> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aigoframework.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 10 AIGO ISO 42001 AIGO Control Mapping v0.1

# AIGO — ISO/IEC 42001 AIGO Control Mapping

## 1. Document Purpose

This document establishes the detailed requirement-to-control crosswalk between ISO/IEC 42001:2023 and the AIGO AI Governance Operating Framework.

ISO/IEC 42001:2023 is an International Standard specifying requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). ISO currently lists the standard as published, first edition, December 2023.

This mapping translates the ISO/IEC 42001 management-system requirements into reusable AIGO controls while preserving the distinction between:

* ISO/IEC 42001 requirements;
* AIGO governance objectives;
* AIGO controls;
* implementation procedures;
* evidence;
* assurance; and
* external certification.

This document does not reproduce ISO/IEC 42001 and does not constitute ISO certification or a certification-body audit.

***

# 2. Mapping Information

| Field               | Value                                          |
| ------------------- | ---------------------------------------------- |
| Mapping             | AIGO ISO/IEC 42001 AIGO Control Mapping        |
| Version             | 0.1                                            |
| Status              | Draft                                          |
| Document Identifier | `AIGO-MAP-ISO42001-010`                        |
| Document Type       | ISO Management-System Mapping                  |
| Mapping Package     | `AIGO-MAP-ISO42001`                            |
| Primary Standard    | ISO/IEC 42001:2023                             |
| Standard Edition    | First edition                                  |
| Primary Function    | Requirement-to-AIGO-control crosswalk          |
| Architecture        | `AIGO-MAP-ISO42001-ARCH-001`                   |
| Registry            | `00-AIGO-ISO-42001-Mapping-Registry-v0.1.json` |

ISO currently lists ISO/IEC 42001:2023 as published and applicable to organizations providing or using AI-based products or services.

***

# 3. Control-Mapping Principle

The control architecture is:

```text theme={null}
ISO/IEC 42001
      ↓
Clause / Annex A Reference
      ↓
AIGO Governance Objective
      ↓
AIGO Control
      ↓
AIGO Process
      ↓
AIGO Evidence
      ↓
Monitoring
      ↓
Assurance
      ↓
Improvement
```

AIGO controls are implementation mechanisms. They do not change the normative meaning of ISO/IEC 42001.

***

# 4. Control Relationship Types

The registry should use:

```text theme={null}
DIRECT
PARTIAL
SUPPORTING
INTEGRATED
CONDITIONAL
CROSS_REFERENCE
DERIVED
NO_DIRECT_EQUIVALENT
```

## DIRECT

The AIGO control directly addresses the mapped ISO requirement.

## PARTIAL

The control addresses only part of the requirement.

## SUPPORTING

The control supports implementation but does not cover the entire requirement.

## INTEGRATED

Multiple AIGO controls collectively implement the requirement.

## CONDITIONAL

The control applies only under defined scope or organizational conditions.

## CROSS\_REFERENCE

An existing AIGO control or artifact is authoritative and is referenced rather than duplicated.

## NO\_DIRECT\_EQUIVALENT

The requirement must be addressed through an organizational or external mechanism not represented by a dedicated AIGO control.

***

# 5. Control Status Model

AIGO controls should distinguish:

```text theme={null}
MAPPED
DEFINED
IMPLEMENTED
PARTIALLY_IMPLEMENTED
EVIDENCED
ASSESSED
MONITORED
ASSURED
SUPERSEDED
RETIRED
```

Control status is an AIGO implementation status and is not an ISO certification status.

***

# 6. Control Identifier Model

The ISO mapping should reference stable AIGO control identifiers.

Recommended regulatory-mapping relationship identifiers:

```text theme={null}
ISO42001-CTRL-<DOMAIN>-<SEQUENCE>
```

Examples:

```text theme={null}
ISO42001-CTRL-GOV-001
ISO42001-CTRL-RISK-001
ISO42001-CTRL-AI-001
ISO42001-CTRL-EVD-001
ISO42001-CTRL-ASSR-001
```

The actual underlying AIGO Control Schema identifier remains authoritative.

***

# 7. Control Domains

The initial domain structure is:

```text theme={null}
CTX   Context
GOV   Governance
POL   Policy
ROL   Roles / Responsibilities
RSK   Risk / Opportunity
OBJ   Objectives
RES   Resources
COM   Competence / Awareness / Communication
DOC   Documented Information
OPS   Operations
AI    AI Lifecycle
TPG   Third-Party Governance
MON   Monitoring / Measurement
AUD   Internal Audit
MREV  Management Review
INC   Incident / Nonconformity
CHG   Change Management
IMP   Improvement
EVD   Evidence
ASSR  Assurance
RET   Retirement
```

***

# 8. Clause 4 — Context Controls

## `ISO42001-CTRL-CTX-001`

**Name:** AIMS Context Determination

**Objective:** Establish and maintain the internal and external context relevant to the AIMS.

**Relationship:** `DIRECT`

**AIGO Components:**

* Governance;
* AI System;
* Risk;
* Assessment;
* Management Review.

**Activities:**

* identify internal issues;
* identify external issues;
* identify AI-related organizational factors;
* assess regulatory context;
* review technological context;
* document significant context changes.

**Evidence:**

* context analysis;
* governance record;
* management-review record;
* change assessment.

***

# 9. `ISO42001-CTRL-CTX-002`

**Name:** Interested-Party Determination

**Objective:** Identify interested parties and relevant requirements affecting the AIMS.

**Relationship:** `DIRECT`

**Activities:**

* stakeholder identification;
* requirement identification;
* expectation analysis;
* regulatory mapping;
* review.

