---
title: "ISO/IEC 42001:2023 — AI Management System (AIMS) — KYE Protocol™ coverage"
description: "ISO/IEC 42001:2023 — AI Management System (AIMS) coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/iso-42001/
lang: en
source: "KYE Protocol"
---

> ISO/IEC 42001:2023 — AI Management System (AIMS) coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

ISO/IEC 42001:2023 — AI Management System (AIMS)

# ISO/IEC 42001:2023 — AI Management System (AIMS) — 97% of in-scope requirements covered.

80 requirements · 80 in scope (76 enforced · 3 designed · 1 advisory). The 97% is weighted over the in-scope base.

**Source:** ISO/IEC 42001:2023 · **License:** ISO copyright — citation only

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Annex A — AIMS controls | 48 | 47 | 1 | 0 | 0 | **99%** |
| Clause 10 — Improvement | 3 | 3 | 0 | 0 | 0 | **100%** |
| Clause 4 — Context of the organisation | 4 | 3 | 1 | 0 | 0 | **88%** |
| Clause 5 — Leadership | 3 | 3 | 0 | 0 | 0 | **100%** |
| Clause 6 — Planning (risk + impact assessment) | 4 | 4 | 0 | 0 | 0 | **100%** |
| Clause 7 — Support | 6 | 4 | 1 | 1 | 0 | **79%** |
| Clause 8 — Operation (AI system lifecycle) | 4 | 4 | 0 | 0 | 0 | **100%** |
| Clause 9 — Performance evaluation | 5 | 5 | 0 | 0 | 0 | **100%** |
| Clause 6 — Planning | 2 | 2 | 0 | 0 | 0 | **100%** |
| Clause 8 — Operation | 1 | 1 | 0 | 0 | 0 | **100%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `iso-42001.A.2.2` | AI policy — document an organisational AI policy | enforced | **audit\_events**: `kye.purpose.permission.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.A.3.2` | Roles and responsibilities for the AIMS | enforced | **audit\_events**: `kye.purpose.grant.v1`, `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/21-DELEGATED-AUDITABILITY.md` |
| `iso-42001.A.4.2` | AI system impact-assessment process | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.assurance.audit_pilot.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.A.6.2` | Data for AI systems — quality, provenance, preparation | enforced | **audit\_events**: `kye.evidence.model_params.v1`, `kye.model.influence_envelope.v1`, `kye.evidence.decision_map.v1` **engines**: `internal` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md`, `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `iso-42001.A.7.2` | Information for stakeholders of AI systems — transparency to affected parties | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.governedui.evidence_timeline.v1` **governedui\_modules**: `kye.governedui.module.entity_passport.v1`, `kye.governedui.module.evidence_timeline.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` **engines**: `internal` **workers**: `kye-pdp` |
| `iso-42001.A.8.2` | Use of AI systems — responsible-use policy and lifecycle | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.purpose.grant.v1`, `kye.agent.refusal.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/52-DELEGATED-AGENT-BINDING.md` |
| `iso-42001.A.10.3` | Third-party and customer relationships in AI lifecycle | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1`, `kye.evidence.tool_call_pin.v1` **engines**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `iso-42001.10.1` | Continual improvement of the suitability, adequacy and effectiveness of the AIMS | enforced | **audit\_events**: `kye.resilience.improvement_record.v1`, `kye.resilience.loop_iteration.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.10.2` | Nonconformity and corrective action — react, evaluate, implement, review | enforced 1 unverified citation | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.resilience.improvement_record.v1`, `kye.purpose.grant.revoked.v1` unverified citation **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.4.1` | Determine external and internal issues relevant to the AI management system | enforced | **audit\_events**: `kye.risk.authority_register.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.4.3` | Determine the boundaries and applicability of the AIMS to establish its scope | enforced | **audit\_events**: `kye.purpose.permission.v1`, `kye.model.capability_profile.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.5.1` | Top management shall demonstrate leadership and commitment with respect to the AIMS | enforced | **audit\_events**: `kye.risk.authority_register.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **governedui\_modules**: `kye.governedui.module.authority_drift.v1`, `kye.governedui.module.approval_queue.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `iso-42001.5.2` | Top management shall establish an AI policy compatible with strategic direction | enforced | **audit\_events**: `kye.purpose.permission.v1`, `kye.purpose.grant.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.6.1.2` | AI risk assessment — identify, analyse, evaluate AI risks | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.evidence.decision_map.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` **rule\_packs**: `kye:rule-pack:public-sector-governance` |
