Skip to main content

​
AIGO — ISO/IEC 42001 AIGO Control Mapping

​
1. Document Purpose

This document establishes the detailed requirement-to-control crosswalk between ISO/IEC 42001:2023 and the AIGO AI Governance Operating Framework. ISO/IEC 42001:2023 is an International Standard specifying requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). ISO currently lists the standard as published, first edition, December 2023. This mapping translates the ISO/IEC 42001 management-system requirements into reusable AIGO controls while preserving the distinction between:
  • ISO/IEC 42001 requirements;
  • AIGO governance objectives;
  • AIGO controls;
  • implementation procedures;
  • evidence;
  • assurance; and
  • external certification.
This document does not reproduce ISO/IEC 42001 and does not constitute ISO certification or a certification-body audit.

​
2. Mapping Information

ISO currently lists ISO/IEC 42001:2023 as published and applicable to organizations providing or using AI-based products or services.

​
3. Control-Mapping Principle

The control architecture is:
AIGO controls are implementation mechanisms. They do not change the normative meaning of ISO/IEC 42001.

​
4. Control Relationship Types

The registry should use:

​
DIRECT

The AIGO control directly addresses the mapped ISO requirement.

​
PARTIAL

The control addresses only part of the requirement.

​
SUPPORTING

The control supports implementation but does not cover the entire requirement.

​
INTEGRATED

Multiple AIGO controls collectively implement the requirement.

​
CONDITIONAL

The control applies only under defined scope or organizational conditions.

​
CROSS_REFERENCE

An existing AIGO control or artifact is authoritative and is referenced rather than duplicated.

​
NO_DIRECT_EQUIVALENT

The requirement must be addressed through an organizational or external mechanism not represented by a dedicated AIGO control.

​
5. Control Status Model

AIGO controls should distinguish:
Control status is an AIGO implementation status and is not an ISO certification status.

​
6. Control Identifier Model

The ISO mapping should reference stable AIGO control identifiers. Recommended regulatory-mapping relationship identifiers:
Examples:
The actual underlying AIGO Control Schema identifier remains authoritative.

​
7. Control Domains

The initial domain structure is:

​
8. Clause 4 — Context Controls

​
ISO42001-CTRL-CTX-001

Name: AIMS Context Determination Objective: Establish and maintain the internal and external context relevant to the AIMS. Relationship: DIRECT AIGO Components:
  • Governance;
  • AI System;
  • Risk;
  • Assessment;
  • Management Review.
Activities:
  • identify internal issues;
  • identify external issues;
  • identify AI-related organizational factors;
  • assess regulatory context;
  • review technological context;
  • document significant context changes.
Evidence:
  • context analysis;
  • governance record;
  • management-review record;
  • change assessment.

​
9. ISO42001-CTRL-CTX-002

Name: Interested-Party Determination Objective: Identify interested parties and relevant requirements affecting the AIMS. Relationship: DIRECT Activities:
  • stakeholder identification;
  • requirement identification;
  • expectation analysis;
  • regulatory mapping;
  • review.
Evidence:
  • interested-party register;
  • requirements mapping;
  • review record.

​
10. ISO42001-CTRL-CTX-003

Name: AIMS Scope Governance Objective: Define and maintain the scope of the AIMS. Relationship: DIRECT / CRITICAL Activities:
  • define organizational boundaries;
  • identify AI activities;
  • identify products/services;
  • identify locations;
  • identify interfaces;
  • document exclusions where appropriate;
  • approve scope;
  • review after material change.
Evidence:
  • AIMS scope statement;
  • governance approval;
  • change review.

​
11. Clause 5 — Leadership Controls

​
ISO42001-CTRL-GOV-001

Name: AIMS Leadership Governance Objective: Establish leadership accountability for the AIMS. Relationship: DIRECT Activities:
  • assign accountability;
  • establish governance;
  • allocate resources;
  • approve policy;
  • review performance;
  • support continual improvement.
Evidence:
  • governance decisions;
  • approved policy;
  • management review;
  • resource decisions.

