Can you automate evidence collection for ISO 42001?

You can automate part of ISO/IEC 42001 evidence: inventories, scan results, access lists, change logs and test outputs. You cannot automate the decisions the standard cares about most, such as risk acceptance, impact judgments and management review. Automate collection of facts, and keep people responsible for the conclusions.

ISO/IEC 42001 was published on 18 December 2023. Its scope covers establishing, implementing, maintaining and continually improving an AI management system, for any organization that provides or uses products or services that use AI systems. It is a management system standard, which means auditors look for a working system, not a single document.

What does an auditor want to see?

Your certification body decides the exact expectations. As with other ISO management system standards, expect questions in these groups.

• Scope and context: which AI systems are covered, and why.
• Leadership: an AI policy, assigned roles and objectives.
• Risk: how you assess and treat risks for AI systems, and how you assess impact.
• Operation: how systems are developed, deployed, monitored and retired.
• Checks: internal audit, management review and corrective actions.
• Third parties: how you treat suppliers of models, data and tools.

Each group needs records that show the activity happened on a date, by a named person, with a result.

What can be collected automatically?

Machine-generated facts are good candidates.

• An inventory of AI systems, models and datasets pulled from a registry or repository, with last-change dates.
• Software bills of materials for the services around the model, and vulnerability scan results over time.
• Access lists and role assignments exported from your identity provider.
• Change history: pull requests, approvals and deployment logs for the model code and prompts.
• Evaluation results from a test harness, stored with the date, the dataset version and the model version.
• Monitoring outputs and alert history for production behavior.
• Records of incidents, with timestamps from your ticketing system.

The test for each: can a script produce it, and can it be re-run next quarter with the same method?

What cannot be automated?

• The AI policy and its approval by leadership.
• Judgments that someone must own: whether a residual risk is acceptable, whether an impact on people is tolerable, whether a use is appropriate.
• Management review, which is a meeting with minutes and decisions.
• Internal audit, which needs an independent reviewer.
• Corrective actions, which need a cause analysis and a person who closes them.

A tool can remind people, collect attachments and keep a trail. It cannot decide for them, and an auditor will ask who did.

What does Safeguard automate here?

Safeguard's compliance docs say its framework library covers many frameworks, and that for each one a scan checks a set of requirements, lists the controls and offers policy templates. The docs name SOC 2, ISO/IEC 27001, the HIPAA Security Rule, PCI DSS and NIST CSF 2.0 as the frameworks where it also maps automated tests from connected systems. ISO/IEC 42001 appears in the library, but is not in that list, so plan for more of the evidence to come from your own people and tools. The docs also say each framework page states which requirements a scan decides and which need your evidence.

That is a support for your audit work, and it does not make anyone certified. Only a certification body can certify an organization.

What to do

1. List the evidence groups above and mark each item as machine-made or human-made.
2. For machine-made items, write the query or script and store it with the output, so the method is repeatable.
3. Set a schedule, such as monthly, for each export, and name who checks that it ran.
4. For human-made items, create a calendar for reviews and keep minutes in one place.
5. Keep an evidence index: item, source, owner, date, where it is stored.
6. Do a dry run with someone outside the project, and note what they could not find.

Quick check

Sources

• ISO/IEC 42001:2023 scope and publication date, as listed by Genorma
• Safeguard docs: Compliance
• Safeguard docs: All frameworks

Last reviewed: 18 October 2026.