**Evidence:**

* interested-party register;
* requirements mapping;
* review record.

***

# 10. `ISO42001-CTRL-CTX-003`

**Name:** AIMS Scope Governance

**Objective:** Define and maintain the scope of the AIMS.

**Relationship:** `DIRECT / CRITICAL`

**Activities:**

* define organizational boundaries;
* identify AI activities;
* identify products/services;
* identify locations;
* identify interfaces;
* document exclusions where appropriate;
* approve scope;
* review after material change.

**Evidence:**

* AIMS scope statement;
* governance approval;
* change review.

***

# 11. Clause 5 — Leadership Controls

## `ISO42001-CTRL-GOV-001`

**Name:** AIMS Leadership Governance

**Objective:** Establish leadership accountability for the AIMS.

**Relationship:** `DIRECT`

**Activities:**

* assign accountability;
* establish governance;
* allocate resources;
* approve policy;
* review performance;
* support continual improvement.

**Evidence:**

* governance decisions;
* approved policy;
* management review;
* resource decisions.

***

# 12. `ISO42001-CTRL-GOV-002`

**Name:** AI Governance Policy

**Objective:** Establish and maintain the organization's AI policy and its alignment with the AIMS.

**Relationship:** `DIRECT`

**Activities:**

* policy creation;
* approval;
* communication;
* review;
* update.

**Evidence:**

* approved policy;
* version history;
* communication evidence.

***

# 13. `ISO42001-CTRL-ROL-001`

**Name:** AI Governance Roles and Authorities

**Objective:** Define responsibilities and authorities for relevant AIMS activities.

**Relationship:** `DIRECT`

**Roles may include:**

* AI Governance Owner;
* AI System Owner;
* Risk Owner;
* Control Owner;
* Evidence Owner;
* Assurance Owner;
* Management Review authority.

**Evidence:**

* role matrix;
* assignments;
* delegation records.

***

# 14. `ISO42001-CTRL-ROL-002`

**Name:** AI Accountability Assignment

**Objective:** Ensure accountable ownership exists for material AI governance outcomes.

**Relationship:** `DIRECT / CRITICAL`

AIGO should distinguish accountability from the operational performance of individual tasks.

***

# 15. Clause 6 — Planning Controls

## `ISO42001-CTRL-RSK-001`

**Name:** AIMS Risks and Opportunities

**Objective:** Identify and address risks and opportunities relevant to the AIMS.

**Relationship:** `DIRECT`

**Activities:**

* risk identification;
* risk assessment;
* opportunity identification;
* treatment;
* monitoring;
* review.

**Evidence:**

* Risk Schema records;
* assessments;
* treatment plans;
* residual-risk decisions.

***

# 16. `ISO42001-CTRL-RSK-002`

**Name:** AI System Risk Integration

**Objective:** Connect AI-system risks with AIMS-level risk and opportunity management.

**Relationship:** `INTEGRATED`

**Architecture:**

```text theme={null}
AI System
   ↓
AI Risk
   ↓
AIMS Risk
   ↓
Control
   ↓
Monitoring
```

This avoids creating separate, disconnected risk systems.

***

# 17. `ISO42001-CTRL-OBJ-001`

**Name:** AIMS Objectives Governance

**Objective:** Define, monitor, and review AIMS objectives.

**Relationship:** `DIRECT`

**Activities:**

* objective definition;
* ownership;
* measures;
* targets where appropriate;
* monitoring;
* review;
* improvement.

***

# 18. `ISO42001-CTRL-OBJ-002`

**Name:** AIMS Objective Performance Monitoring

**Objective:** Measure progress against AIMS objectives.

**Relationship:** `DIRECT`

**Evidence:**

* KPI/indicator records;
* monitoring results;
* management review;
* corrective actions.

***

# 19. `ISO42001-CTRL-CHG-001`

**Name:** AIMS Change Planning

**Objective:** Ensure material changes to the AIMS are planned and controlled.

**Relationship:** `DIRECT`

**Triggers:**

* organizational change;
* new AI systems;
* major AI-system change;
* regulatory change;
* outsourcing;
* technology change.

***

# 20. Clause 7 — Support Controls

## `ISO42001-CTRL-RES-001`

**Name:** AIMS Resource Management

**Objective:** Ensure adequate resources are available for effective AIMS operation.

**Relationship:** `DIRECT`

**Resources may include:**

* people;
* technology;
* infrastructure;
* assurance;
* training;
* monitoring;
* financial resources.

***

# 21. `ISO42001-CTRL-COM-001`

**Name:** AI Competence Management

**Objective:** Establish competence requirements and maintain evidence that relevant personnel are appropriately competent.

**Relationship:** `DIRECT`

**Activities:**

* role analysis;
* competence requirements;
* training;
* experience;
* qualifications;
* assessment;
* reassessment.

***

# 22. `ISO42001-CTRL-COM-002`

**Name:** AI Awareness Management

**Objective:** Establish awareness of relevant AI policy, responsibilities, risks, controls, and consequences.

**Relationship:** `DIRECT`

***

# 23. `ISO42001-CTRL-COM-003`

**Name:** AI Governance Communication

**Objective:** Control relevant internal and external communication relating to the AIMS.

**Relationship:** `DIRECT`

**Evidence:**

* communication plans;
* notices;
* reports;
* regulatory correspondence.

***

# 24. `ISO42001-CTRL-DOC-001`

**Name:** AIMS Documented Information Control

**Objective:** Control the creation, approval, modification, access, distribution, storage, retention, and disposition of documented information.

**Relationship:** `DIRECT / CRITICAL`

**Evidence:**

* controlled documents;
* approvals;
* versions;
* access records;
* retention records.