​
12. ISO42001-CTRL-GOV-002

Name: AI Governance Policy Objective: Establish and maintain the organization’s AI policy and its alignment with the AIMS. Relationship: DIRECT Activities:
  • policy creation;
  • approval;
  • communication;
  • review;
  • update.
Evidence:
  • approved policy;
  • version history;
  • communication evidence.

​
13. ISO42001-CTRL-ROL-001

Name: AI Governance Roles and Authorities Objective: Define responsibilities and authorities for relevant AIMS activities. Relationship: DIRECT Roles may include:
  • AI Governance Owner;
  • AI System Owner;
  • Risk Owner;
  • Control Owner;
  • Evidence Owner;
  • Assurance Owner;
  • Management Review authority.
Evidence:
  • role matrix;
  • assignments;
  • delegation records.

​
14. ISO42001-CTRL-ROL-002

Name: AI Accountability Assignment Objective: Ensure accountable ownership exists for material AI governance outcomes. Relationship: DIRECT / CRITICAL AIGO should distinguish accountability from the operational performance of individual tasks.

​
15. Clause 6 — Planning Controls

​
ISO42001-CTRL-RSK-001

Name: AIMS Risks and Opportunities Objective: Identify and address risks and opportunities relevant to the AIMS. Relationship: DIRECT Activities:
  • risk identification;
  • risk assessment;
  • opportunity identification;
  • treatment;
  • monitoring;
  • review.
Evidence:
  • Risk Schema records;
  • assessments;
  • treatment plans;
  • residual-risk decisions.

​
16. ISO42001-CTRL-RSK-002

Name: AI System Risk Integration Objective: Connect AI-system risks with AIMS-level risk and opportunity management. Relationship: INTEGRATED Architecture:
This avoids creating separate, disconnected risk systems.

​
17. ISO42001-CTRL-OBJ-001

Name: AIMS Objectives Governance Objective: Define, monitor, and review AIMS objectives. Relationship: DIRECT Activities:
  • objective definition;
  • ownership;
  • measures;
  • targets where appropriate;
  • monitoring;
  • review;
  • improvement.

​
18. ISO42001-CTRL-OBJ-002

Name: AIMS Objective Performance Monitoring Objective: Measure progress against AIMS objectives. Relationship: DIRECT Evidence:
  • KPI/indicator records;
  • monitoring results;
  • management review;
  • corrective actions.

​
19. ISO42001-CTRL-CHG-001

Name: AIMS Change Planning Objective: Ensure material changes to the AIMS are planned and controlled. Relationship: DIRECT Triggers:
  • organizational change;
  • new AI systems;
  • major AI-system change;
  • regulatory change;
  • outsourcing;
  • technology change.

​
20. Clause 7 — Support Controls

​
ISO42001-CTRL-RES-001

Name: AIMS Resource Management Objective: Ensure adequate resources are available for effective AIMS operation. Relationship: DIRECT Resources may include:
  • people;
  • technology;
  • infrastructure;
  • assurance;
  • training;
  • monitoring;
  • financial resources.

​
21. ISO42001-CTRL-COM-001

Name: AI Competence Management Objective: Establish competence requirements and maintain evidence that relevant personnel are appropriately competent. Relationship: DIRECT Activities:
  • role analysis;
  • competence requirements;
  • training;
  • experience;
  • qualifications;
  • assessment;
  • reassessment.

​
22. ISO42001-CTRL-COM-002

Name: AI Awareness Management Objective: Establish awareness of relevant AI policy, responsibilities, risks, controls, and consequences. Relationship: DIRECT

​
23. ISO42001-CTRL-COM-003

Name: AI Governance Communication Objective: Control relevant internal and external communication relating to the AIMS. Relationship: DIRECT Evidence:
  • communication plans;
  • notices;
  • reports;
  • regulatory correspondence.

