ISO 42001 audit evidence is the documented information that shows your AI management system meets ISO/IEC 42001:2023 on iso.org, the standard published on 18 December 2023. The standard’s own definition of documented information (3.10) covers two kinds: documentation that describes how the system works, and records that are “evidence of results achieved”. An auditor reads the first kind to understand your AIMS and samples the second to see whether it runs.
Have these ten items ready, current and approved before anything else, because almost every later sample traces back to one of them:
- AIMS scope statement (clause 4.3)
- AI policy, approved and communicated (5.2)
- AI system register, the list every other record points back to (4.1, 4.3)
- AI risk assessment method and current risk register (6.1.2, 8.2)
- Risk treatment plan and Statement of Applicability (6.1.3)
- AI system impact assessments for in-scope systems (6.1.4, 8.4)
- AI objectives and how they are measured (6.2, 9.1)
- Internal audit program and the latest audit report (9.2)
- Management review minutes (9.3)
- Nonconformity and corrective action log (10.2)
The rest of the pack backs these up. The index below shows which items ISO/IEC 42001 requires and which are good practice.
What Counts as Audit Evidence Under ISO/IEC 42001
Audit evidence is verifiable information relevant to the audit criteria; ISO/IEC 42001 takes the terms “audit evidence” and “audit criteria” from ISO 19011 (definition 3.18, note 3). In an AIMS audit, the criteria are the clauses, your Statement of Applicability and your own procedures, and the evidence is the documents, records, interviews and observations that show each one is met.
Two tests decide whether an item counts. It must be relevant to a specific requirement, and it must be reliable: dated, approved, under version control and produced by the process it describes. A policy PDF with no approval date is weak evidence. A risk register exported the night before Stage 1 with no history is weaker.
Auditors gather evidence in a few ways: reading documents, sampling records, interviewing the people named in them and watching a process run. Plan the pack for all four. The record proves the process ran; the interview proves the owner understands it. For the wording behind each clause, read ISO 42001 requirements, clause by clause.
The ISO 42001 Evidence Index, by Clause
The index sorts every common evidence item by clause and marks its status in four ways. Required (preview) means the official ISO/IEC 42001 preview text shows the requirement. Required (HS) means it comes from the harmonized structure core text that ISO/IEC 42001 applies, so the same wording appears in every ISO management system standard built on it. Required (summaries) means the AI-specific clause text is not in the free preview, and published clause summaries list the item as documented information the standard requires. Good practice means auditors expect it, but no clause names it.
Clauses 4 to 6: Context, Leadership and Planning
| Clause | Evidence item | Status | Stage 1 or Stage 2 | Usual owner | Freshness rule |
| 4.1 | Internal and external issues, including the climate change determination; AI role per system | Determination required (preview); written record is good practice | Stage 1 | AIMS owner | Reviewed at each management review |
| 4.2 | Interested parties and their requirements, marked with what the AIMS addresses | Good practice | Stage 1 | Legal, with AIMS owner | Updated when a contract or law changes |
| 4.3 | AIMS scope statement | Required (preview): “available as documented information” | Stage 1 | Top management approves | Re-approved on any scope change |
| 4.4 | The AIMS, its processes and their interactions, documented | Required (preview) | Stage 1 | AIMS owner | Matches current process map |
| 4.1, 4.3 | AI system register | Good practice (no clause names it), but it evidences 4.1 and 4.3 | Stage 1 and 2 | AIMS owner, system owners confirm | Reconciled with procurement and sign-on data on a set cycle |
| 5.1 | Leadership evidence: mandate, resource decisions, review attendance | Good practice | Stage 2 interviews | Top management | Current year |
| 5.2 | AI policy | Required (HS): available as documented information, communicated | Stage 1, communication checked in Stage 2 | Top management | Approved version in force; review date not passed |
| 5.3 | Roles, responsibilities and authorities | Good practice record; assignment is required | Stage 1 | Top management | Names match the current organization chart |
| 6.1.1, 6.1.2 | AI risk criteria and risk assessment process | Required (summaries) | Stage 1 | Risk owner, with AIMS owner | Version used for the current register |
| 6.1.3 | Statement of Applicability | Required (summaries) under 6.1.3; definition 3.26 in the preview says every identified risk and its controls are reflected in it | Stage 1 and 2 | AIMS owner; management approves | Updated after any risk or control change |
| 6.1.3 | AI risk treatment plan, approval and residual risk acceptance | Required (summaries) | Stage 1 and 2 | Risk owners; management approves | Dated after the latest risk assessment |
| 6.1.4 | AI system impact assessment process | Required (preview): definition 3.24 calls it a “formal, documented process” | Stage 1 | AIMS owner | Version cited by each assessment |
| 6.2 | AI objectives and plans to achieve them | Required (HS): available as documented information | Stage 1, progress in Stage 2 | Top management | Progress recorded at the interval you set |
| 6.3 | Records of planned changes to the AIMS | Good practice | Stage 2 | AIMS owner | One record per change |
Source: ISO/IEC 42001:2023 official preview (clauses 4.1 to 4.4, definitions 3.10, 3.24, 3.26); harmonized structure core text in Annex SL of the ISO/IEC Directives; published clause summaries for 6.1.1 to 6.1.3, including the Statement of Applicability.