***

# 25. `ISO42001-CTRL-DOC-002`

**Name:** AIMS Document Integrity

**Objective:** Protect documented information against unauthorized modification and loss of integrity.

**Relationship:** `SUPPORTING`

This control should integrate with the AIGO Document Integrity Checker.

***

# 26. Clause 8 — Operation Controls

## `ISO42001-CTRL-OPS-001`

**Name:** AI Operational Planning and Control

**Objective:** Ensure AI-related operational processes are planned, implemented, and controlled.

**Relationship:** `DIRECT / CRITICAL`

**Activities:**

* operational planning;
* lifecycle governance;
* control execution;
* evidence generation;
* monitoring;
* change management.

***

# 27. `ISO42001-CTRL-AI-001`

**Name:** AI Lifecycle Governance

**Objective:** Govern AI systems throughout their lifecycle.

**Relationship:** `DIRECT / INTEGRATED`

**Lifecycle:**

```text theme={null}
Planning
 ↓
Design
 ↓
Development / Acquisition
 ↓
Validation
 ↓
Approval
 ↓
Deployment
 ↓
Operation
 ↓
Monitoring
 ↓
Change
 ↓
Retirement
```

The AIGO AI System, Risk, Control, Assessment, Approval, Monitoring, Change, Incident, Assurance, and Retirement schemas collectively support this control.

***

# 28. `ISO42001-CTRL-AI-002`

**Name:** AI System Registration

**Objective:** Maintain a controlled inventory of AI systems within the AIMS scope.

**Relationship:** `DIRECT`

**Evidence:**

* AI System Registration;
* system identifier;
* owner;
* status;
* lifecycle state;
* scope.

***

# 29. `ISO42001-CTRL-AI-003`

**Name:** AI System Purpose and Context Governance

**Objective:** Ensure intended purpose, users, deployment context, and relevant limitations are defined.

**Relationship:** `DIRECT`

**Evidence:**

* AI System Profile;
* intended-purpose statement;
* use context;
* affected-person analysis.

***

# 30. `ISO42001-CTRL-AI-004`

**Name:** AI System Approval Gate

**Objective:** Prevent material AI systems from entering an operational state without required governance approval.

**Relationship:** `INTEGRATED / CRITICAL`

**Inputs may include:**

* classification;
* risk;
* controls;
* testing;
* documentation;
* security;
* rights assessment;
* applicable regulatory requirements.

***

# 31. `ISO42001-CTRL-AI-005`

**Name:** AI System Change Governance

**Objective:** Ensure AI-system changes are assessed, authorized, tested, documented, and monitored.

**Relationship:** `DIRECT / CRITICAL`

**Evidence:**

* change record;
* impact assessment;
* testing;
* approval;
* implementation;
* verification.

***

# 32. `ISO42001-CTRL-AI-006`

**Name:** AI System Retirement Governance

**Objective:** Ensure AI systems are retired in a controlled manner.

**Relationship:** `DIRECT`

**Activities:**

* retirement approval;
* shutdown;
* evidence retention;
* incident closure;
* registration review;
* lessons learned.

***

# 33. `ISO42001-CTRL-TPG-001`

**Name:** Externally Provided AI Process Governance

**Objective:** Control externally provided products, services, processes, and AI capabilities that affect the AIMS.

**Relationship:** `DIRECT`

**Evidence:**

* supplier assessment;
* contract;
* requirements;
* monitoring;
* supplier incidents;
* supplier changes.

***

# 34. `ISO42001-CTRL-TPG-002`

**Name:** AI Supplier Due Diligence

**Objective:** Assess third parties according to risk and applicable requirements.

**Relationship:** `SUPPORTING`

***

# 35. `ISO42001-CTRL-OPS-002`

**Name:** AI Operational Evidence

**Objective:** Ensure material operational activities generate reliable records.

**Relationship:** `DIRECT / SUPPORTING`

**Evidence:**

* execution records;
* approvals;
* monitoring;
* incident records;
* changes;
* system logs.

***

# 36. Clause 9 — Performance Evaluation Controls

## `ISO42001-CTRL-MON-001`

**Name:** AIMS Monitoring and Measurement

**Objective:** Establish monitoring and measurement of AIMS performance.

**Relationship:** `DIRECT / CRITICAL`

**Activities:**

* define indicators;
* collect data;
* analyze results;
* evaluate performance;
* report;
* escalate.

***

# 37. `ISO42001-CTRL-MON-002`

**Name:** AI Performance Monitoring

**Objective:** Monitor material AI-system performance in accordance with risk and system context.

**Relationship:** `DIRECT / CONDITIONAL`

Potential indicators:

* accuracy;
* robustness;
* reliability;
* availability;
* security;
* fairness;
* human oversight;
* incident rates.

***

# 38. `ISO42001-CTRL-MON-003`

**Name:** AIMS Monitoring Data Quality

**Objective:** Ensure monitoring data is sufficiently reliable for management decisions.

**Relationship:** `SUPPORTING`

***

# 39. `ISO42001-CTRL-AUD-001`

**Name:** AIMS Internal Audit Programme

**Objective:** Establish and maintain a risk-based internal-audit programme.

**Relationship:** `DIRECT / CRITICAL`

**Activities:**

* audit planning;
* scope;
* criteria;
* auditor assignment;
* evidence;
* findings;
* reporting;
* follow-up.

