Direct answer: ISO/IEC 42001 Annex A provides reference control objectives for managing AI responsibly across its lifecycle. Organisations use it with the standard's risk-based requirements to decide which controls apply, implement them in context and retain evidence that they operate.
See the ISO/IEC 42001 standard information on ISO.org for the authoritative publication. This practical guide does not reproduce the copyrighted standard text.
What Annex A is for
Annex A helps translate an AIMS risk assessment into practical control objectives. It provides a reference set rather than a promise that every control is appropriate in every scope. The organisation should document applicability, rationale, ownership, implementation status and links to evidence in its control selection record.
Practical control themes
AI system lifecycle and intended use
Controls should make purpose, users, limitations, design decisions, release approvals and lifecycle changes visible. Evidence may include system records, model documentation, requirements, test results and change approvals.
Data and model management
Consider data quality, provenance, rights, preparation, model selection, evaluation and known limitations. Evidence should be proportionate to the system and traceable to a version or release.
Transparency and human oversight
Document what users and affected people need to know, when a person must review an output and how they can override, stop or escalate a system. Training and oversight records demonstrate operation.
Performance, impact and responsible use
Define monitoring, evaluation, impact assessment, fairness or other relevant criteria, incident handling and continual-improvement triggers. Do not assume one metric fits every use case; record justified choices.
Third parties and supply chain
Supplier due diligence, contractual responsibilities, service changes and evidence access should be considered where external models, data or platforms affect AI risk.
What auditors expect to see
An auditor will test whether the AIMS works, not just whether an Annex A spreadsheet is complete. Useful evidence includes an AI inventory, risk and impact assessments, applicability decisions, approved policies, model and data records, evaluation results, human-oversight logs, supplier reviews, monitoring, incidents, internal audit and management review.
Sample evidence should connect a system and intended purpose to a risk, control owner, approval, operating record and follow-up action. Stale templates, unsupported claims or evidence from a different system can expose a readiness gap.
ISO 42001 Annex A compared with ISO 27001 Annex A
ISO 27001 Annex A addresses information-security risks such as confidentiality, integrity, availability, access and resilience. ISO 42001 Annex A addresses AI governance and lifecycle risks, including intended use, data and model considerations, transparency, human oversight, impacts and responsible operation. The standards can share management processes and tools, but an ISMS does not prove that AI-specific controls operate.
Organisations with an ISMS can build on it through ISO 27001 implementation, then extend risk criteria, inventory, ownership and evidence for an AIMS. Our ISO 42001 consultancy can assess Annex A coverage and prepare for internal audit and independent certification. For regulatory context, read the ISO 42001 and EU AI Act compliance guide.
FAQ
Annex A provides a reference set of AI management control objectives that help organisations address AI-specific governance and lifecycle risks within an AIMS.
Auditors expect documented applicability decisions and operating evidence such as inventories, approvals, risk assessments, evaluation results, oversight records, monitoring, incidents and management review.
ISO 27001 Annex A focuses on information security risks, while ISO 42001 Annex A addresses AI governance and lifecycle risks such as intended use, data and model considerations, human oversight and impacts.
Make Annex A evidence practical
Start with your systems, risks and operating records—not a generic control spreadsheet.
Explore ISO 42001 consultancy →