# ISO/IEC 42001:2023 (AI Management System) Annex A Controls

> The first international AI Management System (AIMS) standard. 38 Annex A controls covering AI policy, AI lifecycle, data for AI, information for interested parties, and use of AI systems by or from third parties. Pairs directly with EU AI Act compliance and is increasingly required in enterprise AI vendor risk reviews.

- Source: https://support.icompaas.com/compliance/iso-42001-2023
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## ISO/IEC 42001:2023 (AI Management System) Annex A Controls: control library

38 controls in 2 sections. Each control page has implementation guidance and the evidence to collect; append `.md` to any link for Markdown.

### Organizational controls

ISO/IEC 42001:2023 (AI Management System) Annex A Controls

- [ISO/IEC 42001:2023 A.2.2 — Policies for the responsible development or use of AI systems](https://support.icompaas.com/compliance/iso-42001-2023/a-2-2-policies-for-the-responsible-development-or-use-of-ai-systems)
- [ISO/IEC 42001:2023 A.2.3 — Alignment with other organizational policies](https://support.icompaas.com/compliance/iso-42001-2023/a-2-3-alignment-with-other-organizational-policies)
- [ISO/IEC 42001:2023 A.2.4 — Review of policies for responsible AI](https://support.icompaas.com/compliance/iso-42001-2023/a-2-4-review-of-policies-for-responsible-ai)
- [ISO/IEC 42001:2023 A.3.2 — AI roles and responsibilities](https://support.icompaas.com/compliance/iso-42001-2023/a-3-2-ai-roles-and-responsibilities)
- [ISO/IEC 42001:2023 A.3.3 — Reporting of concerns](https://support.icompaas.com/compliance/iso-42001-2023/a-3-3-reporting-of-concerns)
- [ISO/IEC 42001:2023 A.4.2 — Resources documentation](https://support.icompaas.com/compliance/iso-42001-2023/a-4-2-resources-documentation)
- [ISO/IEC 42001:2023 A.4.3 — Data resources](https://support.icompaas.com/compliance/iso-42001-2023/a-4-3-data-resources)
- [ISO/IEC 42001:2023 A.4.4 — Tooling resources](https://support.icompaas.com/compliance/iso-42001-2023/a-4-4-tooling-resources)
- [ISO/IEC 42001:2023 A.4.5 — System and computing resources](https://support.icompaas.com/compliance/iso-42001-2023/a-4-5-system-and-computing-resources)
- [ISO/IEC 42001:2023 A.4.6 — Human resources](https://support.icompaas.com/compliance/iso-42001-2023/a-4-6-human-resources)
- [ISO/IEC 42001:2023 A.5.2 — Process for impact assessment](https://support.icompaas.com/compliance/iso-42001-2023/a-5-2-process-for-impact-assessment)
- [ISO/IEC 42001:2023 A.5.3 — Documentation of AI system impact assessments](https://support.icompaas.com/compliance/iso-42001-2023/a-5-3-documentation-of-ai-system-impact-assessments)
- [ISO/IEC 42001:2023 A.5.4 — Assessment of AI system impact on individuals and groups](https://support.icompaas.com/compliance/iso-42001-2023/a-5-4-assessment-of-ai-system-impact-on-individuals-and-groups)
- [ISO/IEC 42001:2023 A.5.5 — Assessment of societal impact](https://support.icompaas.com/compliance/iso-42001-2023/a-5-5-assessment-of-societal-impact)
- [ISO/IEC 42001:2023 A.8.2 — System documentation and information for users](https://support.icompaas.com/compliance/iso-42001-2023/a-8-2-system-documentation-and-information-for-users)
- [ISO/IEC 42001:2023 A.8.3 — External reporting](https://support.icompaas.com/compliance/iso-42001-2023/a-8-3-external-reporting)
- [ISO/IEC 42001:2023 A.8.4 — Communication of incidents](https://support.icompaas.com/compliance/iso-42001-2023/a-8-4-communication-of-incidents)
- [ISO/IEC 42001:2023 A.8.5 — Information for interested parties](https://support.icompaas.com/compliance/iso-42001-2023/a-8-5-information-for-interested-parties)
- [ISO/IEC 42001:2023 A.9.2 — Processes for responsible use of AI systems](https://support.icompaas.com/compliance/iso-42001-2023/a-9-2-processes-for-responsible-use-of-ai-systems)
- [ISO/IEC 42001:2023 A.9.3 — Objectives for responsible use of AI systems](https://support.icompaas.com/compliance/iso-42001-2023/a-9-3-objectives-for-responsible-use-of-ai-systems)
- [ISO/IEC 42001:2023 A.9.4 — Intended use of AI systems](https://support.icompaas.com/compliance/iso-42001-2023/a-9-4-intended-use-of-ai-systems)
- [ISO/IEC 42001:2023 A.10.2 — Allocation of responsibilities](https://support.icompaas.com/compliance/iso-42001-2023/a-10-2-allocation-of-responsibilities)
- [ISO/IEC 42001:2023 A.10.3 — Suppliers](https://support.icompaas.com/compliance/iso-42001-2023/a-10-3-suppliers)
- [ISO/IEC 42001:2023 A.10.4 — Customers](https://support.icompaas.com/compliance/iso-42001-2023/a-10-4-customers)

### Technological controls

ISO/IEC 42001:2023 (AI Management System) Annex A Controls

- [ISO/IEC 42001:2023 A.6.1.2 — Objectives for responsible development of AI systems](https://support.icompaas.com/compliance/iso-42001-2023/a-6-1-2-objectives-for-responsible-development-of-ai-systems)
- [ISO/IEC 42001:2023 A.6.1.3 — AI system design and development process](https://support.icompaas.com/compliance/iso-42001-2023/a-6-1-3-ai-system-design-and-development-process)
- [ISO/IEC 42001:2023 A.6.2.2 — AI system requirements and specification](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-2-ai-system-requirements-and-specification)
- [ISO/IEC 42001:2023 A.6.2.3 — AI system design and system architecture](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-3-ai-system-design-and-system-architecture)
- [ISO/IEC 42001:2023 A.6.2.4 — Data acquisition](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-4-data-acquisition)
- [ISO/IEC 42001:2023 A.6.2.5 — Quality of data for AI systems](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-5-quality-of-data-for-ai-systems)
- [ISO/IEC 42001:2023 A.6.2.6 — Data provenance](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-6-data-provenance)
- [ISO/IEC 42001:2023 A.6.2.7 — Preparation of data](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-7-preparation-of-data)
- [ISO/IEC 42001:2023 A.6.2.8 — Development of AI system](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-8-development-of-ai-system)
- [ISO/IEC 42001:2023 A.7.2 — Data for development and enhancement of AI systems](https://support.icompaas.com/compliance/iso-42001-2023/a-7-2-data-for-development-and-enhancement-of-ai-systems)
- [ISO/IEC 42001:2023 A.7.3 — Acquisition of data](https://support.icompaas.com/compliance/iso-42001-2023/a-7-3-acquisition-of-data)
- [ISO/IEC 42001:2023 A.7.4 — Quality of data](https://support.icompaas.com/compliance/iso-42001-2023/a-7-4-quality-of-data)
- [ISO/IEC 42001:2023 A.7.5 — Data provenance](https://support.icompaas.com/compliance/iso-42001-2023/a-7-5-data-provenance)
- [ISO/IEC 42001:2023 A.7.6 — Data preparation](https://support.icompaas.com/compliance/iso-42001-2023/a-7-6-data-preparation)