***

# 40. `ISO42001-CTRL-AUD-002`

**Name:** Internal-Auditor Independence and Competence

**Objective:** Ensure internal audits are performed by appropriately competent and sufficiently independent personnel.

**Relationship:** `DIRECT`

***

# 41. `ISO42001-CTRL-AUD-003`

**Name:** Audit Finding Follow-Up

**Objective:** Ensure audit findings are tracked through corrective action and verified closure.

**Relationship:** `DIRECT`

***

# 42. `ISO42001-CTRL-MREV-001`

**Name:** AIMS Management Review

**Objective:** Ensure management periodically reviews the AIMS for continuing suitability, adequacy, effectiveness, and improvement.

**Relationship:** `DIRECT / CRITICAL`

**Inputs may include:**

* objectives;
* monitoring;
* audits;
* nonconformities;
* corrective actions;
* risks;
* changes;
* stakeholder issues;
* resource needs.

**Outputs may include:**

* decisions;
* improvements;
* resource actions;
* changes;
* priorities.

***

# 43. `ISO42001-CTRL-MREV-002`

**Name:** Management Review Action Tracking

**Objective:** Track management-review decisions to verified completion.

**Relationship:** `DIRECT`

***

# 44. Clause 10 — Improvement Controls

## `ISO42001-CTRL-INC-001`

**Name:** AIMS Nonconformity Management

**Objective:** Identify, control, correct, and evaluate nonconformities.

**Relationship:** `DIRECT`

**Activities:**

* detection;
* classification;
* correction;
* investigation;
* action;
* verification.

***

# 45. `ISO42001-CTRL-IMP-001`

**Name:** Corrective Action Management

**Objective:** Address causes of nonconformity and verify effectiveness.

**Relationship:** `DIRECT / CRITICAL`

**Evidence:**

* root-cause analysis;
* corrective action;
* owner;
* due date;
* evidence;
* verification.

***

# 46. `ISO42001-CTRL-IMP-002`

**Name:** Continual Improvement

**Objective:** Continually improve the suitability, adequacy, and effectiveness of the AIMS.

**Relationship:** `DIRECT / CRITICAL`

**Inputs:**

* monitoring;
* internal audit;
* incidents;
* risk;
* management review;
* changes;
* lessons learned.

***

# 47. `ISO42001-CTRL-IMP-003`

**Name:** Improvement Effectiveness Verification

**Objective:** Determine whether implemented improvements achieve their intended result.

**Relationship:** `SUPPORTING / CRITICAL`

***

# 48. Cross-Cutting Evidence Controls

## `ISO42001-CTRL-EVD-001`

**Name:** AIMS Evidence Management

**Objective:** Ensure evidence is attributable, current, relevant, traceable, protected, and retrievable.

**Relationship:** `SUPPORTING / CROSS-CUTTING`

***

# 49. `ISO42001-CTRL-EVD-002`

**Name:** Evidence Traceability

**Objective:** Maintain relationships among:

```text theme={null}
ISO Requirement
 ↓
AIGO Control
 ↓
Activity
 ↓
Evidence
 ↓
Assurance
```

**Relationship:** `SUPPORTING / CRITICAL`

***

# 50. `ISO42001-CTRL-EVD-003`

**Name:** Evidence Retention

**Objective:** Retain documented information and records according to applicable requirements and organizational policy.

**Relationship:** `SUPPORTING`

Retention periods should be defined by applicable requirements rather than by a universal AIGO period.

***

# 51. `ISO42001-CTRL-EVD-004`

**Name:** Evidence Version Governance

**Objective:** Preserve the relationship between evidence and the AI-system, control, and AIGO-framework versions to which it relates.

**Relationship:** `SUPPORTING`

***

# 52. Cross-Cutting Assurance Controls

## `ISO42001-CTRL-ASSR-001`

**Name:** AIMS Governance Assurance

**Objective:** Provide objective assurance over selected AIMS controls, processes, and evidence.

**Relationship:** `SUPPORTING / CROSS-CUTTING`

***

# 53. `ISO42001-CTRL-ASSR-002`

**Name:** Control Effectiveness Assurance

**Objective:** Assess whether selected controls are appropriately designed, implemented, and operating effectively.

**Relationship:** `SUPPORTING / CRITICAL`

***

# 54. `ISO42001-CTRL-ASSR-003`

**Name:** Evidence Quality Assurance

**Objective:** Evaluate authenticity, integrity, completeness, currency, and traceability of selected evidence.

**Relationship:** `SUPPORTING`

***

# 55. `ISO42001-CTRL-ASSR-004`

**Name:** Certification Readiness Assurance

**Objective:** Evaluate readiness for an external ISO/IEC 42001 assessment without representing the activity as certification.

**Relationship:** `SUPPORTING / CONDITIONAL`

Relevant external certification-body requirements are separately addressed by ISO/IEC 42006:2025. ISO currently lists ISO/IEC 42006:2025 as the standard specifying requirements for bodies auditing and certifying AIMS against ISO/IEC 42001. ([iso.org](https://www.iso.org/standard/42006?browse=tc))

***

# 56. Cross-Cutting Change Controls

## `ISO42001-CTRL-CHG-002`

**Name:** Regulatory and Standards Change Assessment

**Objective:** Evaluate changes to applicable standards, regulations, guidance, and organizational requirements.

**Relationship:** `SUPPORTING / CROSS-CUTTING`

**Activities:**

* source monitoring;
* impact analysis;
* mapping review;
* control impact;
* evidence impact;
* assurance impact;
* management review.

***

# 57. `ISO42001-CTRL-CHG-003`

**Name:** Framework Control Change Management

**Objective:** Ensure AIGO control changes are assessed for impact across all mappings that use the control.

**Relationship:** `INTEGRATED / CRITICAL`

Example:

```text theme={null}
AIGO Control Change
      ↓
ISO/IEC 42001 Impact
      ↓
EU AI Act Impact
      ↓
Other Mapping Impact
      ↓
Evidence Impact
      ↓
Assurance Impact
```

***

# 58. Regulatory Integration Controls

## `ISO42001-CTRL-GOV-003`

**Name:** Cross-Framework Regulatory Mapping

**Objective:** Maintain relationships between ISO/IEC 42001 and applicable laws, regulations, contracts, and organizational requirements.