​
24. ISO42001-CTRL-DOC-001

Name: AIMS Documented Information Control Objective: Control the creation, approval, modification, access, distribution, storage, retention, and disposition of documented information. Relationship: DIRECT / CRITICAL Evidence:
  • controlled documents;
  • approvals;
  • versions;
  • access records;
  • retention records.

​
25. ISO42001-CTRL-DOC-002

Name: AIMS Document Integrity Objective: Protect documented information against unauthorized modification and loss of integrity. Relationship: SUPPORTING This control should integrate with the AIGO Document Integrity Checker.

​
26. Clause 8 — Operation Controls

​
ISO42001-CTRL-OPS-001

Name: AI Operational Planning and Control Objective: Ensure AI-related operational processes are planned, implemented, and controlled. Relationship: DIRECT / CRITICAL Activities:
  • operational planning;
  • lifecycle governance;
  • control execution;
  • evidence generation;
  • monitoring;
  • change management.

​
27. ISO42001-CTRL-AI-001

Name: AI Lifecycle Governance Objective: Govern AI systems throughout their lifecycle. Relationship: DIRECT / INTEGRATED Lifecycle:
The AIGO AI System, Risk, Control, Assessment, Approval, Monitoring, Change, Incident, Assurance, and Retirement schemas collectively support this control.

​
28. ISO42001-CTRL-AI-002

Name: AI System Registration Objective: Maintain a controlled inventory of AI systems within the AIMS scope. Relationship: DIRECT Evidence:
  • AI System Registration;
  • system identifier;
  • owner;
  • status;
  • lifecycle state;
  • scope.

​
29. ISO42001-CTRL-AI-003

Name: AI System Purpose and Context Governance Objective: Ensure intended purpose, users, deployment context, and relevant limitations are defined. Relationship: DIRECT Evidence:
  • AI System Profile;
  • intended-purpose statement;
  • use context;
  • affected-person analysis.

​
30. ISO42001-CTRL-AI-004

Name: AI System Approval Gate Objective: Prevent material AI systems from entering an operational state without required governance approval. Relationship: INTEGRATED / CRITICAL Inputs may include:
  • classification;
  • risk;
  • controls;
  • testing;
  • documentation;
  • security;
  • rights assessment;
  • applicable regulatory requirements.

​
31. ISO42001-CTRL-AI-005

Name: AI System Change Governance Objective: Ensure AI-system changes are assessed, authorized, tested, documented, and monitored. Relationship: DIRECT / CRITICAL Evidence:
  • change record;
  • impact assessment;
  • testing;
  • approval;
  • implementation;
  • verification.

​
32. ISO42001-CTRL-AI-006

Name: AI System Retirement Governance Objective: Ensure AI systems are retired in a controlled manner. Relationship: DIRECT Activities:
  • retirement approval;
  • shutdown;
  • evidence retention;
  • incident closure;
  • registration review;
  • lessons learned.

​
33. ISO42001-CTRL-TPG-001

Name: Externally Provided AI Process Governance Objective: Control externally provided products, services, processes, and AI capabilities that affect the AIMS. Relationship: DIRECT Evidence:
  • supplier assessment;
  • contract;
  • requirements;
  • monitoring;
  • supplier incidents;
  • supplier changes.

​
34. ISO42001-CTRL-TPG-002

Name: AI Supplier Due Diligence Objective: Assess third parties according to risk and applicable requirements. Relationship: SUPPORTING

​
35. ISO42001-CTRL-OPS-002

Name: AI Operational Evidence Objective: Ensure material operational activities generate reliable records. Relationship: DIRECT / SUPPORTING Evidence:
  • execution records;
  • approvals;
  • monitoring;
  • incident records;
  • changes;
  • system logs.

​
36. Clause 9 — Performance Evaluation Controls

​
ISO42001-CTRL-MON-001

Name: AIMS Monitoring and Measurement Objective: Establish monitoring and measurement of AIMS performance. Relationship: DIRECT / CRITICAL Activities:
  • define indicators;
  • collect data;
  • analyze results;
  • evaluate performance;
  • report;
  • escalate.

