ISO/IEC 42001:2023 · AI management system
ISO/IEC 42001
ISO/IEC 42001 is the international standard for an AI management system (AIMS): the governance an organization puts around the AI it builds or operates. Helmwart reads it the way it reads every framework — as an interpretive layer, mapping the Annex A controls that carry a design-time threat surface to the agentic threats they bear on, and honestly marking the rest as organizational process.
What ISO/IEC 42001 is
ISO/IEC 42001:2023 is the first international standard for an AI management system (AIMS) — the governance scaffolding an organization puts around the AI it develops or uses. It is the AI-specific counterpart to ISO/IEC 27001 for information security or ISO 9001 for quality: a certifiable management-system standard, structured as management clauses 4–10 plus a set of reference controls in Annex A.
In practice the standard asks an organization to define its AI policy, assign accountable roles, assess the impact of its AI systems on people and society, govern the data and the system life cycle, be transparent with the people affected, and manage its AI suppliers — then to keep evidence that it actually does these things, and to improve the system over time. It is a governance and assurance lens, not a threat taxonomy: where OWASP and MITRE ATLAS tell you what can go wrong, ISO 42001 asks whether you are running a system that would catch and manage it.
How Helmwart maps to it
Helmwart is a design-time threat-modeling tool, not an audit. It cannot make you certified to ISO 42001 — certification is an audited outcome of operating a management system, awarded by an accredited body. What Helmwart can do is show, control by control, which Annex A controls your threat model and placed mitigations actually bear on, and which are gaps — a coverage map you can fold into a Statement of Applicability, never a compliance verdict.
Two honest limits shape that map.
Most of Annex A is organizational, not technical. Of the 38 Annex A reference controls, 30 are policy, roles, resourcing and process controls — an AI policy exists, accountable roles are assigned, an impact-assessment process is defined. A design-time tool cannot satisfy those; they are your organization's process, and Helmwart marks them organizational rather than claiming a green. Only the 8 data, life-cycle, logging, transparency, intended-use and supplier controls carry a threat surface a model can assess — those are the ones mapped below to the agentic threats they bear on.
The mapping is interpretive. ISO/IEC 42001 is a copyrighted, paywalled standard. Every control description here is Helmwart's own summary of the control's intent, citing ISO 42001 — never the standard's verbatim text. Treat it as an interpretive layer, the same posture Helmwart takes toward every framework it reads.
To turn this reference into a live coverage read against a specific system, model it on the canvas and open the Compliance view — it scores each Annex A control as covered, at-risk or not-present from the findings your design actually raises, and lists the mitigations that close each gap.
Annex A reference controls
The 38 Annex A controls across 9 control objectives (A.2–A.10). Controls that carry a design-time threat surface are tagged mappable and list the agentic threats they bear on; the rest are tagged organizational — real controls, but your process, not a Helmwart control.
A.2 Policies related to AI
AI policy & alignment with other policies
-
A.2.2 AI policy organizational Top-level AI policy — governance, no design-time threat surface.
-
A.2.3 Alignment with other organisational policies organizational Reconcile the AI policy with security, privacy and ethics policy.
-
A.2.4 Review of the AI policy organizational Periodic review of the AI policy.
A.3 Internal organisation
Roles, responsibilities & escalation
-
A.3.2 AI roles and responsibilities organizational Assign accountable roles for the AI system.
-
A.3.3 Reporting of concerns organizational A route to raise concerns about the AI system.
A.4 Resources for AI systems
Data, tooling, compute & people
-
A.4.2 Resource documentation organizational Document the resources the AI system depends on.
-
A.4.3 Data resources organizational Document data resources used by the AI system.
-
A.4.4 Tooling resources organizational Document tooling resources.
-
A.4.5 System and computing resources organizational Document compute and system resources.
-
A.4.6 Human resources organizational Competence of the people building and running the AI.
A.5 Assessing impacts of AI
Impact on individuals & society
-
A.5.2 AI system impact assessment process organizational A defined impact-assessment process.
