ISO/IEC 42001: The records behind your AI management system

ISO/IEC 42001 was published in December 2023 by ISO and IEC. It is the first certifiable management system standard for artificial intelligence. It uses the same clause structure as ISO/IEC 27001, so a firm that already runs an information security program will recognize the shape.

The standard is voluntary. Firms adopt it to give their AI governance a structure an auditor can test, and to answer client and counterparty due diligence about how they control the AI they use.

It applies to organizations that develop, provide or use AI. A firm that uses ChatGPT Enterprise or Microsoft Copilot can apply the standard as a user of AI, even if it built none of it.

At a Glance

What the Standard Requires

Clauses 4 to 10 set the requirements every certified organization meets:

• An AI policy and named owners (Clause 5). Top management sets an AI policy and assigns roles and responsibilities for the management system.
• Risk and impact assessments (Clause 6). The organization assesses AI risks, decides how to treat them, and records which Annex A controls apply, and why, in a Statement of Applicability. It also assesses how its AI systems could affect individuals, groups and society.
• Documented information (Clause 7). The evidence that the management system runs is kept, controlled and available.
• Operational control (Clause 8). Risk assessment, risk treatment and impact assessment are repeated at planned intervals and when significant changes occur.
• Monitoring, internal audit and management review (Clause 9). The organization measures how its AI systems and controls perform, audits itself, and reports the results to management.
• Corrective action and improvement (Clause 10). Problems that are found get fixed, with a record of what was done.

Annex A: The Controls an Auditor Tests

Annex A lists 38 reference controls grouped under nine objectives. An organization selects the Annex A controls relevant to its AI risks. It documents which controls it will use and why, and explains why others are not needed. This record is called the Statement of Applicability.

A.6.2.8: Event Logs While AI Is in Use

Control A.6.2.8 covers event logging throughout an AI system’s life cycle. Organizations must determine which stages need logging, including at least the period when the system is in use. Control A.6.2.6 sits beside it and covers how AI systems are operated and monitored once deployed.

The control does not prescribe a log format. For a firm using AI in client work, useful logs may show who used the system, what they entered, what the AI returned, which tools or data it accessed, and which model and settings were used.

A.9: Using AI as Intended

The A.9 controls ask the organization to define processes and objectives for responsible use of AI, and to make sure each AI system is used according to its intended use and documentation (A.9.4).

An acceptable-use policy explains how employees should use AI. Records of actual use help reviewers check whether employees follow that policy. For example, a reviewer can check whether someone entered client data into a tool approved only for internal drafting.

A.10: The AI You Buy

Most AI at a regulated firm comes from vendors: an enterprise chat assistant, a copilot inside office software, a meeting note-taker. A.10 still applies. The organization allocates responsibilities between itself and its suppliers (A.10.2) and makes sure the AI products and services it buys fit its own approach to responsible AI (A.10.3).

In practice, that means due diligence on each AI tool and knowing what records each tool can produce. Native history and export vary widely between AI tools. Where a tool keeps little, the gap is the firm’s to close.

How ISO/IEC 42001 Fits With Your Other Obligations

SEC and FINRA recordkeeping. The standard does not change what US rules require. AI-assisted communications about firm business can be business records under SEC Rule 17a-4 and FINRA Rule 4511. In Regulatory Notice 24-09, FINRA reminded firms that its rules are technology neutral and continue to apply when they use generative AI.

The EU AI Act. Article 12 sets logging requirements for high-risk AI systems, while Article 14 requires effective human oversight designed to address relevant risks. The specific obligations depend on the system and its use. An ISO/IEC 42001 management system can help organize this work, but certification does not itself establish compliance with the Act. See the EU AI Act guide.

ISO/IEC 27001. Both standards use a similar structure, which can help organizations combine their AI and information security management systems.

NIST AI RMF. The NIST AI Risk Management Framework covers similar ground as a voluntary US framework, without a certification scheme.

Where Comma Fits

Comma does not certify AI management systems, and an archive is not a management system. The AI policy, the risk and impact assessments, the Statement of Applicability, internal audit and management review belong to the firm. Comma keeps the records of AI use that those processes rely on.

The event log, with the execution behind it. Comma’s AI activity retention captures prompts, responses, tool calls and agent actions, along with the execution context: which model ran, under what system prompt, with which tools available. That gives A.6.2.8 evidence of what the AI did, not only that it ran.

AI and messaging in one archive. Comma is built to keep AI records and business communications from 40+ channels in one archive under one retention policy, so the AI draft and the client message it became can be reviewed together. The full channel list is on platform integrations.

Human review and signoff. Reviewers see AI activity turn by turn, flag interactions, escalate and document their decisions. That record supports the monitoring an auditor asks about under A.6.2.6 and A.9. See communications surveillance and review.

Retention and legal holds. Records are kept under the retention policy you configure. When a matter is open, a legal hold suspends disposal until it is released.

Exports for audit. Archived records export in standard formats when an internal auditor, a certification body or a regulator asks.

The Bottom Line

ISO/IEC 42001 provides a framework for managing AI risks and demonstrating that controls work. Comma can support that work by preserving AI activity records for monitoring, review and audit.