| `iso-42001.6.1.3` | AI risk treatment — define risk-treatment options and produce a Statement of Applicability | enforced | **audit\_events**: `kye.purpose.grant.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.6.1.4` | AI system impact assessment — assess consequences for individuals, groups, society | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.assurance.audit_pilot.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.6.2` | AI objectives shall be measurable, monitored, communicated, updated as appropriate | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `iso-42001.7.2` | Persons doing work that affects AIMS performance shall be competent | advisory | **governedui\_modules**: `kye.governedui.module.trainers.v1` **constitution\_refs**: `constitution/10-PARTNER.md`, `constitution/39-LEARN-RAIL.md` |
| `iso-42001.7.5` | Documented information required by the AIMS shall be controlled and protected | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.signal.evidence.sealed.v1` **engines**: `internal`, `internal` **worm\_tables**: `evidence_pack` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `iso-42001.8.1` | Plan, implement and control operational processes needed to meet AIMS requirements | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1`, `kye.assurance.adoption_stage.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/14-AGENTS-AND-ENGINES.md` |
| `iso-42001.8.2` | AI risk assessment shall be performed at planned intervals or when significant changes occur | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.signal.drift.detected.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.8.3` | AI system impact assessment shall be performed at planned intervals | enforced | **audit\_events**: `kye.assurance.audit_pilot.v1`, `kye.risk.score.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.8.4` | AI system development, deployment, operation lifecycle controls (data, model, system) | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1`, `kye.evidence.model_params.v1`, `kye.evidence.tool_call_pin.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `iso-42001.9.1` | Monitoring, measurement, analysis and evaluation of AIMS performance | enforced | **audit\_events**: `kye.compliance.attestation.v1`, `kye.risk.score.v1`, `kye.signal.evidence.sealed.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `iso-42001.9.2` | Internal audit shall be conducted at planned intervals | enforced | **audit\_events**: `kye.assurance.audit_pilot.v1`, `kye.assurance.audit_replay_report.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `iso-42001.9.3` | Management review of the AIMS at planned intervals | enforced | **audit\_events**: `kye.risk.authority_register.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **governedui\_modules**: `kye.governedui.module.authority_drift.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `iso-42001.4.2` | Understanding the needs and expectations of interested parties relevant to the AI management system | designed | **audit\_events**: `kye.stakeholder.v1`, `kye.risk.authority_register.v1` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.4.4` | Establish, implement, maintain and continually improve an AI management system | enforced | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `iso-42001.5.3` | Roles, responsibilities and authorities for AI management shall be assigned and communicated | enforced | **audit\_events**: `kye.purpose.permission.v1`, `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.6.1.1` | Actions to address risks and opportunities — general (planning) | enforced | **audit\_events**: `kye.risk.score.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.6.3` | Planning of changes — when changes to the AIMS are needed, they shall be carried out in a planned manner | enforced | **audit\_events**: `kye.change_calendar.v1` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.7.1` | Determine and provide resources needed for the AI management system | enforced | **constitution\_refs**: `constitution/16-EDGE-RUNTIME.md`, `constitution/51-NO-SPOF.md` |
| `iso-42001.7.3` | Persons doing work under the AIMS shall be aware of policy, contribution and implications of non-conformance | designed | **constitution\_refs**: `constitution/39-LEARN-RAIL.md` |
