ISO/IEC 42001:2023 control library
Every control CMDash tracks for ISO/IEC 42001:2023, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
ISO standards are sold per copy and may not be redistributed, so the control text cannot be embedded in this product.
CMDash publishes the identifiers, titles and cross-framework mappings so you can see the shape of what is tracked, and links you to ISO / IEC for the document itself. A tenant that holds its own licence can load the real text through the framework import.
Buy from the ISO Store →Families
Internal Organization · 2
| A.3.2 | AI Roles and Responsibilities Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0 |
| A.3.3 | Reporting of Concerns Maps to ISO/IEC 27001:2022 |
Resources for AI Systems · 5
| A.4.2 | Resource Documentation Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0 |
| A.4.3 | Data Resources Maps to ISO/IEC 27001:2022 |
| A.4.4 | Tooling Resources |
| A.4.5 | System and Computing Resources |
| A.4.6 | Human Resources Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0 |
Assessing Impacts of AI Systems · 4
| A.5.2 | AI-System Impact-Assessment Process Maps to NIST AI Risk Management Framework 1.0 |
| A.5.3 | Documentation of AI-System Impact Assessments Maps to NIST AI Risk Management Framework 1.0 |
| A.5.4 | Assessing AI-System Impact on Individuals or Groups Maps to NIST AI Risk Management Framework 1.0 |
| A.5.5 | Assessing Societal Impacts of AI Systems |
AI System Life Cycle · 9
| A.6.1.2 | Objectives for Responsible Development of AI Systems |
| A.6.1.3 | Processes for Responsible AI-System Design and Development Maps to ISO/IEC 27001:2022 |
| A.6.2.2 | AI-System Requirements and Specification Maps to NIST AI Risk Management Framework 1.0 |
| A.6.2.3 | Documentation of AI-System Design and Development Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0 |
| A.6.2.4 | AI-System Verification and Validation Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0 |
| A.6.2.5 | AI-System Deployment Maps to ISO/IEC 27001:2022 |
| A.6.2.6 | AI-System Operation and Monitoring Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0 |
| A.6.2.7 | AI-System Technical Documentation Maps to NIST AI Risk Management Framework 1.0 |
| A.6.2.8 | AI-System Recording of Event Logs Maps to ISO/IEC 27001:2022 |
Data for AI Systems · 5
Information for Interested Parties · 4
| A.8.2 | System Documentation and Information for Users |
| A.8.3 | External Reporting |
| A.8.4 | Communication of Incidents Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0 |
| A.8.5 | Information for Interested Parties Maps to NIST AI Risk Management Framework 1.0 |
Use of AI Systems · 3
| A.9.2 | Processes for Responsible Use of AI Systems Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0 |
| A.9.3 | Objectives for Responsible Use of AI Systems Maps to NIST AI Risk Management Framework 1.0 |
| A.9.4 | Intended Use of the AI System Maps to NIST AI Risk Management Framework 1.0 |
Third-Party and Customer Relationships · 3
| A.10.2 | Allocating Responsibilities Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0 |
| A.10.3 | Suppliers Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0 |
| A.10.4 | Customers |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for ISO/IEC 42001:2023 2023, published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.