ISO/IEC 42001:2023 — Annexes A–D

ISO/IEC 42001:2023 includes four annexes. All four are informative — they help the organisation implement the standard, but the organisation tailors application to its own risk profile. This page explains how each annex is used in practice and how the Annex A reference controls flow into the Statement of Applicability.

Quick decision

• You are building the Statement of Applicability → start from the AIMS scope statement (Clause 4.3), then use the Annex A reference areas (A.2–A.10) and the AI risk and impact assessments (Clauses 6.1.2 / 6.1.4) to drive selection.
• You need implementation guidance for an Annex A control → Annex B provides implementation patterns for each Annex A control.
• You are designing the AI risk assessment or impact assessment → Annex C is the idea bank for AI objectives and AI risk sources.
• You need to apply the AIMS across multiple business units or AI system types → Annex D describes how to tailor the AIMS across domains.

TL;DR

• All four annexes are informative. This is the key difference from ISO/IEC 27001 (Annex A normative).
• Annex A — reference control objectives across nine areas (A.2 Policies related to AI through A.10 Third-party and customer relationships).
• Annex B — implementation guidance for each Annex A control.
• Annex C — potential AI objectives + AI risk sources. Idea bank for Clauses 6.1.2 / 6.1.4 / 6.2.
• Annex D — using the AIMS across domains or sectors.
• Statement of Applicability documents Annex A control selection — every accredited audit expects one even though Annex A is informative.
• Modulos models Annex A on OFF-7 / MFF-7 (legacy) and OFF-10 / MFF-10 (clause-aligned) at the area level.

Primary source

ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, Annex A (informative) Reference control objectives and controls; Annex B (informative) Implementation guidance for AI controls; Annex C (informative) Potential AI-related organizational objectives and risk sources; Annex D (informative) Use of the AI management system across domains or sectors. Available via the ISO Online Browsing Platform. © ISO.

Annex A — reference control objectives (informative)

Annex A organises reference control objectives into nine areas:

Area	Focus
A.2 Policies related to AI	AI policy, alignment with other policies, policy review
A.3 Internal organization	AI roles, reporting authority, AI ethics escalation
A.4 Resources for AI systems	data, tooling, compute, human resources
A.5 Assessing impacts of AI systems	impact-assessment process and documentation
A.6 AI system life cycle	design, development, verification, validation, deployment, operation, decommissioning
A.7 Data for AI systems	data sources, quality, provenance, preparation
A.8 Information for interested parties	system documentation, user information, external reporting
A.9 Use of AI systems	intended use, responsible use objectives, monitoring
A.10 Third-party and customer relationships	supplier management, downstream use, contractual terms

Each area contains numbered control objectives. For example A.6.2 covers the AI system life cycle phases (design, development, verification and validation, deployment, operation, decommissioning); A.7 covers data quality, provenance and preparation; A.10 covers supplier management.

How to use Annex A

• Treat it as a baseline library, not a checklist to implement verbatim.
• Drive selection from the AIMS scope statement (Clause 4.3) and the AI risk and impact assessments (Clauses 6.1.2 and 6.1.4). The selection is documented in the Statement of Applicability.
• Translate selected controls into operating reality — who owns them, what "executed" means, what evidence will exist.

What auditors check

• The selection method is rational and documented.
• Exclusions are justified against the risk assessment.
• Selected controls are actually operated, with evidence.
• The SoA is current — it tracks system, supplier and risk-environment changes.

Common failure mode

Copying Annex A control wording into a spreadsheet and calling it a control implementation. The SoA is the output of the risk-driven selection, not the input to it.

Annex B — implementation guidance for AI controls (informative)

Annex B is paired with Annex A — for each Annex A control, Annex B provides implementation guidance describing what "doing the control" can look like in practice.

How to use Annex B

• Use Annex B to design control components (sub-claims) that can each be evidenced.
• Use it to define cadence — when the control is executed, reviewed, refreshed.
• Use it to make controls implementable across teams (engineering, product, risk, compliance).

Common failure mode

Overbuilding — writing a perfect procedure that no one follows. Start with the minimum operational pattern that produces reliable evidence, then iterate as the AIMS matures.

Annex C — potential objectives and risk sources (informative)

Annex C is an idea bank covering two things:

• AI-related organisational objectives the organisation may want to set, measure and review under Clause 6.2 — fairness, transparency, safety, accountability, privacy, robustness, environmental impact and others.
• AI risk sources the risk assessment under Clause 6.1.2 should consider — data sources, model behaviour, human–AI interaction, governance gaps, third-party dependencies, environmental and societal factors.

How to use Annex C

• Convert ideas into measurable objectives with owners and review cadence.
• Use the risk-source categories to improve risk discovery prompts so teams don't miss obvious failure modes.
• Keep objectives tied to decisions — "what do we do differently if the metric moves?".

