Regulation map
ISO/IEC 42001, area by area.
The AI management system standard, mapped to the evidence elan1 agents leave: rules before every action, a signed record after it. Free to read, no form.
- Last reviewed
- Access
- Read free · no form
In short
The short answer.
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the first international standard for an AI management system, published in December 2023. It applies to any organisation that develops, provides or uses AI, and it is certifiable: an accredited certification body can audit an organisation against it.
- Applies to
- Any organisation that develops, provides or uses AI, of any size. It follows the structure shared by ISO management system standards: clauses 4 to 10, and 38 reference controls in Annex A across 9 control objectives.
- Key dates
- Dec 2023ISO/IEC 42001:2023 is published.
Clause by clause
Each duty, and the control that answers it.
| Clause, and what it asks | elan1 control | Mapped to | Claim IDs |
|---|---|---|---|
| Use of AI systemsDefined objectives and processes for responsible use, including where a person must be involved. | Operational controls as rules: elan1 Govern turns approval policy into rules evaluated before every agent action. |
| |
| AI system life cycle: event logsEvent logs during operation. | Evidence of operation: every action, allowed, approved or refused, leaves a signed, hash-chained record that can be exported for audit. |
| |
| AI system life cycle: verification and validationDocumented requirements, verification and validation before deployment. | elan1 Act tests ERP changes against a copy of your data before they go live; elan1 Decide runs in shadow before any automation. |
| No claim ID |
| Third-party relationshipsClarity about responsibilities when AI components come from suppliers. | elan1 Run places each AI component behind a versioned contract, so third-party responsibilities are named. |
| No claim ID |
Mappings are drafts for your counsel and auditors. They are not certification, legal advice or regulator approval.
What this map does not claim.
- elan1 is not certified to ISO/IEC 42001, and using elan1 does not make an organisation compliant.
- ISO/IEC 42001 certification is not, on its own, conformity with the EU AI Act.
By industry
Where this rule shows up.
Professional Services and GCCs
ISO/IEC 27001, ISO/IEC 42001, EU AI Act (overseas parents and clients)
Govern control mappings.
- elan1 Govern
Read more
The explainer, and the official text.
Regulation watch
ISO/IEC 42001: a management system for AI, explained
The certifiable standard for running AI responsibly, and the evidence an agent should leave.
4 min read
Paper · June 2026 · 3 min read
A record a stranger can check: designing an audit trail for agents
Why an agent's record should be verifiable offline, without trusting the vendor.
elan1 research team
Read free · no form
Questions
ISO/IEC 42001, plainly.
No. elan1 is not certified to ISO/IEC 42001, and using elan1 does not make an organisation compliant. ISO/IEC 42001:2023 is a voluntary standard that an accredited certification body audits an organisation against. What elan1 supplies is evidence that controls operated: which agent actions were approved, by whom and under which rule version. We list a security certification only once it is held, with its scope.
Evidence that its controls operated, not only a policy. A rule saying risky actions need approval is a start; a record showing which actions were approved, by whom and under which rule version makes the control demonstrable. Event logs during operation, verification before deployment and clear supplier responsibilities also map to the standard's control areas.
Annex A sets out 38 reference controls across 9 control objectives, from AI policy and internal organisation to data, the AI system life cycle, use of AI systems and third-party relationships. An organisation selects the controls that apply and records its choices, with the reasons, in a statement of applicability.
No. ISO/IEC 42001 certification shows that an organisation runs an AI management system to the standard. It is not, on its own, conformity with the EU AI Act, whose high-risk duties and deployer obligations are set separately in law. Take your counsel's view on how the two relate for each use of AI.
No. Mappings are drafts for your counsel and auditors. They are not certification, legal advice or regulator approval. Each row names the clause or duty, what it asks, the elan1 control that answers it and, where one is assigned, the claim ID behind it, so your counsel and auditors can test each mapping against the receipts.
Other maps
The other rules we map.
- Allowed · Approved by Asha R.
- Held for CFO
- Refused · rule 4.2