-
A.5.3 Documentation of AI system impact assessments organizational Record the impact assessments performed.
-
A.5.4 Assessing impact on individuals or groups organizational Assess potential harms to individuals and groups.
-
A.5.5 Assessing societal impacts organizational Assess broader societal impacts.
A.6 AI system life cycle
Responsible design, dev, deploy & operate
-
A.6.1.2 Objectives for responsible development organizational Set responsible-development objectives.
-
A.6.1.3 Processes for responsible design and development organizational Define responsible design/development processes.
-
A.6.2.2 AI system requirements and specification organizational Capture requirements, including security requirements.
-
A.6.2.3 Documentation of design and development organizational Document design and development decisions.
-
A.6.2.4 AI system verification and validation mappable Adversarial verification & validation of tools and execution before release.
-
A.6.2.5 AI system deployment organizational A controlled deployment process.
-
A.6.2.6 AI system operation and monitoring mappable Continuous monitoring of autonomous-write behaviour in operation.
-
A.6.2.7 AI system technical documentation organizational Maintain technical documentation.
-
A.6.2.8 AI system recording of event logs mappable Automatic, tamper-evident logging of agent actions for traceability.
A.7 Data for AI systems
Acquisition, quality, provenance & prep
-
A.7.2 Data for development and enhancement organizational Manage development and enhancement data.
-
A.7.3 Acquisition of data organizational Govern how data is acquired.
-
A.7.4 Quality of data for AI systems mappable Integrity of training, memory and retrieved data against poisoning and drift.
-
A.7.5 Data provenance mappable Provenance of data feeding the agent, to detect poisoned or untrusted sources.
-
A.7.6 Data preparation organizational Govern data preparation.
A.8 Information for interested parties
User documentation, reporting & incidents
-
A.8.2 System documentation and information for users mappable Transparent, non-deceptive information about what the agent does.
-
A.8.3 External reporting organizational A channel for external reporting.
-
A.8.4 Communication of incidents organizational Communicate AI incidents to those affected.
-
A.8.5 Information for interested parties organizational Inform interested parties about the AI system.
A.9 Use of AI systems
Responsible-use processes & intended use
-
A.9.2 Processes for responsible use organizational Define responsible-use processes.
-
A.9.3 Objectives for responsible use organizational Set responsible-use objectives.
-
A.9.4 Intended use of the AI system mappable Keep operation within intended use under untrusted input and manipulation.
A.10 Third-party & customer relationships
Responsibilities, suppliers & customers
-
A.10.2 Allocation of responsibilities organizational Allocate responsibilities across the AI value chain.
-
A.10.3 Suppliers mappable Third-party tools, models and agents: pinning, SBOM and supplier assurance.
-
A.10.4 Customers organizational Give customers the information to use the AI responsibly.
The management-system clauses (4–10)
Annex A is only half the standard. The management-system requirements — the part you are actually certified against — live in clauses 4 through 10, and they are organizational by nature. Helmwart does not assess these; they are audited process, not design-time surface. They are listed here so you can see the whole shape of an AIMS, not just its reference controls.
- Clause 4 Context of the organization Understand the organization, interested parties and the scope of the AIMS.
- Clause 5 Leadership Top-management commitment, an AI policy, and assigned roles and responsibilities.
- Clause 6 Planning Actions to address AI risks and opportunities, AI objectives and the impact assessment.
- Clause 7 Support Resources, competence, awareness, communication and documented information.
- Clause 8 Operation Operational planning and control, and running the AI system impact assessment.
- Clause 9 Performance evaluation Monitoring, measurement, internal audit and management review.
- Clause 10 Improvement Handling nonconformity and driving continual improvement of the AIMS.
Sources
- ISO/IEC 42001:2023 — Information technology · AI · Management system ↗ · ISO · the authoritative standard (paywalled; purchase from ISO)
- Run the coverage against your model → · Helmwart Compliance · live per-control read from your canvas findings