# ISO/IEC 42001 AI Management System Guide | Comma What ISO/IEC 42001 asks of firms that use AI: an AI management system, risk and impact assessments, event logs, and the evidence an auditor checks. Source: https://commacompliance.com/regulations/iso-42001 Last updated: 2026-10-15 --- Standards Guide # ISO/IEC 42001: The records behind your AI management system ISO/IEC 42001 is an international standard for managing AI responsibly. It helps organizations set AI policies, assess risks and impacts, manage AI systems throughout their life cycle, and demonstrate that their controls work. Regulated firms need written AI policies and risk assessments. They also need ways to show how AI is used, how its activity is recorded, and how people review its use. Depending on the system and its risks, that evidence can come from records of prompts, responses, tool calls and execution context. On this pageAt a Glance - [At a Glance](#at-a-glance) - [What the Standard Requires](#what-the-standard-requires) - [Annex A: The Controls an Auditor Tests](#annex-a-the-controls-an-auditor-tests) - [A.6.2.8: Event Logs While AI Is in Use](#a628-event-logs-while-ai-is-in-use) - [A.9: Using AI as Intended](#a9-using-ai-as-intended) - [A.10: The AI You Buy](#a10-the-ai-you-buy) - [How ISO/IEC 42001 Fits With Your Other Obligations](#how-isoiec-42001-fits-with-your-other-obligations) - [Where Comma Fits](#where-comma-fits) - [The Bottom Line](#the-bottom-line) [ISO/IEC 42001](https://www.iso.org/standard/81230.html) was published in December 2023 by ISO and IEC. It is the first certifiable management system standard for artificial intelligence. It uses the same clause structure as ISO/IEC 27001, so a firm that already runs an information security program will recognize the shape. The standard is voluntary. Firms adopt it to give their AI governance a structure an auditor can test, and to answer client and counterparty due diligence about how they control the AI they use. It applies to organizations that develop, provide or use AI. A firm that uses ChatGPT Enterprise or Microsoft Copilot can apply the standard as a user of AI, even if it built none of it. ## At a Glance | ISO/IEC 42001 | Information | | --- | --- | | Full name | ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system | | Published by | ISO and IEC, through joint committee JTC 1/SC 42 | | Published | December 2023 | | Type | Voluntary, certifiable management system standard | | Applies to | Organizations that develop, provide or use AI systems | | Core requirements | Clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement | | Controls | Annex A, 38 controls under nine control objectives | | Event logs | Control A.6.2.8, AI system recording of event logs | | Certification | Audited by a certification body. Accredited bodies follow ISO/IEC 42006:2025 | ### A certificate covers the standard, not the rules ISO/IEC 42001 certification shows that an auditor found your AI management system conforms to the standard. It does not show compliance with the EU AI Act, SEC recordkeeping rules or FINRA supervision rules, which set their own requirements and are examined separately. ## What the Standard Requires Clauses 4 to 10 set the requirements every certified organization meets: - **An AI policy and named owners (Clause 5).** Top management sets an AI policy and assigns roles and responsibilities for the management system. - **Risk and impact assessments (Clause 6).** The organization assesses AI risks, decides how to treat them, and records which Annex A controls apply, and why, in a Statement of Applicability. It also assesses how its AI systems could affect individuals, groups and society. - **Documented information (Clause 7).** The evidence that the management system runs is kept, controlled and available. - **Operational control (Clause 8).** Risk assessment, risk treatment and impact assessment are repeated at planned intervals and when significant changes occur. - **Monitoring, internal audit and management review (Clause 9).** The organization measures how its AI systems and controls perform, audits itself, and reports the results to management. - **Corrective action and improvement (Clause 10).** Problems that are found get fixed, with a record of what was done. ## Annex A: The Controls an Auditor Tests Annex A lists 38 reference controls grouped under nine objectives. An organization selects the Annex A controls relevant to its AI risks. It documents which controls it will use and why, and explains why others are not needed. This record is called the Statement of Applicability. ## The nine Annex A control areas - Policies related to AI (A.2) - Internal organization, including roles and a way to report concerns (A.3) - Resources for AI systems, including data, tools, computing and people (A.4) - Assessing the impacts of AI systems (A.5) - The AI system life cycle, from design through operation and event logs (A.6) - Data for AI systems, including quality and provenance (A.7) - Information for interested parties, including incident communication (A.8) - Use of AI systems (A.9) - Third-party and customer relationships (A.10) ## A.6.2.8: Event Logs While AI Is in Use Control A.6.2.8 covers event logging throughout an AI system’s life cycle. Organizations must determine which stages need logging, including at least the period when the system is in use. Control A.6.2.6 sits beside it and covers how AI systems are operated and monitored once deployed. The control does not prescribe a log format. For a firm using AI in client work, useful logs may show who used the system, what they entered, what the AI returned, which tools or data it accessed, and which model and settings were used. ## A.9: Using AI as Intended The A.9 controls ask the organization to define processes and objectives for responsible use of AI, and to make sure each AI system is used according to its intended use and documentation (A.9.4). An acceptable-use policy explains how employees should use AI. Records of actual use help reviewers check whether employees follow that policy. For example, a reviewer can check whether someone entered client data into a tool approved only for internal drafting. ## A.10: The AI You Buy Most AI at a regulated firm comes from vendors: an enterprise chat assistant, a copilot inside office software, a meeting note-taker. A.10 still applies. The organization allocates responsibilities between itself and its suppliers (A.10.2) and makes sure the AI products and services it buys fit its own approach to responsible AI (A.10.3). In practice, that means due diligence on each AI tool and knowing what records each tool can produce. Native history and export vary widely between AI tools. Where a tool keeps little, the gap is the firm’s to close. An AI policy says how AI should be used. The record of each prompt, response and tool call shows how it was used. See [AI activity retention](/ai-platform-compliance). ## How ISO/IEC 42001 Fits With Your Other Obligations **SEC and FINRA recordkeeping.