Standard · ISO/IEC 42001
Operational control you can show, one action at a time.
ISO/IEC 42001:2023 sets out an AI management system. elan1 supplies one part: the control on each consequential action, and the record that it ran.
ISO/IEC 42001 asks an organisation to run an AI management system and show that its controls operate, not only that policies exist. For AI agents, auditors look for runtime evidence such as event logs (Annex A control A.6.2.8) and records of human oversight. elan1 produces that evidence per action, in a proof record.
elan1 does not certify you or itself against ISO/IEC 42001.
01What it asks
A management system, audited as a whole.
The standard follows the harmonised structure used by other ISO management system standards, with AI-specific controls in Annex A.
- Clauses 4–10Context, leadership, planning (including AI risk and impact assessment), support, operation, performance evaluation, improvement.
- Annex AReference controls — policies, internal organisation, resources, impact assessment, life cycle, data, information for interested parties, use of AI systems, third parties — recorded in a Statement of Applicability.
- CertificationAn accredited body audits the management system. No tool can hold that audit on your behalf, and using one does not give you a certificate.
Source: ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, clauses 4–10 and Annex A.
02How elan1 helps
Where elan1 acts, and the evidence it leaves.
Five places where a governed action produces evidence your management system can point to.
| What the standard asks | elan1 mechanism | Evidence | At the moment of action? |
|---|---|---|---|
| Operational control (Cl. 8) | Versioned declarations checked on every write | Declaration version per record | Mode A enforced |
| Roles and responsibilities (Cl. 5; Annex A) | Named approvers; actor on every record | F09–F10 | Yes |
| Monitoring and internal audit (Cl. 9) | Records and refusals in the Assurance door | The chain | — |
| Use of AI systems (Annex A) | Autonomy ceiling; human approval | F11 | Mode A enforced |
| Third parties (Annex A) | Third-party agents in Mode B; no claim before C1–C14 pass | Conformance result | — |
“Enforced” applies only in Mode A, where elan1 holds the write credential. In Mode B every write intent is evaluated and recorded; we call that attested advisory, never blocked.
03Not covered
What elan1 helps with, and what it does not.
Stated at equal weight, so nobody reads a gap as a feature.
Helps you produce evidence for
- Operational control on every consequential write (Cl. 8)
- Roles and responsibilities: named approvers and the actor on every record (Cl. 5; Annex A)
- Monitoring and internal audit: records and refusals, read without touching the system of record (Cl. 9)
- Use of AI systems: an autonomy ceiling and human approval (Annex A)
- Third parties: agents connected in Mode B, with no claim before C1–C14 pass (Annex A)
Does not cover
- Your AI policy and scope
- Risk and impact assessments
- The Statement of Applicability
- Competence, management review, internal audit itself
- The certification audit
We say elan1 helps you produce evidence for a management system. We never say it makes you compliant.
04Regulation mapper
Clause by clause, to the rung that acts.
Select a row to see which rung of the Right Path it maps to. Switch frameworks to compare; nothing here is a certification.
ISO/IEC 42001: Operational control (Cl. 8) maps to rung 4 evaluate().
| Requirement | elan1 control | Evidence produced | Not covered | Enforced at action time? |
|---|---|---|---|---|
| Rung 4 evaluate(): versioned declarations checked on every write | Declaration version per record (F06–F08) | Operational planning outside the write path | Yes, Mode A only | |
| Rung 6 AUTONOMY: named approvers; actor on every record | F09–F10 | Assigning roles and building competence | Mode A enforced; Mode B recorded | |
| Rung 8 PROOF: one proof record per governed action | The chain | Logs of model behaviour outside the write | Recorded at the action, both modes | |
| Records and refusals in the Assurance door | The chain | Your internal audit programme | After the action | |
| Rung 6 AUTONOMY: autonomy ceiling; human approval | F11 | Your policy on where AI may be used | Yes, Mode A only | |
| Rung 2 WRITE DOOR: third-party agents in Mode B; no claim before C1–C14 pass | Conformance result | Supplier due diligence | Recorded at the action, both modes | |
| None | None | Context, leadership, planning, support, review, improvement and the Statement of Applicability | No. Outside elan1 |
Where this is weak: Mode B records the write; it cannot stop it. “Enforced” applies only in Mode A, where elan1 holds the write credential.
Clause references summarise the official text. Not legal advice. elan1 holds no certificate against any framework. Source: ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system.
Read the full page: ISO/IEC 42001: what it asks and how elan1 helps
05Worked example
One rule, its clauses, and the record it writes.