| `iso-42001.7.4` | Determine the need for internal and external communications relevant to the AI management system | enforced | **audit\_events**: `kye.comms.dispatched.v1` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `iso-42001.7.5.1` | Documented information shall be controlled (creation, update, version) | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.audit_chain_entry.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `iso-42001.8.5` | Operation — actions to address AI system impact assessment results | enforced | **audit\_events**: `kye.consequence_map.v1`, `kye.purpose.admissibility.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.9.2.1` | Internal audit — general (plan, conduct, report) | enforced | **audit\_events**: `kye.assurance.audit_pilot.v1` **agents**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `iso-42001.9.2.2` | Internal audit program — establish, implement, maintain | enforced | **audit\_events**: `kye.assurance.audit_pilot.v1`, `kye.change_calendar.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `iso-42001.10.3` | Continual improvement — continually improve the suitability, adequacy and effectiveness of the AIMS | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.A.2.3` | Annex A — alignment with other organisational policies (information security, privacy, quality) | enforced | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `iso-42001.A.3.3` | Annex A — reporting of concerns about AI systems (whistleblower channel) | designed | **audit\_events**: `kye.comms.dispatched.v1` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `iso-42001.A.4.3` | Annex A — resources for AI systems (data, tooling, personnel, computational) | enforced | **audit\_events**: `kye.spof_registry.v1` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `iso-42001.A.4.4` | Annex A — tooling resources for AI systems | enforced | **constitution\_refs**: `constitution/32-AGENT-DEV-KIT.md` |
| `iso-42001.A.4.5` | Annex A — data resources for AI systems | enforced | **audit\_events**: `kye.data_use_manifest.v1`, `kye.data_asset.v1` **engines**: `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `iso-42001.A.4.6` | Annex A — system and computing resources for AI | enforced | **audit\_events**: `kye.spof_registry.v1` **constitution\_refs**: `constitution/16-EDGE-RUNTIME.md`, `constitution/51-NO-SPOF.md` |
| `iso-42001.A.5.1` | Annex A — AI system impact assessment process | enforced | **audit\_events**: `kye.consequence_map.v1`, `kye.risk_assessment.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.A.5.2` | Annex A — documentation of AI system impact assessment | enforced | **audit\_events**: `kye.evidence.pack.v1` **engines**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `iso-42001.A.5.3` | Annex A — assessment of AI system impact on individuals or groups of individuals | enforced | **audit\_events**: `kye.consequence_map.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.A.5.4` | Annex A — assessment of societal impacts of AI systems | enforced | **audit\_events**: `kye.consequence_map.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-42001.A.6.1.1` | Annex A — objectives for responsible AI development | enforced | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `iso-42001.A.6.1.2` | Annex A — processes for responsible AI design and development | enforced | **constitution\_refs**: `constitution/32-AGENT-DEV-KIT.md` |
| `iso-42001.A.6.2.1` | Annex A — AI system requirements and specification | enforced | **audit\_events**: `kye.entity.model.v1`, `kye.model.capability_profile.v1` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `iso-42001.A.6.2.3` | Annex A — AI system verification and validation | enforced | **audit\_events**: `kye.scenario_run.v1`, `kye.assurance.audit_replay_report.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `iso-42001.A.6.2.4` | Annex A — AI system deployment | enforced | **audit\_events**: `kye.purpose.grant.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.A.6.2.5` | Annex A — AI system operation and monitoring | enforced | **audit\_events**: `kye.audit_chain_entry.v1`, `kye.signal.drift.detected.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/35-STREAMING-LOGS.md` |
| `iso-42001.A.6.2.6` | Annex A — AI system technical documentation | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.model.capability_profile.v1` **engines**: `internal` **constitution\_refs**: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md` |
| `iso-42001.A.6.2.7` | Annex A — AI system recording of event logs | enforced | **audit\_events**: `kye.audit_chain_entry.v1`, `kye.audit_retention_policy.v1` **engines**: `internal` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md`, `constitution/35-STREAMING-LOGS.md` |
