For ISO/IEC 42001, an auditor asks for proof that your AI management system (AIMS) exists on paper and works in practice. Expect the governance documents first, such as policy, scope and risk treatment, then operating records: impact assessments, change approvals, training, incidents, internal audits and management review.
What is ISO 42001 asking you to run?
ISO/IEC 42001:2023 is a management system standard for artificial intelligence. Practitioner sources describe it as following the same high level structure as other ISO management system standards, which is why organizations that already run ISO 27001 find the shape familiar. The standard text is paywalled, so the lists below come from practitioner guidance. Check any clause reference against the official text before you rely on it.
This post explains the audit. It does not certify anyone. Only an accredited certification body can do that.
Which documents come first?
Guidance on audit preparation lists these governance records, and they are the usual opening requests:
- AIMS manual or overview, and an AI policy signed by top management
- A scope document: which AI systems, business units and boundaries are covered
- Risk assessment procedure, risk register and treatment plan linked to controls
- A Statement of Applicability listing the Annex A controls you apply, with reasons for exclusions
- Roles, responsibilities and an organization chart for AI oversight
- Measurable AI objectives with plans and progress tracking
If scope is vague, every later question gets harder. Write scope in terms an outsider can check: names of systems and owners.
Which operating records prove it works?
This is where audits are won or lost. Auditors review documents, interview staff to check competence and understanding, and observe operations to corroborate both.
- AI system impact assessments: what each system could do to people and society, with a date and a reviewer.
- Change management: approvals, records and refreshed assessments when a model, prompt or dataset changes.
- Competence and training: a skills matrix and attendance or completion records for the people who build and operate AI.
- Communication: proof that policies reached the staff, such as acknowledgments.
- Document and record control: version numbers, a document index, and a retention log.
- Incidents and nonconformities: AI incidents, root cause analysis, corrective actions and proof they were closed.
- Internal audit: plans, reports, findings and follow-up. Internal auditors should not be involved in operating the AIMS, to keep objectivity.
- Management review: agendas, minutes, attendance, decisions and action lists.
What goes wrong most often?
Practitioner write-ups report recurring gaps: the AI system inventory is out of date, and impact assessments refer to a model version that has since been replaced. Both are drift problems. The fix is to tie the inventory and assessments to the change process, so a model swap triggers a review automatically.
Auditors also compare documented procedures with actual practice. A procedure that says "every model change is reviewed" will be tested by sampling changes. Have the sample ready.
How can software help?
Automation can collect system produced evidence on a schedule: inventories, change records, scan results, with timestamps. Safeguard's compliance automation is built for that kind of record keeping, and its scanning can list the models and dependencies in your software. People still own the risk decisions, the impact assessments and the management review.
What to do
- Write the scope as a list of named AI systems with owners.
- Build the AI inventory, and link each system to its risk and impact records.
- Draft the Statement of Applicability and the reasons for each exclusion.
- Connect change management to assessments, so a model change triggers a review.
- Run an internal audit with someone independent of AIMS operations.
- Hold and minute a management review before the certification audit.
Quick check
Is ISO 42001 the same as ISO 27001?
No. ISO 27001 covers information security. ISO 42001 covers management of AI systems. They share a structure, so evidence practices carry over.
Who may carry out the internal audit?
Someone who is not involved in operating the AIMS, with management system audit experience and knowledge of the standard.
Sources
Last reviewed: 18 October 2026.
