ISO/IEC 42001

ISO/IEC 42001:2023 is the world's first certifiable AI management system (AIMS) standard. This companion volume is the hands-on field guide to its Annex A controls - written by a practicing ISO/IEC 27001, 27701, and 42001 auditor.

Volume 2 - Annex A Controls works through all 38 Annex A controls (A.2 through A.10), each explained with a single repeatable 12-element template: control overview and attributes, requirement intent, law-and-standard mapping, learning objectives, implementation guidance, audit-floor lessons, an auditor-perspective checklist (15 questions) and an organization self-check (15 questions), five core evidence types with a completed sample, worked industry cases including generative AI, audit-report examples (conformity / minor / major), a bilingual nonconformity form with corrective action, and FAQ plus ISO/IEC 27001 integration tips.

The controls span AI policy and governance, the AI system life cycle, data for AI, information for interested parties, responsible use, and third-party and supplier relationships. A single fictional company carries a consistent document set, risk register, and impact assessment across every control, and each control is mapped to the EU AI Act (Regulation (EU) 2024/1689) and Korea's AI Framework Act.

The companion Volume 1 - Requirements covers the management-system clauses (4-10).

For AI governance leads, compliance and security managers, ISO consultants and auditors, and AI/ML teams preparing certification evidence.

Note: Certification does not by itself guarantee legal compliance; this book shows how the two fit together.