Kit certification ISO/IEC 42001

Mandatory scope statement (first doc auditors ask for)

Top-level AIMS policy: clause 5.2 commitments, principles, objectives, roles, prohibited uses (AI Act Art. 5), assessments, suppliers, AI literacy

AI policy + AI system impact assessment

Repeatable risk assessment + treatment process

GOVERN, MAP, MEASURE, MANAGE assessment: context, impacts, trustworthiness, scored risk register, controls, residual risk

Assess an AI system's benefits and harms to individuals, groups and society across its life cycle (ISO/IEC 42005:2025)

AIMS SoA: scope, risk treatment link, all 38 Annex A controls with basis, justification, status, owner, evidence, Annex B ref, extra controls, traceability

Measurable objectives + plans to achieve

AI literacy measures for staff and contractors: roles, competence levels, curriculum, records, assessment, refresh

AI supplier due diligence: tiering, provenance, data residency, OWASP LLM security, evals, bias, incidents, GPAI dependencies, Art. 25, scoring

Screen a proposed AI use case: data, affected people, AI Act prohibited/high-risk/transparency questions, tier, reviews

Audit schedule + report with findings

Review minutes – required inputs/outputs

NC + root cause + effectiveness check