**Relationship:** `SUPPORTING`

Potential mappings include:

* EU AI Act;
* other AI regulations;
* privacy requirements;
* security requirements;
* contractual obligations.

***

# 59. `ISO42001-CTRL-GOV-004`

**Name:** Legal and Standards Source Currency

**Objective:** Ensure the AIMS uses current authoritative sources.

**Relationship:** `SUPPORTING / CRITICAL`

The AIGO framework should distinguish:

```text theme={null}
Binding Requirement
```

from:

```text theme={null}
Official Guidance
```

from:

```text theme={null}
Voluntary Standard / Practice
```

***

# 60. AIMS Scope-to-Control Relationship

The following chain should be maintained:

```text theme={null}
AIMS Scope
   ↓
Applicable Requirements
   ↓
Applicable AIGO Controls
   ↓
Evidence
   ↓
Assurance
```

Controls outside scope should not automatically be treated as required.

***

# 61. AIMS Context-to-Control Relationship

```text theme={null}
Organizational Context
       ↓
Interested Parties
       ↓
Requirements
       ↓
Risks / Opportunities
       ↓
Objectives
       ↓
Controls
```

***

# 62. Risk-to-Control Relationship

```text theme={null}
Risk
 ↓
Risk Treatment
 ↓
Control
 ↓
Evidence
 ↓
Monitoring
 ↓
Residual Risk
```

***

# 63. Objective-to-Control Relationship

```text theme={null}
AIMS Objective
 ↓
Measure
 ↓
Control / Process
 ↓
Evidence
 ↓
Performance Evaluation
 ↓
Management Review
```

***

# 64. Lifecycle-to-Control Relationship

| Lifecycle Stage | AIGO Control Domains                |
| --------------- | ----------------------------------- |
| Planning        | Context, Risk, Objectives           |
| Design          | Risk, AI Lifecycle, Controls        |
| Development     | AI Lifecycle, Data, Technical       |
| Acquisition     | Third-Party, Risk, Approval         |
| Testing         | Performance, Robustness, Assurance  |
| Approval        | Governance, Risk, Approval          |
| Deployment      | Approval, Documentation, Monitoring |
| Operation       | Operations, Monitoring, Incident    |
| Change          | Change, Risk, Documentation         |
| Assurance       | Audit, Assurance, Evidence          |
| Improvement     | Corrective Action, Improvement      |
| Retirement      | Retirement, Evidence                |

***

# 65. Annex A Mapping Architecture

Annex A controls should be mapped through:

```text theme={null}
ISO Annex A Control
       ↓
Applicability
       ↓
AIGO Control
       ↓
Evidence
       ↓
Assurance
```

Where an Annex A control requires multiple AIGO mechanisms, the mapping should state:

`INTEGRATED`

rather than forcing a false one-to-one relationship.

***

# 66. Control Applicability

Every mapped control should support:

```text theme={null}
APPLICABLE
CONDITIONAL
INTEGRATED
NOT_APPLICABLE
FUTURE
SUPERSEDED
```

Where the organization determines non-applicability, the rationale should be recorded in the relevant management-system documentation.

***

# 67. Control Priority

AIGO may classify control priority as:

```text theme={null}
CRITICAL
HIGH
MEDIUM
LOW
INFORMATIONAL
```

Priority should reflect:

* risk;
* impact;
* organizational importance;
* legal relevance;
* safety;
* rights;
* regulatory exposure.

Priority is not the same as ISO control applicability.

***

# 68. Critical Controls

Controls that will frequently warrant critical treatment include:

```text theme={null}
ISO42001-CTRL-CTX-003
ISO42001-CTRL-GOV-001
ISO42001-CTRL-ROL-002
ISO42001-CTRL-RSK-001
ISO42001-CTRL-OPS-001
ISO42001-CTRL-AI-005
ISO42001-CTRL-MON-001
ISO42001-CTRL-AUD-001
ISO42001-CTRL-MREV-001
ISO42001-CTRL-IMP-001
ISO42001-CTRL-IMP-002
ISO42001-CTRL-EVD-002
ISO42001-CTRL-ASSR-002
```

Actual criticality should be adjusted according to organizational context.

***

# 69. Control Ownership

Each control should have:

```text theme={null}
CONTROL_OWNER
ACCOUNTABLE_OWNER
OPERATIONAL_OWNER
EVIDENCE_OWNER
ASSURANCE_OWNER
```

The same person may occupy multiple roles where appropriate, subject to independence requirements for assurance.

***

# 70. Control Frequency

Possible operating frequencies:

```text theme={null}
CONTINUOUS
PER_SYSTEM
PER_TRANSACTION
PER_CHANGE
MONTHLY
QUARTERLY
SEMI_ANNUAL
ANNUAL
EVENT_DRIVEN
```

Frequency should be defined by:

* ISO requirements;
* risk;
* system criticality;
* operational needs.

***

# 71. Control Evidence

Every material control should specify evidence.

Example:

```text theme={null}
Control:
ISO42001-CTRL-RSK-001

Evidence:
- AIMS risk register
- AI risk assessments
- treatment decisions
- residual-risk review
- monitoring records
```

***

# 72. Control Monitoring

Each critical or high-priority control should have monitoring indicators where appropriate.