Clauses 7 to 10: Support, Operation, Evaluation and Improvement
| Clause | Evidence item | Status | Stage 1 or Stage 2 | Usual owner | Freshness rule |
| 7.1 | Resource decisions for the AIMS | Good practice | Stage 2 | Top management | Current budget year |
| 7.2 | Competence evidence for people in AIMS roles (training, experience, qualifications) | Required (HS): “evidence of competence” | Stage 2 sample | Line managers, HR | Updated when a person joins a role |
| 7.3, 7.4 | Awareness records; communication plan | Good practice | Stage 2 interviews | HR, AIMS owner | Each new starter covered |
| 7.5 | Document control rules; version history | Required (HS) for control of required documented information | Stage 1 and 2 | AIMS owner | Every item shows version, approver, date |
| 8.1 | Records that operational processes ran as planned: deployment approvals, supplier checks | Required (HS) “to the extent necessary” | Stage 2 | System owners | Covers the audit period |
| 8.2 | Results of AI risk assessments in operation | Required (summaries) | Stage 2 | Risk owners | Dated after the last significant change |
| 8.3 | Results of AI risk treatment | Required (summaries) | Stage 2 | Control owners | Matches SoA status |
| 8.4 | Results of AI system impact assessments in operation | Required (summaries) | Stage 2 | System owners | Dated after the last significant change |
| Annex A | Evidence for each control the SoA marks applied, such as supplier assessments, data records, monitoring logs | Expected for every applied control | Stage 2 | Control owners | Inside the audit period |
| 9.1 | Monitoring and measurement results | Required (HS): “evidence of the results” | Stage 2 | Process owners | At the frequency you set |
| 9.2 | Internal audit program and audit results | Required (HS) | Stage 1 (program), Stage 2 (results) | Program owner | Full scope audited before Stage 1 |
| 9.3 | Management review results | Required (HS) | Stage 1 and 2 | Top management | At least one review before Stage 1 |
| 10.2 | Nonconformities, actions taken and corrective action results | Required (HS) | Stage 2 | Action owners | Open items have dates and owners |
Source: harmonized structure core text (clauses 7.2, 7.5, 8.1, 9.1, 9.2.2, 9.3.3, 10.2) in Annex SL of the ISO/IEC Directives, applied by ISO/IEC 42001:2023 per its official preview; published clause summaries for 8.2 to 8.4.
Two items deserve a word. The AI system register is not a named mandatory document, yet nearly every other record points at it, so build it first; the fields an ISO 42001 AI register needs are set out separately. The Statement of Applicability is the record auditors use to choose their Annex A sample, so check what an ISO 42001 SoA must contain before Stage 1. If you are still building these records, follow the ISO 42001 implementation sequence rather than assembling a pack for a system that is not yet running.
How Stage 1 and Stage 2 Use the Evidence Pack
A certification body’s initial certification audit has two stages, Stage 1 and Stage 2, under the ISO/IEC 17021-1 rules that ISO/IEC 42006 builds on. Stage 1 reviews your documented AIMS and readiness. Stage 2 tests whether the system is implemented and effective, by sampling records and interviewing the people named in them.
So the pack does two jobs. For Stage 1, the auditor reads the documentation layer: scope, policy, risk method, SoA, impact assessment process, audit program and management review. Gaps here can delay Stage 2. For Stage 2, the auditor samples the records layer: risk and impact results in operation, monitoring output, competence records, audit results and the corrective action log, over the period since the system started running.
Certification bodies work to ISO/IEC 17021-1 plus ISO/IEC 42006:2025, which adds requirements for bodies that audit and certify AI management systems. In the US, ANAB’s ISO/IEC 42001 accreditation program lists ISO/IEC 42006:2025 among its program documents. The certification route itself, from choosing a body to surveillance audits, is in how a company gets ISO 42001 certified.
Three AI-Specific Evidence Trails Auditors Pull
Beyond the clause-by-clause index, AIMS auditors follow trails across records. Each trail is an audit trail in the plain sense: a chronological set of records that documents the sequence of activities affecting one system or event. The draft (FDIS) text of ISO/IEC 42006 asks certification audit teams to be collectively competent in “tracing and identifying indications of incidents” back to AIMS elements, so expect at least one trail per audit.
