Iso 42001 Check

ISO/IEC 42001 AIMS Compliance Check (38 Annex A Controls)

Standard: ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system Status: Voluntary, certifiable. Not regulatory. Anti-pattern: Discovering AIMS gaps during the certification audit instead of months before.

> ⚠️ NOT A CERTIFICATION GUARANTEE. This skill produces a developer-facing AIMS readiness checklist. Certification requires a third-party audit by an accredited certification body. The skill helps surface gaps and prepare evidence — nothing more.

> Paywall notice: ISO/IEC 42001:2023 is paywalled (~CHF 174 from iso.org/standard/81230.html). Control titles in reference.md are paraphrased from secondary sources; consult the standard for normative wording.

> Companion plugin: For the 7-step development workflow that produces AIMS-shaped evidence as a side effect, install pitimon/8-habit-ai-dev alongside this plugin. The two plugins are complementary by design.

When to Use

• Before a third-party ISO 42001 certification audit
• After an enterprise customer asks for ISO 42001 readiness evidence
• During architecture design of a new AI system (apply A.5 + A.6 controls early)
• After significant changes to AI policy, data governance, or third-party AI dependencies
• For periodic AIMS self-attestation (quarterly / annually)

When to Skip

• Project does not produce/deploy/operate an AI system (per ISO/IEC 22989 vocabulary) — skip entirely
• Already covered by a recent (.md **in the user's project repository** (not in this plugin). Create the folder once via mkdir -p docs/compliance/iso-42001/reports` if it doesn't exist.

Step 3 — Conscience Check

> "Have I built an actual AI Management System, or just produced a checklist for the auditor?" > "Do I understand WHY ISO 42001 exists (responsible AI governance at organizational scale), not just WHAT to evidence?" > "If our AI system caused harm tomorrow, would these controls have prevented it — or just documented it?"

Handoff

• Expects from predecessor: A defined AI system with documented intended purpose and at least one round of /spec-driven-dev
• Produces for successor: Compliance report + gap list. Failures route back to:
• /spec-driven-dev for documentation gaps (A.5, A.6, A.8, A.9)
• /governance-check for V&V and process gaps (A.6.2.4 test coverage)
• /create-adr for policy + decision gaps (A.2, A.10)
• governance-reviewer agent for deep multi-file audit (A.5, A.7)
• External (use pitimon/8-habit-ai-dev's /deploy-guide, /monitor-setup, /ai-dev-log) for runtime concerns: deployment (A.6.2.5), operation/monitoring (A.6.2.6), event logs (A.6.2.8), incident communication (A.8.4)

Definition of Done

• [ ] Scope pre-flight completed; posture + AI sourcing documented in scope-decision.md
• [ ] All 38 Annex A controls checked with Pass/Fail/N-A + 1-line evidence (or 17 MUST in default mode)
• [ ] MUST + GAP items identified explicitly (deploy-blockers for certification)
• [ ] Critical gaps mapped to remediation route (governance skill or external)
• [ ] Report saved under docs/compliance/iso-42001/reports/ in the user's project repo
• [ ] Conscience Check questions answered honestly
• [ ] (For certification audit) Auditor engagement scheduled with evidence package ready

References

• Annex A reference: ${CLAUDE_PLUGIN_ROOT}/skills/iso-42001-check/reference.md (38 controls with paraphrased titles, tier tags, evidence paths)
• User-facing mapping: ${CLAUDE_PLUGIN_ROOT}/docs/compliance/ISO-42001-MAPPING.md (coverage scorecard, gap analysis, Standards Family, end-to-end example)
• Framework selection rationale: ${CLAUDE_PLUGIN_ROOT}/docs/adr/ADR-004-iso-42001-framework-selection.md (why 42001 first; why 23894/5338/22989 are informative cross-refs only)
• DSGAI cross-reference: ${CLAUDE_PLUGIN_ROOT}/docs/compliance/DSGAI-MAPPING.md (DSGAI04 ↔ A.7.4/A.7.5/A.10.3, DSGAI19 ↔ A.9.x, DSGAI03 ↔ A.4.x)
• EU AI Act cross-reference: ${CLAUDE_PLUGIN_ROOT}/docs/compliance/EU-AI-ACT-MAPPING.md (Art. 10 ↔ A.5/A.7, Art. 11 ↔ A.6, Art. 14 ↔ A.9)

> ⚠️ NOT A CERTIFICATION GUARANTEE. This skill is a developer reference. The 38-control checklist is derived from secondary sources of ISO/IEC 42001:2023 Annex A; consult the paywalled standard for normative wording. ISO 42001 certification requires a third-party audit by an accredited certification body — passing this checklist is not certification.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: pitimon
• Source: pitimon/claude-governance
• License: MIT

Install and usage instructions live in the source repository linked above.