Annex A (ISO 42001)

The normative list of 38 AI-specific reference controls in ISO/IEC 42001:2023, under nine objectives from A.2 to A.10: policies related to AI, internal organisation, resources for AI systems, assessing impacts, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. As with ISO 27001 you select controls from the list through risk treatment and justify exclusions in a Statement of Applicability. Annex B gives implementation guidance for each control.