ISO/IEC 42001:2023 — AI Management System (AIMS)

ISO/IEC 42001:2023 — AI Management System (AIMS) — 97% of in-scope requirements covered.

80 requirements · 80 in scope (76 enforced · 3 designed · 1 advisory). The 97% is weighted over the in-scope base.

ISO/IEC 42001:2023: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: ISO/IEC 42001:2023 · License: ISO copyright — citation only

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Annex A — AIMS controls484710099%
Clause 10 — Improvement33000100%
Clause 4 — Context of the organisation4310088%
Clause 5 — Leadership33000100%
Clause 6 — Planning (risk + impact assessment)44000100%
Clause 7 — Support6411079%
Clause 8 — Operation (AI system lifecycle)44000100%
Clause 9 — Performance evaluation55000100%
Clause 6 — Planning22000100%
Clause 8 — Operation11000100%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
iso-42001.A.2.2AI policy — document an organisational AI policyenforcedaudit_events: kye.purpose.permission.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.A.3.2Roles and responsibilities for the AIMSenforcedaudit_events: kye.purpose.grant.v1, kye.federation.cross_org_delegation.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/21-DELEGATED-AUDITABILITY.md
iso-42001.A.4.2AI system impact-assessment processenforcedaudit_events: kye.risk.score.v1, kye.assurance.audit_pilot.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.A.6.2Data for AI systems — quality, provenance, preparationenforcedaudit_events: kye.evidence.model_params.v1, kye.model.influence_envelope.v1, kye.evidence.decision_map.v1
engines: internal
constitution_refs: constitution/14-AGENTS-AND-ENGINES.md, constitution/31-DATA-GOVERNANCE-PACK.md
iso-42001.A.7.2Information for stakeholders of AI systems — transparency to affected partiesenforcedaudit_events: kye.model.capability_profile.v1, kye.governedui.evidence_timeline.v1
governedui_modules: kye.governedui.module.entity_passport.v1, kye.governedui.module.evidence_timeline.v1
constitution_refs: constitution/36-GOVERNEDUI.md
engines: internal
workers: kye-pdp
iso-42001.A.8.2Use of AI systems — responsible-use policy and lifecycleenforcedaudit_events: kye.purpose.admissibility.v1, kye.purpose.grant.v1, kye.agent.refusal.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/52-DELEGATED-AGENT-BINDING.md
iso-42001.A.10.3Third-party and customer relationships in AI lifecycleenforcedaudit_events: kye.federation.cross_org_delegation.v1, kye.evidence.tool_call_pin.v1
engines: internal
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
iso-42001.10.1Continual improvement of the suitability, adequacy and effectiveness of the AIMSenforcedaudit_events: kye.resilience.improvement_record.v1, kye.resilience.loop_iteration.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.10.2Nonconformity and corrective action — react, evaluate, implement, reviewenforced 1 unverified citationaudit_events: kye.signal.drift.detected.v1, kye.resilience.improvement_record.v1, kye.purpose.grant.revoked.v1 unverified citation
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.4.1Determine external and internal issues relevant to the AI management systemenforcedaudit_events: kye.risk.authority_register.v1, kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.4.3Determine the boundaries and applicability of the AIMS to establish its scopeenforcedaudit_events: kye.purpose.permission.v1, kye.model.capability_profile.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.5.1Top management shall demonstrate leadership and commitment with respect to the AIMSenforcedaudit_events: kye.risk.authority_register.v1, kye.compliance.attestation.v1
engines: internal
governedui_modules: kye.governedui.module.authority_drift.v1, kye.governedui.module.approval_queue.v1
constitution_refs: constitution/36-GOVERNEDUI.md
iso-42001.5.2Top management shall establish an AI policy compatible with strategic directionenforcedaudit_events: kye.purpose.permission.v1, kye.purpose.grant.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.6.1.2AI risk assessment — identify, analyse, evaluate AI risksenforcedaudit_events: kye.risk.score.v1, kye.evidence.decision_map.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
rule_packs: kye:rule-pack:public-sector-governance