| `iso-42001.A.7.3` | Annex A — data for AI systems: acquisition of data | enforced | **audit\_events**: `kye.data_use_manifest.v1`, `kye.data_asset.v1` **engines**: `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `iso-42001.A.7.4` | Annex A — quality of data for AI systems | enforced | **audit\_events**: `kye.data_use_manifest.v1` **engines**: `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `iso-42001.A.7.5` | Annex A — data provenance | enforced | **audit\_events**: `kye.data_use_manifest.v1`, `kye.evidence.pack.v1` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `iso-42001.A.7.6` | Annex A — data preparation | enforced | **audit\_events**: `kye.data_use_manifest.v1`, `kye.evidence.model_params.v1` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `iso-42001.A.8.3` | Annex A — information for interested parties about AI systems (transparency) | enforced | **audit\_events**: `kye.comms.dispatched.v1`, `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `iso-42001.A.8.4` | Annex A — external reporting (regulatory or public reporting) | enforced | **audit\_events**: `kye.comms.dispatched.v1` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `iso-42001.A.8.5` | Annex A — communication of incidents to interested parties | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.comms.dispatched.v1` **engines**: `internal` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `iso-42001.A.9.2` | Annex A — processes for responsible use of AI systems | enforced | **audit\_events**: `kye.purpose.admissibility.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.A.9.3` | Annex A — objectives for responsible use of AI systems | enforced | **audit\_events**: `kye.purpose.permission.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.A.9.4` | Annex A — intended use of the AI system | enforced | **audit\_events**: `kye.purpose.permission.v1`, `kye.model.capability_profile.v1` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.A.10.2` | Annex A — allocating responsibilities (third-party relationships) | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1`, `kye.subprocessor.v1` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.A.10.4` | Annex A — suppliers (AI components, data, services) | enforced | **audit\_events**: `kye.subprocessor.v1`, `kye.spof_registry.v1` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `iso-42001.A.10.5` | Annex A — customers (intended deployment context) | enforced | **audit\_events**: `kye.account.v1`, `kye.directory.entry.v1` **constitution\_refs**: `constitution/17-DIRECTORY-SEARCH.md` |
| `iso-42001.A.2.1` | Annex A — policies for AI (organisational AI policy) | enforced | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `iso-42001.A.2.4` | Annex A — review of AI policies | enforced | **audit\_events**: `kye.change_calendar.v1`, `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/DECAY-WINDOWS.md` |
| `iso-42001.A.3.1` | Annex A — internal organisation roles and responsibilities for AI | enforced | **audit\_events**: `kye.risk.authority_register.v1`, `kye.purpose.permission.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.A.4.1` | Annex A — resource documentation for AI systems | enforced | **audit\_events**: `kye.spof_registry.v1`, `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `iso-42001.A.6.1.3` | Annex A — documentation of AI design and development | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.evidence.model_params.v1` **engines**: `internal` **constitution\_refs**: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md` |
| `iso-42001.A.6.2.2` | Annex A — documentation of AI system requirements and specification | enforced | **audit\_events**: `kye.model.capability_profile.v1` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `iso-42001.A.7.1` | Annex A — data management process for AI systems | enforced | **audit\_events**: `kye.data_use_manifest.v1`, `kye.data_flow_graph.v1` **engines**: `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `iso-42001.A.8.1` | Annex A — information for interested parties about AI systems (objectives) | enforced | **audit\_events**: `kye.purpose_manifest.v1` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.A.9.1` | Annex A — processes for responsible use of AI systems (objectives) | enforced | **audit\_events**: `kye.purpose.permission.v1` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-42001.A.10.1` | Annex A — third-party relationships — general (vendor / customer / regulator) | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1`, `kye.directory.entry.v1` **constitution\_refs**: `constitution/49-UNIVERSAL-ENGAGEMENT-RAIL.md` |

Canonical KYE™ surfaces referenced on this page: [KYE Protocol™](https://kyeprotocol.com/).