Regulatory Standards · Global
ISO/IEC 42001
An AI management system you can certify.
ISO 42001 is the first certifiable management system standard for AI. Astragar maps its controls to evidence, and Aeguard shows how AI agents behave in practice.
Register interest in ISO 42001Coming to Astragar GRC
2023
Published as the first AI management system standard
38
Annex A controls
Certifiable
Independently audited, like ISO 27001
What ISO 42001 requires
The obligations, in brief.
AIMS scope
Define the AI management system and its context.
AI risk & impact
Assess AI risks and impacts on individuals and society.
Controls
Apply Annex A controls across the AI system lifecycle.
Monitor & improve
Audit, review and continually improve the system.
How Astragar helps
From checklist to measurable risk.
01
Requirement → control mapping
Map every ISO 42001 requirement to controls, systems, assets and owners.
02
Evidence, continuously
Collect and maintain evidence, with sign-off from contributor to IT auditor, CISO and executive office.
03
Exposure behind the gaps
See which vulnerabilities and sensitive data put ISO 42001 controls at risk.
04
Risk in financial terms
Prioritise remediation by business and financial impact, not checklist order.
Runs alongside ISO 27001 in Astragar, so AI and security evidence share one base.
Sign-off workflow
Evidence Contributor
→IT Auditor
→CISO
→Executive Office
Related · Government, Critical Infrastructure & AI
European Union
NIS2 →
Saudi Arabia
NCA ECC →
European Union
EU CRA →
United States
FedRAMP →
United States
CMMC →
European Union
EU AI Act →
Global
NIST AI RMF →
Find the data. Test the controls. Reduce the risk.
ISO 42001 mapping is coming to Astragar GRC. Talk to us about early access and how your existing evidence already applies.
Talk to usAstragar supports compliance programmes with technical evidence and risk analysis. It does not provide legal advice or issue certifications.
See your cyber risk in $ terms, not CVSS scores.