iso-42001.6.1.3AI risk treatment — define risk-treatment options and produce a Statement of Applicabilityenforcedaudit_events: kye.purpose.grant.v1, kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.6.1.4AI system impact assessment — assess consequences for individuals, groups, societyenforcedaudit_events: kye.risk.score.v1, kye.assurance.audit_pilot.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.6.2AI objectives shall be measurable, monitored, communicated, updated as appropriateenforcedaudit_events: kye.model.capability_profile.v1, kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-42001.7.2Persons doing work that affects AIMS performance shall be competentadvisorygovernedui_modules: kye.governedui.module.trainers.v1
constitution_refs: constitution/10-PARTNER.md, constitution/39-LEARN-RAIL.md
iso-42001.7.5Documented information required by the AIMS shall be controlled and protectedenforcedaudit_events: kye.evidence.pack.v1, kye.signal.evidence.sealed.v1
engines: internal, internal
worm_tables: evidence_pack
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-42001.8.1Plan, implement and control operational processes needed to meet AIMS requirementsenforcedaudit_events: kye.purpose.admissibility.v1, kye.evidence.decision_map.v1, kye.assurance.adoption_stage.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/14-AGENTS-AND-ENGINES.md
iso-42001.8.2AI risk assessment shall be performed at planned intervals or when significant changes occurenforcedaudit_events: kye.risk.score.v1, kye.signal.drift.detected.v1, kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.8.3AI system impact assessment shall be performed at planned intervalsenforcedaudit_events: kye.assurance.audit_pilot.v1, kye.risk.score.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.8.4AI system development, deployment, operation lifecycle controls (data, model, system)enforcedaudit_events: kye.model.capability_profile.v1, kye.model.influence_envelope.v1, kye.evidence.model_params.v1, kye.evidence.tool_call_pin.v1
engines: internal, internal
constitution_refs: constitution/14-AGENTS-AND-ENGINES.md
iso-42001.9.1Monitoring, measurement, analysis and evaluation of AIMS performanceenforcedaudit_events: kye.compliance.attestation.v1, kye.risk.score.v1, kye.signal.evidence.sealed.v1
engines: internal, internal
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-42001.9.2Internal audit shall be conducted at planned intervalsenforcedaudit_events: kye.assurance.audit_pilot.v1, kye.assurance.audit_replay_report.v1
engines: internal, internal
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
iso-42001.9.3Management review of the AIMS at planned intervalsenforcedaudit_events: kye.risk.authority_register.v1, kye.compliance.attestation.v1
engines: internal
governedui_modules: kye.governedui.module.authority_drift.v1
constitution_refs: constitution/36-GOVERNEDUI.md
iso-42001.4.2Understanding the needs and expectations of interested parties relevant to the AI management systemdesignedaudit_events: kye.stakeholder.v1, kye.risk.authority_register.v1
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.4.4Establish, implement, maintain and continually improve an AI management systemenforcedaudit_events: kye.compliance.attestation.v1
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-42001.5.3Roles, responsibilities and authorities for AI management shall be assigned and communicatedenforcedaudit_events: kye.purpose.permission.v1, kye.risk.authority_register.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.6.1.1Actions to address risks and opportunities — general (planning)enforcedaudit_events: kye.risk.score.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.6.3Planning of changes — when changes to the AIMS are needed, they shall be carried out in a planned mannerenforcedaudit_events: kye.change_calendar.v1
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.7.1Determine and provide resources needed for the AI management systemenforcedconstitution_refs: constitution/16-EDGE-RUNTIME.md, constitution/51-NO-SPOF.md
iso-42001.7.3Persons doing work under the AIMS shall be aware of policy, contribution and implications of non-conformancedesignedconstitution_refs: constitution/39-LEARN-RAIL.md
iso-42001.7.4Determine the need for internal and external communications relevant to the AI management systemenforcedaudit_events: kye.comms.dispatched.v1
