Standards, ISO/IEC 42001
Hand your 42001 auditor the operating evidence, not the manual
A certification auditor has read your AI policy. What they sample is whether it ran: which rule applied to a real decision, who reviewed the exception, and whether a finding was fixed. When those records already exist, nobody spends audit week rebuilding them.
What a stage 2 audit looks like from the auditor's chair
Agree the scope
The auditor opens an engagement in VeriProof scoped to the agents and dates in your certification scope. They see nothing outside it.
Pick a sample
They choose decisions from the period: some the agent handled alone, some that went to a person, some the rules denied.
Trace each one
For each decision they see the rule version that applied, the facts it was checked against, the reviewer and their response, and what the agent reported doing.
Check the record hasn't changed
Integrity proofs let them confirm the record is the one written at the time, without relying on your team's word for it.
Annex A controls and the records behind them
Scroll horizontally to see all columns.
| Control | What your AIMS needs to show | Where the evidence comes from |
|---|---|---|
| A.3.2 AI roles and responsibilities | Roles for the AI system are defined and assigned. | Six role portals with separate permissions. Production rule changes from governance engineers need an administrator or compliance officer to approve them, and auditors can't operate the agent. |
| A.6.2.6 AI system operation and monitoring | The system is monitored in operation, including for errors and failures. | Policy outcomes, exceptions, and overrides from live decisions, with the agents that produced them. |
| A.6.2.8 AI system recording of event logs | Event logs are kept at the phases where they are needed. | A decision record at each policy check with timestamps, rule version, reviewer decision, and reported outcome, sealed so later changes can be detected. |
| A.9.2 Processes for responsible use of AI systems | Processes for using the AI system responsibly are defined and followed. | Rules checked before each consequential action, and escalation to a person with authority when the stakes call for it. |
| Clause 10.2 Nonconformity and corrective action | Nonconformities are corrected, causes reviewed, and actions recorded. | Compliance gaps assigned to an owner with a due date and priority, tracked to closure. |
Your Statement of Applicability decides which Annex A controls are in scope. The ones above are where VeriProof records carry most of the weight. Others, such as data quality and impact assessments, rest on your own documents.
When a rule changes mid-period
Auditors ask about change control because a new rule can change what the agent does. In VeriProof a changed rule must pass its tests before it's enforced, and it can run in Shadow first to show what it would have decided. Your organization sets how many people other than the author approve it, up to two. A production change from a governance engineer or developer always goes to an administrator or compliance officer.
The auditor sees the rule version, who wrote it, who approved it, and any Shadow results that came before. See how policy decisions work.
Two questions certification teams ask
Does VeriProof replace our AIMS documentation? No. Your policy, risk assessments, and impact assessments stay yours. VeriProof supplies the operating evidence that shows those documents in use.
Can the certification body use VeriProof records directly? Yes. An auditor with an engagement reads and exports the records in scope. Your certification body reaches its own conclusion.
About the standard
ISO/IEC 42001:2023 sets the requirements for an AI management system. The ISO overview describes its purpose and scope. Other framework mappings are in the Compliance Center.