Trail 1: One AI System From Register to Monitoring
The auditor follows one AI system from its register entry (4.1, 4.3) through its impact assessment (6.1.4, 8.4), risks and treatments (6.1.2, 6.1.3) and SoA rows to its monitoring output (9.1). For the pack, the test is consistency: every record carries the same system ID, and a harm named in the impact assessment shows up in the risk register and in the SoA control that treats it. For how those assessments are run and signed, see AI impact assessments in practice.
Trail 2: A Change and the Reassessment It Triggered
The auditor picks a recent model, data or vendor change and asks for the change record, the approval, the release test and the risk and impact reassessments that your procedure says a significant change triggers (8.2, 8.4). A change ticket with no reassessment behind it is a finding, and it tends to appear where the change process and the AIMS run separately.
Trail 3: An Incident or Concern Through to Corrective Action
The auditor picks an AI incident, complaint or reported concern and follows it into the nonconformity log and the root cause analysis. Then come the corrective action, the check that it worked (10.2) and the management review that saw it (9.3). If you have had no incidents, expect questions about how people report concerns and where reports go.
Freshness Rules That Make AI Evidence Credible
Evidence goes stale in predictable ways, and auditors check dates before content. Clause 7.5.3 of the harmonized structure text asks you to control documented information, including version control and retention, so every item in the pack should show version, approver and date.
Common freshness failures:
- Dated the week before Stage 1. A pack written in a rush shows a system that has not run. Let the AIMS operate through at least one cycle of monitoring, an internal audit and a management review first.
- Older than the system it describes. An impact assessment approved before the current model version went live does not cover what is running now.
- Out of sync across records. The SoA says a control is implemented, the risk register says the treatment is planned.
- Unsigned or unapproved. Drafts and emailed approvals that cannot be traced to a person and date.
- Missing history. Only the current version is kept, so nobody can show what changed after the last finding.
Set a freshness rule for each item, as in the index above, and check the whole pack against it before every audit, internal or external.
How to Organize the ISO 42001 Evidence Pack
Organize the pack by clause, with one evidence index on top listing each item, its location, owner, status and last-approved date. Auditors work through the standard in clause order and sample across it, so a clause-ordered index lets you answer any request in minutes.
Keep records where they are produced, such as the ticketing system, model registry or HR system, and point to them from the index instead of copying them into a folder. Copies go stale; links to the system of record do not. Before the certification body arrives, run your own check of the pack through running an ISO 42001 internal audit program, using the same trails the external auditor will pull.
If you need starting layouts for the records themselves, use ISO 42001 templates for the SoA, risk register and impact assessment. If you are the person who will build and defend this pack, ISO/IEC 42001 Lead Implementer training with the evidence an auditor samples works the AI register, impact assessment, risk register and SoA end to end in a case study workbook.
Frequently Asked Questions
What Are the Mandatory Documents for ISO 42001?
The official ISO/IEC 42001:2023 preview shows the scope (4.3) as required documented information, and definitions 3.24 and 3.26 describe a documented impact assessment process and the Statement of Applicability. Harmonized structure text adds the AI policy, AI objectives, competence evidence, monitoring results, internal audit, management review and corrective action records. Published clause summaries add the AI risk assessment process, the risk treatment plan, the Statement of Applicability and risk and impact assessment results.
What Evidence Does an ISO 42001 Auditor Look at in Stage 1?
Stage 1 of an ISO/IEC 42001 certification audit reviews the documented AIMS and readiness for Stage 2. Expect requests for the scope statement, AI policy, AI system register, risk assessment method and register, Statement of Applicability, impact assessment process, AI objectives, internal audit program and at least one set of management review minutes.
What Is the Difference Between a Document and a Record in ISO 42001?
ISO/IEC 42001:2023 uses one term, documented information (definition 3.10), with notes describing documentation that the organization creates to operate and records that are evidence of results achieved. In audit practice, documents such as the AI policy say what you will do, and records such as risk assessment results show you did it.
Is an AI System Inventory Required for ISO 42001?
ISO/IEC 42001:2023 does not name a mandatory “AI inventory”, but clause 4.1 requires you to consider the intended purpose of each AI system and determine your role for it, and clause 4.3 requires a documented scope. An AI system register is the practical evidence for both, and auditors usually ask for it early.
How Far Back Should ISO 42001 Audit Evidence Go?
ISO/IEC 42001 sets no fixed look-back period. At Stage 2, auditors sample records from the period the AIMS has been operating. Evidence should cover at least one full cycle of your own intervals: monitoring, risk and impact reassessment where triggered, an internal audit and a management review. Retention periods are yours to set under clause 7.5.
Can an ISO 27001 Evidence Pack Be Reused for ISO 42001?
Partly. ISO/IEC 42001 and ISO/IEC 27001 share the harmonized structure, so document control, internal audit, management review and corrective action evidence can serve both if the AIMS scope is included. AI-specific items are new: the AI system register, AI policy, AI risk and impact assessments, and the ISO/IEC 42001 Statement of Applicability.