constitution_refs: constitution/38-COMMS-RAIL.md
iso-42001.7.5.1Documented information shall be controlled (creation, update, version)enforcedaudit_events: kye.evidence.pack.v1, kye.audit_chain_entry.v1
engines: internal, internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-42001.8.5Operation — actions to address AI system impact assessment resultsenforcedaudit_events: kye.consequence_map.v1, kye.purpose.admissibility.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.9.2.1Internal audit — general (plan, conduct, report)enforcedaudit_events: kye.assurance.audit_pilot.v1
agents: internal
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
iso-42001.9.2.2Internal audit program — establish, implement, maintainenforcedaudit_events: kye.assurance.audit_pilot.v1, kye.change_calendar.v1
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
iso-42001.10.3Continual improvement — continually improve the suitability, adequacy and effectiveness of the AIMSenforcedaudit_events: kye.signal.drift.detected.v1, kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.A.2.3Annex A — alignment with other organisational policies (information security, privacy, quality)enforcedaudit_events: kye.compliance.attestation.v1
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-42001.A.3.3Annex A — reporting of concerns about AI systems (whistleblower channel)designedaudit_events: kye.comms.dispatched.v1
constitution_refs: constitution/38-COMMS-RAIL.md
iso-42001.A.4.3Annex A — resources for AI systems (data, tooling, personnel, computational)enforcedaudit_events: kye.spof_registry.v1
constitution_refs: constitution/51-NO-SPOF.md
iso-42001.A.4.4Annex A — tooling resources for AI systemsenforcedconstitution_refs: constitution/32-AGENT-DEV-KIT.md
iso-42001.A.4.5Annex A — data resources for AI systemsenforcedaudit_events: kye.data_use_manifest.v1, kye.data_asset.v1
engines: internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-42001.A.4.6Annex A — system and computing resources for AIenforcedaudit_events: kye.spof_registry.v1
constitution_refs: constitution/16-EDGE-RUNTIME.md, constitution/51-NO-SPOF.md
iso-42001.A.5.1Annex A — AI system impact assessment processenforcedaudit_events: kye.consequence_map.v1, kye.risk_assessment.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.A.5.2Annex A — documentation of AI system impact assessmentenforcedaudit_events: kye.evidence.pack.v1
engines: internal
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
iso-42001.A.5.3Annex A — assessment of AI system impact on individuals or groups of individualsenforcedaudit_events: kye.consequence_map.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.A.5.4Annex A — assessment of societal impacts of AI systemsenforcedaudit_events: kye.consequence_map.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-42001.A.6.1.1Annex A — objectives for responsible AI developmentenforcedaudit_events: kye.compliance.attestation.v1
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-42001.A.6.1.2Annex A — processes for responsible AI design and developmentenforcedconstitution_refs: constitution/32-AGENT-DEV-KIT.md
iso-42001.A.6.2.1Annex A — AI system requirements and specificationenforcedaudit_events: kye.entity.model.v1, kye.model.capability_profile.v1
constitution_refs: constitution/14-AGENTS-AND-ENGINES.md
iso-42001.A.6.2.3Annex A — AI system verification and validationenforcedaudit_events: kye.scenario_run.v1, kye.assurance.audit_replay_report.v1
engines: internal, internal
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
iso-42001.A.6.2.4Annex A — AI system deploymentenforcedaudit_events: kye.purpose.grant.v1, kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.A.6.2.5Annex A — AI system operation and monitoringenforcedaudit_events: kye.audit_chain_entry.v1, kye.signal.drift.detected.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/35-STREAMING-LOGS.md
iso-42001.A.6.2.6Annex A — AI system technical documentationenforcedaudit_events: kye.evidence.pack.v1, kye.model.capability_profile.v1
engines: internal
constitution_refs: constitution/43-MACHINE-READABLE-BY-DEFAULT.md
iso-42001.A.6.2.7Annex A — AI system recording of event logsenforcedaudit_events: kye.audit_chain_entry.v1, kye.audit_retention_policy.v1
engines: internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md, constitution/35-STREAMING-LOGS.md