Example:

```text theme={null}
Control:
ISO42001-CTRL-AUD-001

Indicators:
- audit-plan completion
- overdue audits
- repeat findings
- corrective-action closure
```

***

# 73. Control Assurance

The preferred assurance chain is:

```text theme={null}
Control
 ↓
Evidence
 ↓
Test
 ↓
Finding
 ↓
Corrective Action
 ↓
Verification
```

***

# 74. Control Failure

Control failure should generate an AIGO finding or other appropriate governance record.

Example:

```text theme={null}
Control Failure
      ↓
Incident / Finding
      ↓
Risk
      ↓
Corrective Action
      ↓
Change
      ↓
Retest
```

***

# 75. Exceptions

Control exceptions should record:

* control;
* requirement;
* reason;
* risk;
* compensating control;
* approval;
* expiry;
* review.

An AIGO exception cannot remove a mandatory ISO requirement from the authoritative standard.

***

# 76. Control Dependency

Important dependencies include:

```text theme={null}
Context
 ↓
Risk
 ↓
Objectives
 ↓
Controls
 ↓
Evidence
 ↓
Monitoring
 ↓
Audit
 ↓
Management Review
 ↓
Improvement
```

Control dependencies should be represented in machine-readable relationships where practical.

***

# 77. Cross-Framework Reuse

The AIGO Control Schema is intended to support reusable controls.

For example:

```text theme={null}
AIGO Control
  ├── ISO/IEC 42001
  ├── EU AI Act
  ├── Organizational Policy
  └── Other Regulatory Framework
```

Each mapping relationship should remain independently traceable.

***

# 78. Shared-Control Rule

A shared control is not automatically identical across standards.

Where the same AIGO control supports different frameworks, the registry should preserve separate mappings.

Example:

```text theme={null}
AIGO-CTRL-CHANGE-001
   ├── ISO/IEC 42001 relationship
   └── EU AI Act relationship
```

***

# 79. Evidence Reuse

Evidence may support multiple framework requirements where:

* it is within scope;
* it is current;
* the evidence addresses the relevant criteria;
* the relationship is documented.

***

# 80. Assurance Reuse

An assurance activity may address multiple frameworks when:

* criteria are separately defined;
* reviewer competence is sufficient;
* scope is sufficient;
* conclusions are not conflated.

***

# 81. Management-System Evidence Pack

AIMS evidence should be capable of assembling:

```text theme={null}
AIMS Scope
Policy
Context
Interested Parties
Risks / Opportunities
Objectives
Controls
AI System Records
Competence
Documentation
Operational Evidence
Monitoring
Internal Audit
Management Review
Nonconformities
Corrective Actions
Improvement
```

***

# 82. Certification-Readiness Evidence Pack

A certification-readiness package may additionally contain:

```text theme={null}
AIMS Scope
Policy
Requirement Mapping
Risk / Opportunity Records
Annex A Applicability
Controls
Evidence
Internal Audit
Management Review
Corrective Actions
Continual Improvement
```

The package remains an internal readiness artifact.

***

# 83. Control Validation

The Schema Validator should verify:

* control ID;
* required fields;
* enum values;
* evidence relationships;
* owner fields.

***

# 84. Reference Validation

The Reference Validator should verify:

* ISO mapping document references;
* AIGO control IDs;
* schema references;
* template references;
* related mapping packages.

***

# 85. Traceability Validation

The Traceability Validator should confirm:

```text theme={null}
ISO Requirement
 ↓
AIGO Control
 ↓
Evidence
 ↓
Assurance
```

Where a required step is absent, a finding should be raised.

***

# 86. Control Coverage

The Control Coverage Validator should identify:

* applicable ISO requirements;
* mapped AIGO controls;
* critical gaps;
* unowned controls;
* unimplemented controls.

***

# 87. Evidence Coverage

The Evidence Coverage Validator should determine:

* required evidence;
* evidence availability;
* current status;
* stale evidence;
* evidence gaps.

***

# 88. Framework Consistency

The Framework Consistency Checker should detect:

* duplicate control IDs;
* inconsistent control names;
* conflicting owners;
* contradictory applicability;
* inconsistent mapping relationships;
* stale standard references.

***

# 89. Document Integrity

The Document Integrity Checker should verify:

* expected files;
* version;
* document metadata;
* structure;
* links;
* cross-references.

***

# 90. Repository Health

Repository Health should evaluate:

```text theme={null}
Mapping Completeness
+
Control Coverage
+
Evidence Coverage
+
Traceability
+
Assurance Coverage
+
Reference Integrity
```

***

# 91. Control Mapping Findings

Potential findings:

```text theme={null}
ISO_CONTROL_MAPPING_MISSING
ISO_CONTROL_ID_INVALID
ISO_CONTROL_OWNER_MISSING
ISO_CONTROL_APPLICABILITY_UNRESOLVED
ISO_CONTROL_EVIDENCE_MISSING
ISO_CONTROL_ASSURANCE_MISSING
ISO_CONTROL_DEPENDENCY_BROKEN
ISO_CONTROL_DUPLICATE
ISO_CONTROL_VERSION_CONFLICT
ISO_CONTROL_REFERENCE_STALE
```

***

# 92. Critical Control Findings

Potential critical findings include:

* material ISO requirement has no mapped control;
* critical control lacks ownership;
* critical control is not implemented;
* critical control cannot produce evidence;
* management review control is ineffective;
* internal-audit control is absent;
* continual-improvement control is ineffective.

***

# 93. Control Effectiveness Model

AIGO should distinguish:

```text theme={null}
DEFINED
   ↓
IMPLEMENTED
   ↓
OPERATING
   ↓
MONITORED
   ↓
ASSESSED
   ↓
EFFECTIVE
```

An implemented control is not automatically effective.