A month-end close rule, written once as a declaration. The same rule is your operational control, your role assignment and your sample for internal audit.
1 · The rule, in the declaration
# decl_month_end_close · v7 (illustrative)
write_type: journal_entry.post
pre_gates: [G1_LEDGER, G3_PERMISSIONS, G8_MCA]
autonomy_ceiling: A2
when: period == "closing"
and amount_inr > 1000000
approver: role:financial_controller
approver_not_requester: true
record: always # refusals includedDuring closing, journal entries above ₹10,00,000 need the financial controller, who is not the requester. Every outcome writes a record.
2 · The clauses it serves
- Cl. 8Operational control: the rule is applied to every write, not described in a policy alone.
- Cl. 5Roles and responsibilities: the approver is named by role and is never the requester.
- Annex AUse of AI systems: the agent works up to A2; above it a person decides.
- Cl. 9Performance evaluation: allows and refusals are there to sample.
3 · The proof record it writes
- F05journal_entry.post
- F06decl_month_end_close
- F077
- F082027.06.1
- F09usr_specimen_approver
- F10human
- F11A2
- F12je_specimen_5531
Illustrative specimen. Not customer data.
06What an auditor sees
One record, each field mapped to its clause.
For a sample of actions, the declaration version in force, who acted, at what autonomy level, and the refusals beside the allows, in a chain that shows nothing was edited afterwards.
- F01tenant_id
- tnt_specimen_01
- F02seq
- 1042
- F03prev_digest
- sha256:9f3c…e41a
- F04write_id
- wr_specimen_7c2
- F05write_type
- journal_entry.post
- F06declaration_id
- decl_month_end_close
- F07declaration_version
- 7
- F08policy_version
- 2027.06.1
- F09actor_id
- usr_specimen_approver
- F10actor_kind
- human
- F11autonomy_level
- A2
- F12record_id
- je_specimen_5531
- F13record_version
- 2
- F14payload_hash
- sha256:51b0…7d9a
- F15lexicon_hash
- sha256:e2c4…0b16
- F16recorded_at
- 2027-07-14T10:42:07+05:30
Illustrative specimen. Not customer data.
Field notes · select a note to mark its fields
07FAQ
ISO/IEC 42001: questions we are asked.
Evidence that the controls in your AI management system operate, not only that policies exist. For AI agents, that usually means event logs of what the agent did, records of human oversight and approvals, and proof of which rules were in force at the time. elan1 produces that evidence per action, in a proof record, refusals included.
A.6.2.8 is the Annex A control on recording AI system event logs. It asks the organisation to decide at which phases of the AI system life cycle event logs are kept, and at minimum to keep them while the system is in use. elan1's proof records are one source of that evidence for the actions an agent takes.
Each record carries evidence for several clauses at once. The declaration and policy versions (F07, F08) show operational control under clause 8; the actor fields (F09, F10), naming who acted and whether a person or an agent, show roles under clause 5 and Annex A; the autonomy level (F11) shows how the AI system was used; and the chain supports monitoring and internal audit under clause 9. The mapper on this page shows each row.
No. elan1 holds no ISO/IEC 42001 certificate, and using elan1 does not give you one. Certification is an audit of your whole AI management system by an accredited body; elan1 helps you produce evidence for parts of it: operational control, roles and monitoring at the moment of action.
You decide which Annex A controls apply and how you meet them. Where you use elan1 for a control, your Statement of Applicability can point to its declarations and records as evidence. The justification stays yours.
Declarations are versioned. Every proof record carries the declaration version (F07) and the policy version (F08), so a sample shows exactly which rules applied to each action.
Yes. The Assurance door shows records, refusals and approvals, read without touching the system of record. Refusals sit beside the allows, so you can see the control fire, not only pass.
Third-party agents connect in Mode B over MCP or HTTP: every write intent is evaluated and recorded, but not enforced. A third-party agent may not claim to run on elan1 Govern until conformance tests C1–C14 pass.
Last reviewed
Reviewed against the official text. Not legal advice; your counsel decides how the law applies to you.
| Date | Change |
|---|---|
| 6 Oct 2026 | First version. Mapped clauses 5, 8 and 9 and Annex A controls to elan1 mechanisms; listed what is not covered. |
| 10 Oct 2026 | Reviewed at launch: wording updated now that elan1 Govern, Work, Decide and Run are available. Clause references unchanged. |
// NEXT STEP
Find out where you stand, in five minutes.
Twelve questions. A plain result. Nothing is stored or sent, and no email is needed.