ISO 42001 with ARRTECH
Records for the Annex A controls in a Statement of Applicability.
Records for an AI management system
An AI management system needs evidence of purpose, evaluation, operating decisions and ongoing review. Detector tests and analyst acceptance records contribute to that history.
Requirements
| Clause | What it asks | Security support |
|---|---|---|
| A.6.2.4 | Verification and validation. | Measured in shadow before promotion. → |
| A.6.2.5 | Deployment. | Every promotion on record. → |
| A.6.2.6 | Operation and monitoring. | Data health on each finding. → |
| A.6.2.8 | Event logs. | Each request’s outcome. → |
Validation
In shadow, a detector’s findings go to a separate channel, and replay measures precision, recall, stability and volume.
Deployment
Retain the decision to move a detector from testing into production and any later rollback. The record should identify what was evaluated and why the change was authorized.
Operation
Findings need context about the evidence and data quality behind them. Ongoing review should consider changes in sources and workload as well as model output.
Logging
Record the request, relevant scope and outcome, including work that needed approval or could not proceed. That history helps reviewers understand how the system used its permissions.
Residency
Local inference can keep analytical processing within the organization’s environment. Any external model route is an explicit policy choice, with permitted data and access defined.
Limits
The following responsibilities belong to the organization’s wider security and governance program. Their owners maintain the evidence needed for review.
A.5
AI system impact assessment.
A.2
AI policy.
A.7
Data governance includes sources, intended use and handling responsibilities. Identify the information available for the deployed models and document any remaining gaps.
A.10.3
Supplier review uses the model, system and service information relevant to the deployment. Keep responsibilities and supporting documentation clear between the parties.
By rule
Use these references to connect the requirement with relevant operating evidence. The organization defines the scope and implementation being assessed.
A.6.2.4
Verify and validate the AI system against defined criteria. Shadow evaluation and recorded release decisions show how the detector was assessed before production use.
A.6.2.5
Document a deployment plan and meet its requirements. The release record connects the production change to its evaluation and the decision to proceed.
A.6.2.6
Operate and monitor the AI system. Source-health information helps reviewers judge whether a result rests on usable and sufficiently complete data.
A.6.2.8
Record event logs for the AI system. Request records retain the scope, outcome and reason, including work that was refused or required approval.
Questions
Who certifies against ISO 42001?
Accredited bodies, under ISO/IEC 42006:2025.
Is AI Investigation available?
In early access. It investigates an AI Detection finding or a SIEM alert.
Who accepts an Investigation case?
An analyst. The case records who accepted it.
Guide
What is ISO 42001?
The international standard for an AI management system, published in 2023.
Who can be certified?
Organizations, for their AI management system. Products are not certified.
What is ISO/IEC 42006?
The 2025 standard for bodies that audit and certify AI management systems.
How ARRTECH takes care of ISO 42001 AI governance
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