​
37. ISO42001-CTRL-MON-002

Name: AI Performance Monitoring Objective: Monitor material AI-system performance in accordance with risk and system context. Relationship: DIRECT / CONDITIONAL Potential indicators:
  • accuracy;
  • robustness;
  • reliability;
  • availability;
  • security;
  • fairness;
  • human oversight;
  • incident rates.

​
38. ISO42001-CTRL-MON-003

Name: AIMS Monitoring Data Quality Objective: Ensure monitoring data is sufficiently reliable for management decisions. Relationship: SUPPORTING

​
39. ISO42001-CTRL-AUD-001

Name: AIMS Internal Audit Programme Objective: Establish and maintain a risk-based internal-audit programme. Relationship: DIRECT / CRITICAL Activities:
  • audit planning;
  • scope;
  • criteria;
  • auditor assignment;
  • evidence;
  • findings;
  • reporting;
  • follow-up.

​
40. ISO42001-CTRL-AUD-002

Name: Internal-Auditor Independence and Competence Objective: Ensure internal audits are performed by appropriately competent and sufficiently independent personnel. Relationship: DIRECT

​
41. ISO42001-CTRL-AUD-003

Name: Audit Finding Follow-Up Objective: Ensure audit findings are tracked through corrective action and verified closure. Relationship: DIRECT

​
42. ISO42001-CTRL-MREV-001

Name: AIMS Management Review Objective: Ensure management periodically reviews the AIMS for continuing suitability, adequacy, effectiveness, and improvement. Relationship: DIRECT / CRITICAL Inputs may include:
  • objectives;
  • monitoring;
  • audits;
  • nonconformities;
  • corrective actions;
  • risks;
  • changes;
  • stakeholder issues;
  • resource needs.
Outputs may include:
  • decisions;
  • improvements;
  • resource actions;
  • changes;
  • priorities.

​
43. ISO42001-CTRL-MREV-002

Name: Management Review Action Tracking Objective: Track management-review decisions to verified completion. Relationship: DIRECT

​
44. Clause 10 — Improvement Controls

​
ISO42001-CTRL-INC-001

Name: AIMS Nonconformity Management Objective: Identify, control, correct, and evaluate nonconformities. Relationship: DIRECT Activities:
  • detection;
  • classification;
  • correction;
  • investigation;
  • action;
  • verification.

​
45. ISO42001-CTRL-IMP-001

Name: Corrective Action Management Objective: Address causes of nonconformity and verify effectiveness. Relationship: DIRECT / CRITICAL Evidence:
  • root-cause analysis;
  • corrective action;
  • owner;
  • due date;
  • evidence;
  • verification.

​
46. ISO42001-CTRL-IMP-002

Name: Continual Improvement Objective: Continually improve the suitability, adequacy, and effectiveness of the AIMS. Relationship: DIRECT / CRITICAL Inputs:
  • monitoring;
  • internal audit;
  • incidents;
  • risk;
  • management review;
  • changes;
  • lessons learned.

​
47. ISO42001-CTRL-IMP-003

Name: Improvement Effectiveness Verification Objective: Determine whether implemented improvements achieve their intended result. Relationship: SUPPORTING / CRITICAL

​
48. Cross-Cutting Evidence Controls

​
ISO42001-CTRL-EVD-001

Name: AIMS Evidence Management Objective: Ensure evidence is attributable, current, relevant, traceable, protected, and retrievable. Relationship: SUPPORTING / CROSS-CUTTING

​
49. ISO42001-CTRL-EVD-002

Name: Evidence Traceability Objective: Maintain relationships among:
Relationship: SUPPORTING / CRITICAL

​
50. ISO42001-CTRL-EVD-003

Name: Evidence Retention Objective: Retain documented information and records according to applicable requirements and organizational policy. Relationship: SUPPORTING Retention periods should be defined by applicable requirements rather than by a universal AIGO period.

