# Iso 42001 Check

> ISO/IEC 42001:2023 AI Management System (AIMS) compliance checklist — 38 controls across 9 Annex A clauses (A.2-A.10). Use BEFORE certification audit, customer compliance request, or major AIMS review. Mode-selection scope-check supports certification, self-attestation, internal-alignment, and customer-requirement postures.

- **Type:** Skill
- **Install:** `agentstack add skill-pitimon-claude-governance-iso-42001-check`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [pitimon](https://agentstack.voostack.com/s/pitimon)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [pitimon](https://github.com/pitimon)
- **Source:** https://github.com/pitimon/claude-governance/tree/main/skills/iso-42001-check

## Install

```sh
agentstack add skill-pitimon-claude-governance-iso-42001-check
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# ISO/IEC 42001 AIMS Compliance Check (38 Annex A Controls)

**Standard**: ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system
**Status**: Voluntary, certifiable. Not regulatory.
**Anti-pattern**: Discovering AIMS gaps during the certification audit instead of months before.

> ⚠️ **NOT A CERTIFICATION GUARANTEE.** This skill produces a developer-facing AIMS readiness checklist. Certification requires a third-party audit by an accredited certification body. The skill helps surface gaps and prepare evidence — nothing more.

> **Paywall notice**: ISO/IEC 42001:2023 is paywalled (~CHF 174 from `iso.org/standard/81230.html`). Control titles in `reference.md` are paraphrased from secondary sources; consult the standard for normative wording.

> **Companion plugin**: For the 7-step development workflow that produces AIMS-shaped evidence as a side effect, install [`pitimon/8-habit-ai-dev`](https://github.com/pitimon/8-habit-ai-dev) alongside this plugin. The two plugins are complementary by design.

## When to Use

- Before a third-party ISO 42001 certification audit
- After an enterprise customer asks for ISO 42001 readiness evidence
- During architecture design of a new AI system (apply A.5 + A.6 controls early)
- After significant changes to AI policy, data governance, or third-party AI dependencies
- For periodic AIMS self-attestation (quarterly / annually)

## When to Skip

- Project does **not produce/deploy/operate an AI system** (per ISO/IEC 22989 vocabulary) — skip entirely
- Already covered by a recent (.md` **in the user's project repository** (not in this plugin). Create the folder once via `mkdir -p docs/compliance/iso-42001/reports` if it doesn't exist.

### Step 3 — Conscience Check

> "Have I built an actual AI Management System, or just produced a checklist for the auditor?"
> "Do I understand WHY ISO 42001 exists (responsible AI governance at organizational scale), not just WHAT to evidence?"
> "If our AI system caused harm tomorrow, would these controls have prevented it — or just documented it?"

## Handoff

- **Expects from predecessor**: A defined AI system with documented intended purpose and at least one round of `/spec-driven-dev`
- **Produces for successor**: Compliance report + gap list. Failures route back to:
  - `/spec-driven-dev` for documentation gaps (A.5, A.6, A.8, A.9)
  - `/governance-check` for V&V and process gaps (A.6.2.4 test coverage)
  - `/create-adr` for policy + decision gaps (A.2, A.10)
  - `governance-reviewer` agent for deep multi-file audit (A.5, A.7)
  - **External** (use `pitimon/8-habit-ai-dev`'s `/deploy-guide`, `/monitor-setup`, `/ai-dev-log`) for runtime concerns: deployment (A.6.2.5), operation/monitoring (A.6.2.6), event logs (A.6.2.8), incident communication (A.8.4)

## Definition of Done

- [ ] Scope pre-flight completed; posture + AI sourcing documented in `scope-decision.md`
- [ ] All 38 Annex A controls checked with Pass/Fail/N-A + 1-line evidence (or 17 MUST in default mode)
- [ ] MUST + GAP items identified explicitly (deploy-blockers for certification)
- [ ] Critical gaps mapped to remediation route (governance skill or external)
- [ ] Report saved under `docs/compliance/iso-42001/reports/` in the user's project repo
- [ ] Conscience Check questions answered honestly
- [ ] (For certification audit) Auditor engagement scheduled with evidence package ready

## References

- Annex A reference: `${CLAUDE_PLUGIN_ROOT}/skills/iso-42001-check/reference.md` (38 controls with paraphrased titles, tier tags, evidence paths)
- User-facing mapping: `${CLAUDE_PLUGIN_ROOT}/docs/compliance/ISO-42001-MAPPING.md` (coverage scorecard, gap analysis, Standards Family, end-to-end example)
- Framework selection rationale: `${CLAUDE_PLUGIN_ROOT}/docs/adr/ADR-004-iso-42001-framework-selection.md` (why 42001 first; why 23894/5338/22989 are informative cross-refs only)
- DSGAI cross-reference: `${CLAUDE_PLUGIN_ROOT}/docs/compliance/DSGAI-MAPPING.md` (DSGAI04 ↔ A.7.4/A.7.5/A.10.3, DSGAI19 ↔ A.9.x, DSGAI03 ↔ A.4.x)
- EU AI Act cross-reference: `${CLAUDE_PLUGIN_ROOT}/docs/compliance/EU-AI-ACT-MAPPING.md` (Art. 10 ↔ A.5/A.7, Art. 11 ↔ A.6, Art. 14 ↔ A.9)

> ⚠️ **NOT A CERTIFICATION GUARANTEE.** This skill is a developer reference. The 38-control checklist is derived from secondary sources of ISO/IEC 42001:2023 Annex A; consult the paywalled standard for normative wording. ISO 42001 certification requires a third-party audit by an accredited certification body — passing this checklist is not certification.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [pitimon](https://github.com/pitimon)
- **Source:** [pitimon/claude-governance](https://github.com/pitimon/claude-governance)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-pitimon-claude-governance-iso-42001-check
- Seller: https://agentstack.voostack.com/s/pitimon
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.