***

# 94. Control Maturity

An internal maturity model may use:

```text theme={null}
0 — NOT_ESTABLISHED
1 — INITIAL
2 — DEFINED
3 — IMPLEMENTED
4 — MANAGED
5 — OPTIMIZED
```

This is an AIGO maturity model and is not an ISO/IEC 42001 scoring model.

***

# 95. Control Review

Controls should be reviewed:

* annually;
* after significant changes;
* after audit findings;
* after incidents;
* after standard updates;
* after major AIGO framework changes.

***

# 96. Standard Currency

The mapping should identify:

`ISO/IEC 42001:2023`

as the exact standard baseline.

ISO currently lists the standard as published and in its first edition.

***

# 97. Related Standards

The mapping should identify related standards separately.

ISO/IEC 42005:2025 addresses AI system impact assessment, while ISO/IEC 42006:2025 addresses requirements for bodies auditing and certifying AIMS. ISO/IEC AWI 42003 is currently under development as implementation guidance for ISO/IEC 42001.

These standards should not be silently added to the ISO/IEC 42001 requirement baseline.

***

# 98. Certification Boundary

The AIGO control mapping supports organizational implementation and readiness.

It does not create:

* accreditation;
* certification;
* external conformity;
* certification-body authority.

ISO/IEC 42006:2025 governs the relevant certification-body requirements.

***

# 99. Implementation Boundary

Control definitions identify what should be governed.

Detailed operating procedures should remain within:

`08-AIGO-ISO-42001-Implementation-Mapping-v0.1.md`

and relevant AIGO procedures/templates.

***

# 100. Evidence Boundary

Detailed evidence relationships remain in:

`07-AIGO-ISO-42001-Evidence-Mapping-v0.1.md`

This control mapping should identify evidence categories without duplicating the complete evidence architecture.

***

# 101. Assurance Boundary

Detailed assurance relationships remain in:

`09-AIGO-ISO-42001-Assurance-Mapping-v0.1.md`

Controls should identify the assurance relationship without duplicating the assurance methodology.

***

# 102. Registry Boundary

Machine-readable relationships should be held in:

`00-AIGO-ISO-42001-Mapping-Registry-v0.1.json`

The registry should remain synchronized with this control mapping.

***

# 103. Management-System Crosswalk

| ISO/IEC 42001 Area     | Primary AIGO Control Domains |
| ---------------------- | ---------------------------- |
| Context                | CTX, GOV, RSK                |
| Leadership             | GOV, POL, ROL                |
| Planning               | RSK, OBJ, CHG                |
| Support                | RES, COM, DOC                |
| Operation              | OPS, AI, TPG                 |
| Performance Evaluation | MON, AUD, MREV               |
| Improvement            | INC, IMP, CHG                |
| Annex A Controls       | Integrated across domains    |

***

# 104. Master Control Relationships

The core controls are:

```text theme={null}
ISO42001-CTRL-CTX-001
ISO42001-CTRL-CTX-002
ISO42001-CTRL-CTX-003

ISO42001-CTRL-GOV-001
ISO42001-CTRL-GOV-002
ISO42001-CTRL-GOV-003
ISO42001-CTRL-GOV-004

ISO42001-CTRL-ROL-001
ISO42001-CTRL-ROL-002

ISO42001-CTRL-RSK-001
ISO42001-CTRL-RSK-002

ISO42001-CTRL-OBJ-001
ISO42001-CTRL-OBJ-002

ISO42001-CTRL-RES-001

ISO42001-CTRL-COM-001
ISO42001-CTRL-COM-002
ISO42001-CTRL-COM-003

ISO42001-CTRL-DOC-001
ISO42001-CTRL-DOC-002

ISO42001-CTRL-OPS-001
ISO42001-CTRL-OPS-002

ISO42001-CTRL-AI-001
ISO42001-CTRL-AI-002
ISO42001-CTRL-AI-003
ISO42001-CTRL-AI-004
ISO42001-CTRL-AI-005
ISO42001-CTRL-AI-006

ISO42001-CTRL-TPG-001
ISO42001-CTRL-TPG-002

ISO42001-CTRL-MON-001
ISO42001-CTRL-MON-002
ISO42001-CTRL-MON-003

ISO42001-CTRL-AUD-001
ISO42001-CTRL-AUD-002
ISO42001-CTRL-AUD-003

ISO42001-CTRL-MREV-001
ISO42001-CTRL-MREV-002

ISO42001-CTRL-INC-001

ISO42001-CTRL-IMP-001
ISO42001-CTRL-IMP-002
ISO42001-CTRL-IMP-003

ISO42001-CTRL-EVD-001
ISO42001-CTRL-EVD-002
ISO42001-CTRL-EVD-003
ISO42001-CTRL-EVD-004

ISO42001-CTRL-ASSR-001
ISO42001-CTRL-ASSR-002
ISO42001-CTRL-ASSR-003
ISO42001-CTRL-ASSR-004

ISO42001-CTRL-CHG-002
ISO42001-CTRL-CHG-003
```

These are AIGO mapping identifiers and should resolve through the control architecture and registry.