​
51. ISO42001-CTRL-EVD-004

Name: Evidence Version Governance Objective: Preserve the relationship between evidence and the AI-system, control, and AIGO-framework versions to which it relates. Relationship: SUPPORTING

​
52. Cross-Cutting Assurance Controls

​
ISO42001-CTRL-ASSR-001

Name: AIMS Governance Assurance Objective: Provide objective assurance over selected AIMS controls, processes, and evidence. Relationship: SUPPORTING / CROSS-CUTTING

​
53. ISO42001-CTRL-ASSR-002

Name: Control Effectiveness Assurance Objective: Assess whether selected controls are appropriately designed, implemented, and operating effectively. Relationship: SUPPORTING / CRITICAL

​
54. ISO42001-CTRL-ASSR-003

Name: Evidence Quality Assurance Objective: Evaluate authenticity, integrity, completeness, currency, and traceability of selected evidence. Relationship: SUPPORTING

​
55. ISO42001-CTRL-ASSR-004

Name: Certification Readiness Assurance Objective: Evaluate readiness for an external ISO/IEC 42001 assessment without representing the activity as certification. Relationship: SUPPORTING / CONDITIONAL Relevant external certification-body requirements are separately addressed by ISO/IEC 42006:2025. ISO currently lists ISO/IEC 42006:2025 as the standard specifying requirements for bodies auditing and certifying AIMS against ISO/IEC 42001. (iso.org)

​
56. Cross-Cutting Change Controls

​
ISO42001-CTRL-CHG-002

Name: Regulatory and Standards Change Assessment Objective: Evaluate changes to applicable standards, regulations, guidance, and organizational requirements. Relationship: SUPPORTING / CROSS-CUTTING Activities:
  • source monitoring;
  • impact analysis;
  • mapping review;
  • control impact;
  • evidence impact;
  • assurance impact;
  • management review.

​
57. ISO42001-CTRL-CHG-003

Name: Framework Control Change Management Objective: Ensure AIGO control changes are assessed for impact across all mappings that use the control. Relationship: INTEGRATED / CRITICAL Example:

​
58. Regulatory Integration Controls

​
ISO42001-CTRL-GOV-003

Name: Cross-Framework Regulatory Mapping Objective: Maintain relationships between ISO/IEC 42001 and applicable laws, regulations, contracts, and organizational requirements. Relationship: SUPPORTING Potential mappings include:
  • EU AI Act;
  • other AI regulations;
  • privacy requirements;
  • security requirements;
  • contractual obligations.

​
59. ISO42001-CTRL-GOV-004

Name: Legal and Standards Source Currency Objective: Ensure the AIMS uses current authoritative sources. Relationship: SUPPORTING / CRITICAL The AIGO framework should distinguish:
from:
from:

​
60. AIMS Scope-to-Control Relationship

The following chain should be maintained:
Controls outside scope should not automatically be treated as required.

​
61. AIMS Context-to-Control Relationship

​
62. Risk-to-Control Relationship

​
63. Objective-to-Control Relationship

​
64. Lifecycle-to-Control Relationship

​
65. Annex A Mapping Architecture

Annex A controls should be mapped through:
Where an Annex A control requires multiple AIGO mechanisms, the mapping should state: INTEGRATED rather than forcing a false one-to-one relationship.

​
66. Control Applicability

Every mapped control should support:
Where the organization determines non-applicability, the rationale should be recorded in the relevant management-system documentation.

​
67. Control Priority

AIGO may classify control priority as:
Priority should reflect:
  • risk;
  • impact;
  • organizational importance;
  • legal relevance;
  • safety;
  • rights;
  • regulatory exposure.
Priority is not the same as ISO control applicability.

​
68. Critical Controls

Controls that will frequently warrant critical treatment include:
Actual criticality should be adjusted according to organizational context.

​
69. Control Ownership

Each control should have:
The same person may occupy multiple roles where appropriate, subject to independence requirements for assurance.

​
70. Control Frequency

Possible operating frequencies:
Frequency should be defined by:
  • ISO requirements;
  • risk;
  • system criticality;
  • operational needs.

