmwart reads it the way it reads every framework — as an interpretive layer, mapping the Annex A controls that carry a design-time threat surface to the agentic threats they bear on, and honestly marking the rest as organizational process.
What ISO/IEC 42001 is
ISO/IEC 42001:2023 is the first international standard for an AI management system (AIMS) — the governance scaffolding an organization puts around the AI it develops or uses. It is the AI-specific counterpart to ISO/IEC 27001 for information security or ISO 9001 for quality: a certifiable management-system standard, structured as management clauses 4–10 plus a set of reference controls inAnnex A.
In practice the standard asks an organization to define its AI policy, assign accountable roles, assess the impact of its AI systems on people and society, govern the data and the system life cycle, be transparent with the people affected, and manage its AI suppliers — then to keep evidence that it actually does these things, and to improve the system over time. It is a governance and assurance lens, not a threat taxonomy: where OWASP and MITRE ATLAS tell you what can go wrong, ISO 42001 asks whether you are running a system that would catch and manage it.
How Helmwart maps to it
Helmwart is a design-time threat-modeling tool, not an audit. It cannot make you certified to ISO 42001 — certification is an audited outcome of operating a management system, awarded by an accredited body. What Helmwart can do is show, control by control, which Annex A controls your threat model and placed mitigations actually bear on, and which are gaps — a coverage map you can fold into a Statement of Applicability, never a compliance verdict.
Two honest limits shape that map.
Most of Annex A is organizational, not technical. Of the 38 Annex A reference controls, 30 are policy, roles, resourcing and process controls — an AI policy exists, accountable roles are assigned, an impact-assessment process is defined. A design-time tool cannot satisfy those; they are your organization's process, and Helmwart marks them organizational rather than claiming a green. Only the 8 data, life-cycle, logging, transparency, intended-use and supplier controls carry a threat surface a model can assess — those are the ones mapped below to the agentic threats they bear on.
The mapping is interpretive. ISO/IEC 42001 is a copyrighted, paywalled standard. Every control description here is Helmwart's own summary of the control's intent, citing ISO 42001 — never the standard's verbatim text. Treat it as an interpretive layer, the same posture Helmwart takes toward every framework it reads.
To turn this reference into a live coverage read against a specific system, model it on thecanvas and open the Compliance view — it scores each Annex A control as covered, at-risk or not-present from the findings your design actually raises, and lists the mitigations that close each gap.
Annex A reference controls
The 38 Annex A controls across 9 control objectives (A.2–A.10). Controls that carry a design-time threat surface are tagged mappable and list the agentic threats they bear on; the rest are taggedorganizational — real controls, but your process, not a Helmwart control.
A.2Policies related to AI
AI policy & alignment with other policies
A.2.2AI policyorganizational Top-level AI policy — governance, no design-time threat surface.
A.2.3Alignment with other organisational policiesorganizational Reconcile the AI policy with security, privacy and ethics policy.
A.2.4Review of the AI policyorganizational Periodic review of the AI policy.
A.3Internal organisation
Roles, responsibilities & escalation
A.3.2AI roles and responsibilitiesorganizational Assign accountable roles for the AI system.
A.3.3Reporting of concernsorganizational A route to raise concerns about the AI system.
A.4Resources for AI systems
Data, tooling, compute & people
A.4.2Resource documentationorganizational Document the resources the AI system depends on.
A.4.3Data resourcesorganizational Document data resources used by the AI system.
A.4.4Tooling resourcesorganizational Document tooling resources.
A.4.5System and computing resourcesorganizational Document compute and system resources.
A.4.6Human resourcesorganizational Competence of the people building and running the AI.
A.5Assessing impacts of AI
Impact on individuals & society
A.5.2AI system impact assessment processorganizational A defined impact-assessment process.
A.5.3Documentation of AI system impact assessmentsorganizational Record the impact assessments performed.
A.5.4Assessing impact on individuals or groupsorganizational Assess potential harms to individuals and groups.
A.5.5Assessing societal impactsorganizational Assess broader societal impacts.
A.6AI system life cycle
Responsible design, dev, deploy & operate
A.6.1.2Objectives for responsible developmentorganizational Set responsible-development objectives.
A.6.1.3Processes for responsible design and developmentorganizational Define responsible design/development processes.
A.6.2.2AI system requirements and specificationorganizational Capture requirements, including security requirements.
A.6.2.3Documentation of design and developmentorganizational Document design and development decisions.
A.6.2.4AI system verification and validationmappable Adversarial verification & validation of tools and execution before release.
A.6.2.5AI system deploymentorganizational A controlled deployment process.
A.6.2.6AI system operation and monitoringmappable Continuous monitoring of autonomous-write behaviour in operation.
A.6.2.7AI system technical documentationorganizational Maintain technical documentation.
A.6.2.8AI system recording of event logsmappable Automatic, tamper-evident logging of agent actions for traceability.
A.7Data for AI systems
Acquisition, quality, provenance & prep
A.7.2Data for development and enhancementorganizational Manage development and enhancement data.
A.7.3Acquisition of dataorganizational Govern how data is acquired.
A.7.4Quality of data for AI systemsmappable Integrity of training, memory and retrieved data against poisoning and drift.
A.7.5Data provenancemappable Provenance of data feeding the agent, to detect poisoned or untrusted sources.
A.7.6Data preparationorganizational Govern data preparation.
A.8Information for interested parties
User documentation, reporting & incidents
A.8.2System documentation and information for usersmappable Transparent, non-deceptive information about what the agent does.
A.8.3External reportingorganizational A channel for external reporting.
A.8.4Communication of incidentsorganizational Communicate AI incidents to those affected.
A.8.5Information for interested partiesorganizational Inform interested parties about the AI system.
A.9Use of AI systems
Responsible-use processes & intended use
A.9.2Processes for responsible useorganizational Define responsible-use processes.
A.9.3Objectives for responsible useorganizational Set responsible-use objectives.
A.9.4Intended use of the AI systemmappable Keep operation within intended use under untrusted input and manipulation.
A.10Third-party & customer relationships
Responsibilities, suppliers & customers
A.10.2Allocation of responsibilitiesorganizational Allocate responsibilities across the AI value chain.
A.10.3Suppliersmappable Third-party tools, models and agents: pinning, SBOM and supplier assurance.
A.10.4Customersorganizational Give customers the information to use the AI responsibly.
The management-system clauses (4–10)
Annex A is only half the standard. The management-system requirements — the part you are actually certified against — live in clauses 4 through 10, and they are organizational by nature. Helmwart does not assess these; they are audited process, not design-time surface. They are listed here so you can see the whole shape of an AIMS, not just its reference controls.
- Clause 4Context of the organizationUnderstand the organization, interested parties and the scope of the AIMS.
- Clause 5LeadershipTop-management commitment, an AI policy, and assigned roles and responsibilities.
- Clause 6PlanningActions to address AI risks and opportunities, AI objectives and the impact assessment.
- Clause 7SupportResources, competence, awareness, communication and documented information.
- Clause 8OperationOperational planning and control, and running the AI system impact assessment.
- Clause 9Performance evaluationMonitoring, measurement, internal audit and management review.
- Clause 10ImprovementHandling nonconformity and driving continual improvement of the AIMS.
Sources
- ISO/IEC 42001:2023 — Information technology · AI · Management system ↗ · ISO · the authoritative standard (paywalled; purchase from ISO)
- Run the coverage against your model → · Helmwart Compliance · live per-control read from your canvas findings