# ISO/IEC 42001 A.6.1.3 — AI system design and development process

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_iso42001_a613_2b6ed5ec6a-isoiec-42001-a613-ai-system-design-and-development-process
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 42001 (AI Management System)](https://support.icompaas.com/support/solutions/c_gen_iso42001) › [Technological controls](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso42001_technologicalcontrols)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 42001 · Control A.6.1.3 · Priority: high · Component: Technological controls

### What this control covers

A controlled AI system design and development process shall be established, implemented, and continually improved.

### Why it matters

Vulnerabilities introduced in code are 100× cheaper to fix in development than in production; this control is the place where security shifts left.

### How to implement

#### AWS

Use **CodeBuild** with [VPC-isolated](https://aws.amazon.com/codebuild/) build environments and **CodeArtifact** for an internal package mirror so builds don't pull straight from the public registry. Sign artefacts with **AWS Signer**.

#### Azure

Use **Azure DevOps Pipelines** with mandatory approvals on production environments and **Microsoft Defender for DevOps** for secret scanning across GitHub/ADO/GitLab in one pane.

#### GCP

**Vertex AI Model Registry** with model-card metadata, **Model Garden** for vetted base models, and **Sensitive Data Protection** on training/inference inputs.

#### GitHub

Apply **branch protection** on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use **CODEOWNERS** for required reviewers, **Dependabot** + **CodeQL** for SAST, and the **Dependency graph / SBOM** export for vendor disclosures.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.
-   `code_repo_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.
-   `ticketing_workflow` — See the iCompaas Evidence library for the canonical source for this evidence type.

Policies, repository controls, and workflow evidence should demonstrate an established and controlled AI design and development process, including reviews, approvals, and continuous improvement activities. Focus: AI system design and development process.

### Quick checklist

-   Develop — Development Process

### Related articles on this site

-   [NIST 800-171 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.](https://support.icompaas.com/support/solutions/articles/62000229280-nist-800-171-3-4-1-establish-and-maintain-baseline-configurations-and-inventories-of-organizational-s)
-   [NIST 800-171 3.12.4 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to](https://support.icompaas.com/support/solutions/articles/62000229333-nist-800-171-3-12-4-develop-document-and-periodically-update-system-security-plans-that-describe-sy)
-   [NIST 800-171 3.13.3 Separate user functionality from system management functionality.](https://support.icompaas.com/support/solutions/articles/62000229336-nist-800-171-3-13-3-separate-user-functionality-from-system-management-functionality-)
-   [CMMC 2.0 CM.2.061 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.](https://support.icompaas.com/support/solutions/articles/62000229465-cmmc-2-0-cm-2-061-establish-and-maintain-baseline-configurations-and-inventories-of-organizational-sy)