​
71. Control Evidence

Every material control should specify evidence. Example:

​
72. Control Monitoring

Each critical or high-priority control should have monitoring indicators where appropriate. Example:

​
73. Control Assurance

The preferred assurance chain is:

​
74. Control Failure

Control failure should generate an AIGO finding or other appropriate governance record. Example:

​
75. Exceptions

Control exceptions should record:
  • control;
  • requirement;
  • reason;
  • risk;
  • compensating control;
  • approval;
  • expiry;
  • review.
An AIGO exception cannot remove a mandatory ISO requirement from the authoritative standard.

​
76. Control Dependency

Important dependencies include:
Control dependencies should be represented in machine-readable relationships where practical.

​
77. Cross-Framework Reuse

The AIGO Control Schema is intended to support reusable controls. For example:
Each mapping relationship should remain independently traceable.

​
78. Shared-Control Rule

A shared control is not automatically identical across standards. Where the same AIGO control supports different frameworks, the registry should preserve separate mappings. Example:

​
79. Evidence Reuse

Evidence may support multiple framework requirements where:
  • it is within scope;
  • it is current;
  • the evidence addresses the relevant criteria;
  • the relationship is documented.

​
80. Assurance Reuse

An assurance activity may address multiple frameworks when:
  • criteria are separately defined;
  • reviewer competence is sufficient;
  • scope is sufficient;
  • conclusions are not conflated.

​
81. Management-System Evidence Pack

AIMS evidence should be capable of assembling:

​
82. Certification-Readiness Evidence Pack

A certification-readiness package may additionally contain:
The package remains an internal readiness artifact.

​
83. Control Validation

The Schema Validator should verify:
  • control ID;
  • required fields;
  • enum values;
  • evidence relationships;
  • owner fields.

​
84. Reference Validation

The Reference Validator should verify:
  • ISO mapping document references;
  • AIGO control IDs;
  • schema references;
  • template references;
  • related mapping packages.

​
85. Traceability Validation

The Traceability Validator should confirm:
Where a required step is absent, a finding should be raised.

​
86. Control Coverage

The Control Coverage Validator should identify:
  • applicable ISO requirements;
  • mapped AIGO controls;
  • critical gaps;
  • unowned controls;
  • unimplemented controls.

​
87. Evidence Coverage

The Evidence Coverage Validator should determine:
  • required evidence;
  • evidence availability;
  • current status;
  • stale evidence;
  • evidence gaps.

​
88. Framework Consistency

The Framework Consistency Checker should detect:
  • duplicate control IDs;
  • inconsistent control names;
  • conflicting owners;
  • contradictory applicability;
  • inconsistent mapping relationships;
  • stale standard references.

​
89. Document Integrity

The Document Integrity Checker should verify:
  • expected files;
  • version;
  • document metadata;
  • structure;
  • links;
  • cross-references.

​
90. Repository Health

Repository Health should evaluate:

​
91. Control Mapping Findings

Potential findings:

​
92. Critical Control Findings

Potential critical findings include:
  • material ISO requirement has no mapped control;
  • critical control lacks ownership;
  • critical control is not implemented;
  • critical control cannot produce evidence;
  • management review control is ineffective;
  • internal-audit control is absent;
  • continual-improvement control is ineffective.

​
93. Control Effectiveness Model

AIGO should distinguish:
An implemented control is not automatically effective.

​
94. Control Maturity

An internal maturity model may use:
This is an AIGO maturity model and is not an ISO/IEC 42001 scoring model.

​
95. Control Review

Controls should be reviewed:
  • annually;
  • after significant changes;
  • after audit findings;
  • after incidents;
  • after standard updates;
  • after major AIGO framework changes.

​
96. Standard Currency

The mapping should identify: ISO/IEC 42001:2023 as the exact standard baseline. ISO currently lists the standard as published and in its first edition.

​
97. Related Standards

The mapping should identify related standards separately. ISO/IEC 42005:2025 addresses AI system impact assessment, while ISO/IEC 42006:2025 addresses requirements for bodies auditing and certifying AIMS. ISO/IEC AWI 42003 is currently under development as implementation guidance for ISO/IEC 42001. These standards should not be silently added to the ISO/IEC 42001 requirement baseline.

