This mapping covers the technical infrastructure layer of ISO 42001 Annex A compliance. ISO 42001 requires both organisational and technical controls. This repo addresses the technical controls; organisational controls (policies, governance structures, roles, training, third-party management) are addressed by the parent framework and by the implementing organisation's management system.
ISO 42001 Annex A sections A.2 through A.10 are mapped below. Each section lists the Annex A controls, the infrastructure controls that support them, and notes on coverage scope.
Control plane protection ensures AI policy configurations are tamper-proof. Technical controls enforce what policies declare. Organisational policy definition is out of scope for this repo.
A.2.3
Internal use AI policy
IAM-01, IAM-02, DAT-01, DAT-02
Authentication, least privilege, data classification, and minimisation enforce internal use policies at the technical layer.
A.2.4
AI policy for third parties
SUP-01, SUP-02, SUP-05, SEC-07
Model provenance, risk assessment, tool supply chain auditing, and endpoint credential protection govern third-party AI component usage.
Authentication, least privilege, control/data plane separation, and access auditing enforce role-based access. Role definition is organisational.
A.3.3
Reporting AI concerns
IR-01, IR-02, IR-06
AI-specific incident categories, detection triggers, and communication protocols provide the technical infrastructure for concern reporting.
A.3.4
AI governance
NET-06, IAM-03, LOG-07, SUP-07
Control plane protection, plane separation, log integrity, and AI-BOM provide technical infrastructure for governance. Governance structure is organisational.
Model risk assessment, incident category definitions, and action classification by impact support impact assessment. Assessment methodology is organisational.
A.5.3
AI system lifecycle
SUP-01, SUP-04, SUP-07, SUP-08, IR-04
Provenance, fine-tuning security, AI-BOM, vulnerability monitoring, and rollback capability support lifecycle management.
A.5.4
AI system design and development
NET-01, IAM-04, SEC-01, DAT-02
Zone architecture, tool invocation constraints, credential isolation, and data minimisation are design-stage decisions.
A.5.5
AI system testing
SUP-02, SUP-04, LOG-05, SAND-06
Risk assessment, post-training evaluation, drift detection, and code scanning support testing processes.
A.5.6
AI system deployment
SUP-01, SUP-06, TOOL-01, NET-02
Provenance verification, safety model integrity, manifest validation, and bypass prevention support secure deployment.
A.5.7
AI system operation
LOG-01 through LOG-10, NET-08, SESS-01
Full logging suite, cross-zone monitoring, and session boundaries support operational monitoring.
A.5.8
AI system maintenance
IR-04, SUP-08, SUP-06, SEC-05
Rollback, vulnerability monitoring, integrity verification, and credential rotation support maintenance.
AI-BOM, tool manifests, and the structured control documentation support system documentation. Document content is organisational.
A.8.3
AI system explainability
LOG-01, LOG-04, DEL-02, TOOL-06
Model I/O logs, agent chain reconstruction, delegation audit trails, and tool invocation logs provide the data needed for explainability. Explainability methods are organisational.
A.8.4
Information about AI system interaction
LOG-01, LOG-02, DAT-07
I/O logging, guardrail decision logging, and conversation history management support interaction transparency. User-facing disclosures are organisational.
Provenance, risk assessment, tool/plugin supply chain, and vulnerability monitoring govern third-party AI components. Supplier management processes are organisational.
A.10.3
Third-party AI customers
DAT-06, SEC-01, NET-07, LOG-09
Response leakage prevention, credential isolation, gateway enforcement, and log redaction protect customer data in multi-tenant AI deployments.
A.10.4
Interested parties for AI systems
IR-06, IR-07, LOG-10
Communication protocols, post-incident review, and SIEM correlation support stakeholder engagement. Stakeholder identification is organisational.
Technical enforcement of policies; policy creation is organisational
A.3 Internal Organisation
7 controls
Technical infrastructure for governance; organisational structure is out of scope
A.4 Resources
11 controls
Resource usage controls at infrastructure level
A.5 Development
16 controls
Lifecycle security from design through maintenance
A.6 Data
12 controls
Data integrity, quality, and protection at infrastructure level
A.7 Performance
10 controls
Monitoring, detection, and response infrastructure
A.8 Transparency
7 controls
Data and logging infrastructure supporting transparency
A.9 Accountability
10 controls
Record-keeping, auditing, and attribution infrastructure
A.10 Third Parties
8 controls
Supply chain and multi-tenant protection
Note: Full ISO 42001 compliance requires both the technical infrastructure controls in this repo and the organisational controls (policies, governance, training, roles, processes) addressed by the implementing organisation's AI management system. This mapping covers the technical layer only.
AI Runtime Behaviour Security, 2026 (Jonathan Gill).