> Markdown version of https://agledger.ai/compliance/iso-42001/
> Full index of this site for AI assistants: https://agledger.ai/llms.txt

# ISO/IEC 42001 certification evidence: the clause-by-clause crosswalk

If your AI management system needs to evidence [ISO/IEC 42001](https://www.iso.org/standard/81230.html) Clauses 4 through 10 - context, leadership, planning, support, operation, performance evaluation, and improvement - here is how each clause maps to the AGLedger record, the Signed Statement chain, and the audit-export surface.

The crosswalk below is a capability mapping, not a certification. AGLedger provides the evidence pattern as a byproduct of operations; your management system provides the policies, the risk methodology, and the decisions.

If your AI program needs to evidence ISO 42001 Clauses 8–10, the crosswalk below applies. The same evidence pattern - signed records, hash-chained, append-only - also supports non-AI automated work under SOX, GLBA, HIPAA, and other control families that require tamper-evident audit trails for RPA, CI pipelines, and microservice handoffs. AGLedger is software you self-host; the regulations are AI-framed, the underlying evidence pattern is not.

## Clause-by-clause mapping

| Clause | AGLedger provides | You own |
| --- | --- | --- |
| 4: Context of the organization | Federation and custom schemas document inter-organizational AI system boundaries. Risk level and domain classification per record. | Determining organizational context, stakeholder needs, and AI management system scope. |
| 5: Leadership | Role-based access with principal, performer, and accessor roles. Authority scope and designation date recorded per record. | Leadership commitment, policy establishment, and role assignment decisions. |
| 6: Planning | Record structure captures objectives, constraints, deadlines, and tolerance bounds before work begins. Risk fields per record. | Risk assessment methodology, AI objectives, and planning decisions. |
| 7: Support | SDKs (TypeScript, Python), native API, and MCP integration. Documentation exports in JSON, CSV, NDJSON formats. | Resource allocation, competence requirements, communication strategy. |
| 8: Operation | Structured lifecycle (record → completion → verdict) with 17-state machine. Append-only audit vault records every state change. | Operational planning, control implementation, and risk treatment execution. |
| 9: Performance evaluation | Tolerance-band enforcement on numeric criteria. Timeliness evidence on every state transition. Reputation scoring for agent reliability. Drift detection across model updates (most useful in federated deployments). Audit vault queryable for cross-record analysis of acceptance, rejection, and revision rates. | Monitoring program design, internal audit scope, management review. |
| 10: Improvement | 3-tier dispute resolution. Remediation states and revision workflow. Full chain preserved for nonconformity analysis. | Corrective action decisions, continual improvement strategy. |

## How the evidence gets collected

ISO/IEC 42001 certification turns on demonstrable, auditable evidence that your AI management system operates the way it is documented to: records of operation (Clause 8), monitoring and evaluation results (Clause 9), and nonconformity handling (Clause 10). The common failure mode is collecting that evidence retroactively - screenshots, log exports, and spreadsheets assembled in the weeks before the audit, all self-attested by the team being audited.

The AGLedger pattern inverts the collection. Every automated operation writes its evidence at the moment it happens: the record captures what was intended and on whose authority, and where the work is gated, the completion captures what was delivered and the verdict captures who judged it. Each entry is signed and hash-chained as it lands. Agents run at full speed; the evidence is a byproduct, not a phase. When the audit arrives, the export is one call - Signed Statements the auditor verifies offline against published keys - and the operational-evidence collection that certification programs budget weeks for shrinks to that one export.

The division of labor stays clean: AGLedger provides the evidence pattern, your AIMS provides the scoping, policy, and decisions around it.

## Frequently asked

## Primary sources

- [ISO/IEC 42001:2023](https://www.iso.org/standard/81230.html)  - the standard itself, and the source of the clause structure used above
- [ISO/IEC 23894:2023](https://www.iso.org/standard/77304.html)  - the companion AI risk-management guidance 42001 leans on for Clause 6
- [NIST AI RMF crosswalks](https://airc.nist.gov/AI_RMF_Knowledge_Base/Crosswalks) - NIST's own 42001 mapping, useful if you are evidencing both at once

next[EU AI Act](https://agledger.ai/compliance/eu-ai-act/)

next[NIST AI RMF 1.0](https://agledger.ai/compliance/nist/)

learn[AI agent audit trail](https://agledger.ai/ai-agent-audit-trail/)

learn[Tamper-evident logging](https://agledger.ai/tamper-evident-logging/)

install[Install locally](https://agledger.ai/docs/install/)