​
98. Certification Boundary

The AIGO control mapping supports organizational implementation and readiness. It does not create:
  • accreditation;
  • certification;
  • external conformity;
  • certification-body authority.
ISO/IEC 42006:2025 governs the relevant certification-body requirements.

​
99. Implementation Boundary

Control definitions identify what should be governed. Detailed operating procedures should remain within: 08-AIGO-ISO-42001-Implementation-Mapping-v0.1.md and relevant AIGO procedures/templates.

​
100. Evidence Boundary

Detailed evidence relationships remain in: 07-AIGO-ISO-42001-Evidence-Mapping-v0.1.md This control mapping should identify evidence categories without duplicating the complete evidence architecture.

​
101. Assurance Boundary

Detailed assurance relationships remain in: 09-AIGO-ISO-42001-Assurance-Mapping-v0.1.md Controls should identify the assurance relationship without duplicating the assurance methodology.

​
102. Registry Boundary

Machine-readable relationships should be held in: 00-AIGO-ISO-42001-Mapping-Registry-v0.1.json The registry should remain synchronized with this control mapping.

​
103. Management-System Crosswalk

​
104. Master Control Relationships

The core controls are:
These are AIGO mapping identifiers and should resolve through the control architecture and registry.

​
105. Control-to-Schema Crosswalk

​
106. Control-to-Template Crosswalk

​
107. Control and Cross-Framework Mappings

The AIGO control architecture should allow the ISO controls to be reused for other mapping packages. Example:
The relationship should be recorded independently for each framework.

​
108. Control Conflict Management

If different standards impose different requirements on the same operational area, AIGO should preserve separate relationships. Example:
The control can be strengthened to support both, but the mapping must not imply that one framework has replaced the other.

​
109. Evidence Reuse

A single evidence record can support several controls where its:
  • scope;
  • date;
  • system version;
  • purpose;
  • quality;
are sufficient for each mapped relationship.

​
110. Assurance Reuse

A single assurance activity may support multiple controls where its scope and criteria cover them. Each relationship must remain explicit.

​
111. Control Change Impact

A change to a shared AIGO control should trigger mapping-impact analysis.

​
112. Control Retirement

A control may be retired only when:
  • its mappings are superseded;
  • dependencies are resolved;
  • historical records are preserved;
  • replacement controls exist where needed.

​
113. Control History

Historical control definitions should preserve:
  • control ID;
  • version;
  • status;
  • owner;
  • effective date;
  • supersession reason.

​
114. Release Validation

Before this control mapping is marked validated:

​
115. Repository Health Validation

The ISO mapping package should pass:
  • structural validation;
  • reference validation;
  • traceability validation;
  • control coverage validation;
  • evidence coverage validation;
  • framework consistency;
  • document integrity;
  • repository health.

​
116. Limitations

This mapping cannot independently establish:
  • conformity to ISO/IEC 42001;
  • certification readiness without complete implementation evidence;
  • certification-body acceptance;
  • adequacy of individual controls in a specific organization;
  • adequacy of an organization’s AIMS scope;
  • legal compliance under other frameworks.
The organization’s actual context, scope, controls, evidence, and assurance results determine implementation outcomes.

​
117. Final Control Architecture

The complete AIGO ISO/IEC 42001 control relationship is:
This architecture supports ISO/IEC 42001 implementation while preserving a reusable AIGO control system that can also serve the EU AI Act and other governance frameworks.

​
118. Document Control

​
119. Document Status

Document: AIGO — ISO/IEC 42001 AIGO Control Mapping Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-MAP-ISO42001-010 Document Type: ISO Management-System Mapping This document establishes the detailed ISO/IEC 42001-to-AIGO control crosswalk, connecting management-system requirements and Annex A control relationships to AIGO governance, lifecycle, risk, evidence, monitoring, assurance, management review, corrective action, and continual improvement. End of Document