Solutions — instrument
No software certifies you against it. Here is what it can evidence.
The AI management system standard. Certifiable, which makes it the one buyers ask about most and the one where vendor claims are loosest — because a management system is a set of organisational practices and software is not one. Two separate things follow from that, and only the first is a limit on any product.
What an auditor could take from a deployment
- Operational controls (A.6, A.9)
- Bounded authority, refusals with reasons, oversight records, and a change history for what each agent was — as artefacts an assessor can sample rather than as a policy document describing intent.
- Records of AI system use
- The inventory, the provenance, and the decisions with their outcomes.
No product certifies anybody against 42001. Certification assesses your organisation: leadership commitment, competence, internal audit, management review. A deployment supplies evidence into that assessment and changes none of its requirements — and a vendor offering "42001 compliance" as a feature is describing something that does not exist.
What a clause map would cover
Annex A enumerates cleanly: nine control objectives and roughly forty
numbered controls. A.6 on the AI system life cycle, A.9 on use, and A.10
on third-party relationships would each carry a provenance of
hybrid — evidence supplied into your assessment rather than a
claim about your organisation — and the certification caveat would live in
the map's own caveat field, where every generated pack
reproduces it.
Ordering is the only reason it is not written: the instruments that create a deadline came first. Annex A is more enumerable than SR 11-7, which is supervisory guidance in roman-numeral sections and which ships as ten clauses, and the same shape as the NIST AI RMF, which is voluntary and ships as eleven.
Until it is written, an assessor asking for 42001 evidence is served by the artefact list above rather than by a percentage. Clause maps are data, so this one can be authored by you, by your counsel, or with us, and scored like any other.
RotaGrant ships no clause map for ISO/IEC 42001. The engine takes clause maps as data, so one can be authored — by you, by your counsel, or with us — and it will be scored like any other. What this page will not do is imply a mapping that does not exist, because a readiness percentage against an instrument nobody encoded is a number with no denominator.