Common failure mode

Writing objectives that aren't measurable or aren't linked to any governance decisions. An objective without a decision rule is not auditable.

Annex D — using the AIMS across domains or sectors (informative)

Annex D exists because AI governance is rarely one-size-fits-all. Organisations often need a single AIMS that works across:

• multiple business units;
• multiple AI system types (decision support vs automation, external vs internal);
• different regulatory expectations and stakeholder risks (e.g., medical-device vs financial-services AI).

How to use Annex D

• Define what is global (policy, minimum controls, audit cadence) vs local (system-specific requirements and evidence).
• Keep tailoring explicit — which domain has stricter requirements, and why.
• Use a "program + systems" model: stable governance layer plus system-level execution.

How to operationalise the annexes in Modulos

Modulos models the Annex A areas as ORF / MRF requirements on OFF-10 / MFF-10 (clause-aligned) and on OFF-7 / MFF-7 (legacy with more granular per-control breakdown):

Annex A area	OFF-10 / MFF-10 requirement	OFF-7 / MFF-7 requirements
A.2 Policies related to AI	ORF-191	ORF-80, ORF-81, ORF-82
A.3 Internal organization	ORF-192	ORF-83, ORF-84
A.4 Resources for AI systems	ORF-193	MRF-85, MRF-86, MRF-87, MRF-88, MRF-89
A.5 Assessing impacts of AI systems	ORF-194	MRF-90, MRF-91, MRF-92
A.6 AI system life cycle	MRF-216	MRF-93…MRF-100 (development → deployment → operation)
A.7 Data for AI systems	MRF-217	MRF-101, MRF-102, MRF-103, MRF-104
A.8 Information for interested parties	MRF-218	MRF-105, MRF-106 + ORF-89, ORF-90
A.9 Use of AI systems	MRF-219	MRF-107 + ORF-86
A.10 Third-party and customer relationships	MRF-220	MRF-84

Operating rules:

• Annex A / B → controls + components. Define what "executed" means at the smallest meaningful claim and attach evidence to that.
• Annex C → objectives + risk sources. Wire AI objectives into monitoring or testing signals and into risk-treatment decisions; wire risk sources into the AI risk-assessment method (Clause 6.1.2).
• Annex D → operating model across projects. Reuse controls across multiple AI-system MFF projects while preserving the per-system audit trail.
• Statement of Applicability is owner-authored documentation stored as control-level evidence on the Annex A area requirements. Modulos does not provide a dedicated SoA workflow surface.

Framework mapping

Four layers, one reusable spine.

Frameworks

EU AI ActRegulatory

ISO 42001Standard

Requirements

Art. 9.1Risk management

Art. 10.2Data governance

6.1.1Risk assessment

Components

Risk identification

Impact analysis

Evidence

Risk registerDocument

Test resultsArtifact

Controls

The reusable spine

One control satisfies many requirements across many frameworks, and groups the components and evidence beneath them.

Risk assessment process

Data validation checks

Reusable

Edge from any layer card crosses into the Controls spine — the same control may serve a regulatory article, a standards clause, a downstream component, and the evidence that closes it.

Cross-framework mapping (preview)

ISO 42001 Annex area	Adjacent provision
A.2 Policies related to AI	ISO 27001 Clause 5.2 + Annex A.5 organisational policies
A.5 Assessing impacts of AI systems	EU AI Act Article 27 FRIA; algorithmic-impact-assessment frameworks
A.6 AI system life cycle	EU AI Act Articles 8–15 substantive obligations; NIST AI RMF GenAI Profile
A.7 Data for AI systems	EU AI Act Article 10 data governance; GDPR Articles 5, 6, 9, 10; ISO 27701 PIMS
A.8 Information for interested parties	EU AI Act Article 13 transparency; Article 50 transparency duties
A.9 Use of AI systems	EU AI Act Article 26 deployer duties
A.10 Third-party and customer relationships	EU AI Act Article 25 value chain; NIS2 Article 21(2)(d) supply-chain security; ISO 27001 Annex A.5.19 supplier relationships

Related pages

ISO 42001 overview

Hub: AIMS structure, Annex SL backbone, certification path

Scope and certification

AIMS scope, Statement of Applicability, Stage 1 / Stage 2 / surveillance / recertification

Clauses 4–10 (implementation guide)

Annex SL backbone with AIMS-specific additions

Operationalizing in Modulos

OFF-7 / MFF-7 (legacy) and OFF-10 / MFF-10 (clause-aligned) rollout

Source attribution

ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, Annex A (informative), Annex B (informative), Annex C (informative), Annex D (informative). © ISO/IEC. Available via the ISO Online Browsing Platform.

Disclaimer

This page is for general informational purposes and does not constitute legal or certification advice.