** The standard does not change what US rules require. AI-assisted communications about firm business can be business records under [SEC Rule 17a-4](/regulations/sec-17a-4) and [FINRA Rule 4511](/regulations/finra-rule-4511). In [Regulatory Notice 24-09](https://www.finra.org/rules-guidance/notices/24-09), FINRA reminded firms that its rules are technology neutral and continue to apply when they use generative AI. **The EU AI Act.** Article 12 sets logging requirements for high-risk AI systems, while Article 14 requires effective human oversight designed to address relevant risks. The specific obligations depend on the system and its use. An ISO/IEC 42001 management system can help organize this work, but certification does not itself establish compliance with the Act. See the [EU AI Act guide](/regulations/eu-ai-act). **ISO/IEC 27001.** Both standards use a similar structure, which can help organizations combine their AI and information security management systems. **NIST AI RMF.** The NIST AI Risk Management Framework covers similar ground as a voluntary US framework, without a certification scheme. ## Where Comma Fits Comma does not certify AI management systems, and an archive is not a management system. The AI policy, the risk and impact assessments, the Statement of Applicability, internal audit and management review belong to the firm. Comma keeps the records of AI use that those processes rely on. **The event log, with the execution behind it.** Comma’s [AI activity retention](/ai-platform-compliance) captures prompts, responses, tool calls and agent actions, along with the execution context: which model ran, under what system prompt, with which tools available. That gives A.6.2.8 evidence of what the AI did, not only that it ran. **AI and messaging in one archive.** Comma is built to keep AI records and business communications from 40+ channels in one archive under one retention policy, so the AI draft and the client message it became can be reviewed together. The full channel list is on [platform integrations](/platform-integrations). **Human review and signoff.** Reviewers see AI activity turn by turn, flag interactions, escalate and document their decisions. That record supports the monitoring an auditor asks about under A.6.2.6 and A.9. See [communications surveillance and review](/policy-matching). **Retention and legal holds.** Records are kept under the retention policy you configure. When a matter is open, a legal hold suspends disposal until it is released. **Exports for audit.** Archived records export in standard formats when an internal auditor, a certification body or a regulator asks. ## The Bottom Line ISO/IEC 42001 provides a framework for managing AI risks and demonstrating that controls work. Comma can support that work by preserving AI activity records for monitoring, review and audit. ## FAQ about ISO/IEC 42001 Is ISO/IEC 42001 required for financial firms? No. It is a voluntary standard. Firms adopt it to structure their AI governance and to answer due diligence questions from clients and counterparties. Does ISO/IEC 42001 apply if we only use AI tools from vendors? Yes. The standard covers organizations that use AI systems, not only those that build them. The A.9 controls cover responsible use, and the A.10 controls cover suppliers and how responsibilities are split with them. Does ISO/IEC 42001 certification mean we comply with the EU AI Act? No. The two overlap on risk management, documentation, logging and human oversight, and a 42001 management system can organize that work. The Act's requirements for high-risk AI systems are legal obligations, assessed separately from certification. See the [EU AI Act guide](/regulations/eu-ai-act). How does ISO/IEC 42001 certification work? A certification body audits the AI management system, usually in two stages: a review of the documentation, then an audit of how the system runs in practice. Certificates typically run for three years, with surveillance audits in between. ISO/IEC 42006:2025 sets the requirements for the bodies that do this work. Check that the body is accredited, since clients and counterparties usually expect an accredited certificate. How long should AI event logs be kept? ISO/IEC 42001 does not set a retention period. The organization decides, based on its legal, regulatory and business needs. Where AI activity is a business record, your existing recordkeeping rules, such as SEC Rule 17a-4 or FINRA Rule 4511, set the minimum. ## Related regulations ### [EU AI Act](/regulations/eu-ai-act) Article 12 logging and Article 14 human oversight for high-risk AI, including credit, insurance and access to financial services. Read the guide ### [AI Activity Retention](/ai-platform-compliance) What a complete record of AI use contains: prompts, responses, tool calls, agent actions and execution context. Read the guide ### [Revised Guidance on Model Risk Management](/regulations/model-risk-management-2026) The April 2026 guidance from the OCC, Federal Reserve and FDIC that replaced SR 11-7. Read the guide On this page - [At a Glance](#at-a-glance) - [What the Standard Requires](#what-the-standard-requires) - [Annex A: The Controls an Auditor Tests](#annex-a-the-controls-an-auditor-tests) - [A.6.2.8: Event Logs While AI Is in Use](#a628-event-logs-while-ai-is-in-use) - [A.9: Using AI as Intended](#a9-using-ai-as-intended) - [A.10: The AI You Buy](#a10-the-ai-you-buy) - [How ISO/IEC 42001 Fits With Your Other Obligations](#how-isoiec-42001-fits-with-your-other-obligations) - [Where Comma Fits](#where-comma-fits) - [The Bottom Line](#the-bottom-line) ## See how Comma supports your recordkeeping obligations [Book a demo](/get-in-touch)[Pricing](/pricing) Last updated: 2026-10-15