Frameworks · ISO/IEC 42001
ISO/IEC 42001 AI management system readiness
ISO/IEC 42001 readiness in TrustProof takes your AI management system through each clause and Annex A control, with templates and owner sign-offs. Certification remains the decision of an accredited certification body; TrustProof prepares you for that audit.
Key facts
What you can check
- Requirement library
- 65 requirements: 27 for clauses 4 to 10 and 38 Annex A controls, in TrustProof's own words with clause numbers only.
- Policy and procedure templates
- 27 templates, from the AI policy to the Statement of Applicability. Each one is a draft until your management signs it off.
- Read-only AI evidence checks
- Three read-only checks look at Amazon Bedrock invocation logging, Bedrock guardrails and an inventory of AI resources. They read metadata only, never prompts or model outputs.
- SHA-256 sign-offs
- Each owner sign-off pins a SHA-256 fingerprint of exactly what was approved. If the document or decision changes, the sign-off stops counting until it is approved again.
- Hosted in AWS Sydney
- TrustProof runs on AWS in the Sydney region (ap-southeast-2), encrypted at rest and in transit.
What TrustProof does
- Walks you through each clause and Annex A control
- Turns templates into draft AI policies for your sign-off
- Records your applicability decision and justification for each Annex A control
- Gives your auditor their own dashboard, with two-step verification
What TrustProof doesn't do
- TrustProof does not certify. Certification is decided by an accredited certification body.
- Readiness is not, by itself, compliance with the EU AI Act, the Privacy Act or any other law.
- It is not legal advice.
FAQ
Frequently asked questions
Do we have to adopt every Annex A control?
No. You decide for each Annex A control whether it applies, based on your AI risk assessment. Excluding one needs a written justification, and your management signs off the decisions.
What does the library cover?
65 requirements: clauses 4 to 10 and all 38 Annex A controls. Each Annex A control can be excluded only with a written justification, which becomes your Statement of Applicability entry.
Does TrustProof read our prompts or model outputs?
No. The AI checks list resources and settings through the read-only role, such as whether Bedrock invocation logging is on. They do not read prompts, outputs or logs.
Does ISO/IEC 42001 readiness mean we meet AI laws?
No. Readiness is not, by itself, compliance with the EU AI Act, the Privacy Act or any other law, and TrustProof does not give legal advice.