ISO/IEC 42001: the clause-by-clause control crosswalk
If your AI management system needs to evidence ISO/IEC 42001 Clauses 4 through 10 - context, leadership, planning, support, operation, performance evaluation, and improvement - here is how each clause maps to the AGLedger record, the Signed Statement chain, and the audit-export surface.
ISO/IEC 42001 is an organizational management-system standard. A certification body audits the organization that runs the AI management system, not a piece of software, so no product is 42001 certified and none can be certified in your place. AGLedger implements ISO 42001-aligned controls and writes the operating evidence your AIMS is audited on.
The crosswalk below is a capability mapping, not a certification. AGLedger provides the evidence pattern as a byproduct of operations; your management system provides the policies, the risk methodology, and the decisions.
The same evidence pattern - signed records, hash-chained, append-only - also supports non-AI automated work in any control family that expects tamper-evident audit trails for RPA, CI pipelines, and microservice calls. AGLedger is software you self-host; the standard is AI-framed, the underlying evidence pattern is not.
Clause-by-clause mapping
| Clause | AGLedger provides | You own |
|---|---|---|
| 4: Context of the organization | Federation and custom schemas document inter-organizational AI system boundaries. Risk level and domain classification per record. | Determining organizational context, stakeholder needs, and AI management system scope. |
| 5: Leadership | Every record names its principal and its performer. The designated overseer, their authority scope, and the designation date are recorded as structured metadata per record. | Leadership commitment, policy establishment, and role assignment decisions. |
| 6: Planning | Record structure captures objectives, constraints, deadlines, and tolerance bounds before work begins. Risk fields per record. | Risk assessment methodology, AI objectives, and planning decisions. |
| 7: Support | SDKs (TypeScript, Python), native API, and MCP integration. Documentation exports in JSON, CSV, NDJSON, and COSE formats. | Resource allocation, competence requirements, communication strategy. |
| 8: Operation | Structured lifecycle (record → completion → verdict) with 17-state machine. Append-only audit vault records every state change. | Operational planning, control implementation, and risk treatment execution. |
| 9: Performance evaluation | Tolerance-band enforcement on numeric criteria. Timeliness evidence on every state transition. Agent drift: per-window counts of what each agent did and the change between windows, with no score or threshold. Audit vault queryable for cross-record analysis of acceptance, rejection, and revision rates. | Monitoring program design, internal audit scope, management review. |
| 10: Improvement | Dispute resolution: a signed evidence window, then an outcome the principal renders. Remediation states and revision workflow. Full chain preserved for nonconformity analysis. | Corrective action decisions, continual improvement strategy. |
How the evidence gets collected
ISO/IEC 42001 certification turns on demonstrable, auditable evidence that your AI management system operates the way it is documented to: records of operation (Clause 8), monitoring and evaluation results (Clause 9), and nonconformity handling (Clause 10). The common failure mode is collecting that evidence retroactively - screenshots, log exports, and spreadsheets assembled in the weeks before the audit, all self-attested by the team being audited.
The AGLedger pattern inverts the collection. Every automated operation writes its evidence at the moment it happens: the record captures what was intended and on whose authority, and where the work is gated, the completion captures what was delivered and the verdict captures who rendered it. Each entry is signed and hash-chained as it lands. Agents run at full speed; the evidence is a byproduct. When the audit arrives, the export is one call, and the auditor verifies the Signed Statements offline against published keys. The operational-evidence collection is not a phase before the audit; it already happened, one entry at a time.
Frequently asked
- Is this crosswalk an ISO/IEC 42001 certification?
- No. The crosswalk is a capability mapping, not a certification. AGLedger provides the evidence pattern as a byproduct of operations; your management system provides the policies, the risk methodology, and the decisions.
- What evidence does an ISO 42001 certification audit need, and how does AGLedger produce it?
- Continuously, as a byproduct of operation. Every automated operation writes signed, hash-chained evidence the moment it happens: intent and authority on the record, and, for gated work, the delivered completion and the verdict. At audit time the export is one call, and the auditor verifies the Signed Statements offline against published keys instead of trusting screenshots and log exports assembled after the fact.
- How does AGLedger map to ISO/IEC 42001 Clause 8 (Operation)?
- Clause 8 covers operation. AGLedger provides a structured lifecycle (record to completion to verdict) with a 17-state machine, and an append-only audit vault that records every state change. You own operational planning, control implementation, and risk treatment execution.
- How does AGLedger map to Clause 9 (Performance evaluation)?
- Clause 9 covers performance evaluation. AGLedger provides tolerance-band enforcement on numeric criteria, timeliness evidence on every state transition, agent drift (per-window counts of what each agent did and the change between windows, with no score or threshold), and an audit vault queryable for cross-record analysis of acceptance, rejection, and revision rates. You own monitoring program design, internal audit scope, and management review.
- How does AGLedger map to Clause 10 (Improvement)?
- Clause 10 covers improvement. AGLedger provides dispute resolution (a signed evidence window, then an outcome the principal renders), remediation states and a revision workflow, and a full chain preserved for nonconformity analysis. You own corrective action decisions and continual improvement strategy.
Primary sources
- ISO/IEC 42001:2023 - the standard itself, and the source of the clause structure used above
- ISO/IEC 23894:2023 - the companion AI risk-management guidance 42001 leans on for Clause 6
- NIST AI RMF crosswalks - NIST's own 42001 mapping, useful if you are evidencing both at once