***

# 105. Control-to-Schema Crosswalk

| Control Domain    | Primary AIGO Schema            |
| ----------------- | ------------------------------ |
| Context           | Governance / Assessment        |
| Leadership        | Governance                     |
| Roles             | Governance                     |
| Risk              | Risk                           |
| Objectives        | Monitoring / Management Review |
| Resources         | Governance                     |
| Competence        | Evidence / Governance          |
| Documentation     | Evidence                       |
| Operations        | AI System / Control            |
| Lifecycle         | AI System                      |
| Suppliers         | Governance / Control           |
| Monitoring        | Monitoring                     |
| Audit             | Assurance                      |
| Management Review | Management Review              |
| Nonconformity     | Incident                       |
| Corrective Action | Improvement / Change           |
| Evidence          | Evidence                       |
| Assurance         | Assurance                      |
| Retirement        | Retirement                     |

***

# 106. Control-to-Template Crosswalk

| Control Area      | Primary Template                 |
| ----------------- | -------------------------------- |
| AI System         | AI System Registration / Profile |
| Classification    | AI Classification                |
| Risk              | AI Risk Assessment               |
| Approval          | AI Approval                      |
| Monitoring        | AI Monitoring                    |
| Incident          | AI Incident                      |
| Change            | AI Change Management             |
| Assurance         | AI Assurance                     |
| Management Review | AI Management Review             |
| Improvement       | AI Continuous Improvement        |
| Retirement        | AI Retirement                    |
| Evidence          | AI Evidence Record               |

***

# 107. Control and Cross-Framework Mappings

The AIGO control architecture should allow the ISO controls to be reused for other mapping packages.

Example:

```text theme={null}
ISO42001-CTRL-RSK-001
        │
        ├── ISO/IEC 42001
        ├── EU AI Act
        └── Internal AIGO Governance
```

The relationship should be recorded independently for each framework.

***

# 108. Control Conflict Management

If different standards impose different requirements on the same operational area, AIGO should preserve separate relationships.

Example:

```text theme={null}
Shared AIGO Control
       ├── ISO requirement A
       └── Regulatory requirement B
```

The control can be strengthened to support both, but the mapping must not imply that one framework has replaced the other.

***

# 109. Evidence Reuse

A single evidence record can support several controls where its:

* scope;
* date;
* system version;
* purpose;
* quality;

are sufficient for each mapped relationship.

***

# 110. Assurance Reuse

A single assurance activity may support multiple controls where its scope and criteria cover them.

Each relationship must remain explicit.

***

# 111. Control Change Impact

A change to a shared AIGO control should trigger mapping-impact analysis.

```text theme={null}
AIGO Control Change
        ↓
ISO Mapping Impact
        ↓
EU Mapping Impact
        ↓
Evidence Impact
        ↓
Assurance Impact
```

***

# 112. Control Retirement

A control may be retired only when:

* its mappings are superseded;
* dependencies are resolved;
* historical records are preserved;
* replacement controls exist where needed.

***

# 113. Control History

Historical control definitions should preserve:

* control ID;
* version;
* status;
* owner;
* effective date;
* supersession reason.

***

# 114. Release Validation

Before this control mapping is marked validated:

```text theme={null}
ISO Standard Verified
AIGO Control IDs Verified
Existing Schemas Verified
Existing Templates Verified
Cross-References Checked
Registry Updated
Evidence Relationships Defined
Assurance Relationships Defined
Critical Controls Identified
```

***

# 115. Repository Health Validation

The ISO mapping package should pass:

* structural validation;
* reference validation;
* traceability validation;
* control coverage validation;
* evidence coverage validation;
* framework consistency;
* document integrity;
* repository health.

***

# 116. Limitations

This mapping cannot independently establish:

* conformity to ISO/IEC 42001;
* certification readiness without complete implementation evidence;
* certification-body acceptance;
* adequacy of individual controls in a specific organization;
* adequacy of an organization's AIMS scope;
* legal compliance under other frameworks.

The organization's actual context, scope, controls, evidence, and assurance results determine implementation outcomes.

***

# 117. Final Control Architecture

The complete AIGO ISO/IEC 42001 control relationship is:

```text theme={null}
ISO/IEC 42001
       ↓
Requirement
       ↓
AIGO Governance Objective
       ↓
AIGO Control
       ↓
AIGO Schema
       ↓
AIGO Process
       ↓
AIGO Evidence
       ↓
Monitoring
       ↓
Assurance
       ↓
Finding
       ↓
Corrective Action
       ↓
Continual Improvement
```

This architecture supports ISO/IEC 42001 implementation while preserving a reusable AIGO control system that can also serve the EU AI Act and other governance frameworks.

***

# 118. Document Control

| Field               | Value                                   |
| ------------------- | --------------------------------------- |
| Document            | AIGO ISO/IEC 42001 AIGO Control Mapping |
| Version             | 0.1                                     |
| Status              | Draft                                   |
| Document Identifier | `AIGO-MAP-ISO42001-010`                 |
| Document Type       | ISO Management-System Mapping           |
| Primary Standard    | ISO/IEC 42001:2023                      |
| Primary Purpose     | Requirement-to-AIGO-control crosswalk   |
| Owner               |                                         |
| Standards Reviewer  |                                         |
| Governance Reviewer |                                         |
| Control Reviewer    |                                         |
| Assurance Reviewer  |                                         |
| Framework Architect |                                         |
| Approved By         |                                         |
| Effective Date      |                                         |
| Next Review Date    |                                         |

***

# 119. Document Status

**Document:** AIGO — ISO/IEC 42001 AIGO Control Mapping

**Version:** 0.1

**Status:** Draft

**Working Name:** AIGO

**Full Name:** AI Governance Operating Framework

**Document Identifier:** `AIGO-MAP-ISO42001-010`

**Document Type:** ISO Management-System Mapping

This document establishes the detailed ISO/IEC 42001-to-AIGO control crosswalk, connecting management-system requirements and Annex A control relationships to AIGO governance, lifecycle, risk, evidence, monitoring, assurance, management review, corrective action, and continual improvement.

End of Document