iso-42001.A.7.3Annex A — data for AI systems: acquisition of dataenforcedaudit_events: kye.data_use_manifest.v1, kye.data_asset.v1
engines: internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-42001.A.7.4Annex A — quality of data for AI systemsenforcedaudit_events: kye.data_use_manifest.v1
engines: internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-42001.A.7.5Annex A — data provenanceenforcedaudit_events: kye.data_use_manifest.v1, kye.evidence.pack.v1
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-42001.A.7.6Annex A — data preparationenforcedaudit_events: kye.data_use_manifest.v1, kye.evidence.model_params.v1
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-42001.A.8.3Annex A — information for interested parties about AI systems (transparency)enforcedaudit_events: kye.comms.dispatched.v1, kye.compliance.attestation.v1
constitution_refs: constitution/38-COMMS-RAIL.md
iso-42001.A.8.4Annex A — external reporting (regulatory or public reporting)enforcedaudit_events: kye.comms.dispatched.v1
constitution_refs: constitution/38-COMMS-RAIL.md
iso-42001.A.8.5Annex A — communication of incidents to interested partiesenforcedaudit_events: kye.signal.incident.opened.v1, kye.comms.dispatched.v1
engines: internal
constitution_refs: constitution/38-COMMS-RAIL.md
iso-42001.A.9.2Annex A — processes for responsible use of AI systemsenforcedaudit_events: kye.purpose.admissibility.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.A.9.3Annex A — objectives for responsible use of AI systemsenforcedaudit_events: kye.purpose.permission.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.A.9.4Annex A — intended use of the AI systemenforcedaudit_events: kye.purpose.permission.v1, kye.model.capability_profile.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.A.10.2Annex A — allocating responsibilities (third-party relationships)enforcedaudit_events: kye.federation.cross_org_delegation.v1, kye.subprocessor.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.A.10.4Annex A — suppliers (AI components, data, services)enforcedaudit_events: kye.subprocessor.v1, kye.spof_registry.v1
constitution_refs: constitution/51-NO-SPOF.md
iso-42001.A.10.5Annex A — customers (intended deployment context)enforcedaudit_events: kye.account.v1, kye.directory.entry.v1
constitution_refs: constitution/17-DIRECTORY-SEARCH.md
iso-42001.A.2.1Annex A — policies for AI (organisational AI policy)enforcedaudit_events: kye.compliance.attestation.v1
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-42001.A.2.4Annex A — review of AI policiesenforcedaudit_events: kye.change_calendar.v1, kye.compliance.attestation.v1
constitution_refs: constitution/DECAY-WINDOWS.md
iso-42001.A.3.1Annex A — internal organisation roles and responsibilities for AIenforcedaudit_events: kye.risk.authority_register.v1, kye.purpose.permission.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.A.4.1Annex A — resource documentation for AI systemsenforcedaudit_events: kye.spof_registry.v1, kye.compliance.attestation.v1
constitution_refs: constitution/51-NO-SPOF.md
iso-42001.A.6.1.3Annex A — documentation of AI design and developmentenforcedaudit_events: kye.evidence.pack.v1, kye.evidence.model_params.v1
engines: internal
constitution_refs: constitution/43-MACHINE-READABLE-BY-DEFAULT.md
iso-42001.A.6.2.2Annex A — documentation of AI system requirements and specificationenforcedaudit_events: kye.model.capability_profile.v1
constitution_refs: constitution/14-AGENTS-AND-ENGINES.md
iso-42001.A.7.1Annex A — data management process for AI systemsenforcedaudit_events: kye.data_use_manifest.v1, kye.data_flow_graph.v1
engines: internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-42001.A.8.1Annex A — information for interested parties about AI systems (objectives)enforcedaudit_events: kye.purpose_manifest.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.A.9.1Annex A — processes for responsible use of AI systems (objectives)enforcedaudit_events: kye.purpose.permission.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-42001.A.10.1Annex A — third-party relationships — general (vendor / customer / regulator)enforcedaudit_events: kye.federation.cross_org_delegation.v1, kye.directory.entry.v1
constitution_refs: constitution/49-UNIVERSAL-ENGAGEMENT-RAIL.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.