Prepare for ISO 42001 certification, faster.
Work through the ISO/IEC 42001 checklist, see what’s open before each audit stage, and let Durin record evidence for the AI agents using your company systems.
9 of 19 ISO 42001 requirements where Durin can supply evidence
Define
- Context, Your team
- Scope, Your team
- AI inventory, Durin evidence
- AI policy, Your team
- Roles, Durin evidence
Assess
- Risk assessment, Your team
- Risk treatment, Durin evidence
- Applicability, Your team
- Impact assessment, Your team
- Objectives, Your team
Operate
- Competence, Your team
- Documentation, Your team
- Operational controls, Durin evidence
- Event logs, Durin evidence
- Suppliers, Durin evidence
Evaluate
- Measurement, Durin evidence
- Internal audit, Durin evidence
- Management review, Durin evidence
- Improvement, Your team
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system: how an organization sets responsibilities, manages AI risks and improves its approach over time. It covers organizations that develop, provide or use AI products and services.
This checklist groups preparation into 19 practical checks with clause and control references. Use the standard for the full requirements and your certification body for the agreed audit scope. Durin supplies operational evidence for agent requests that pass through its gateway.
What certification asks you to show.
Nineteen practical readiness checks, grouped by clause and control reference so each step builds on the last. Tick what is already in place to see your readiness.
Checked against ISO/IEC 42001:2023 on . Clause references follow the standard; the descriptions are our summary, not its text.
Let Durin collect the agent evidence.
If agents that use your company systems fall within your scope, auditors ask what they could reach, which rules applied, who reviewed their actions and what happened. Durin records those answers as each request passes through it. Agent activity through other routes, and any AI systems you develop, need their own evidence.
Clause 4.3 · Annex A.4
Know which agents and systems are in scope
Connections show each system your agents can reach through Durin, which teams can use it and whether it is enabled. Shadow MCP discoveries add MCP servers reported from enrolled devices outside Durin, so your inventory reaches beyond what is already governed.
Review Shadow MCP discoveriesClauses 6.1.3 and 8.1 · Annex A.9
Turn your treatment plan into rules agents follow
Access policies set what agents can do by default, which changes need review and what is blocked, with targeted rules for teams, connections and tools. Each published version is recorded, and publishing a new one invalidates earlier approvals.
Change the access policyClause 5.3 · Annex A.3 and A.9
Show who reviewed each agent action
Where your rules require review, a different administrator checks the exact request in Durin or Slack before it can go ahead. The record keeps the requester, reviewer, decision and expiry, and the retried request carries its own outcome.
Review an exact approvalClause 9.2 · Annex A.6.2.6 and A.6.2.8
Keep event logs an auditor can sample
Each governed request records the person, client, connection, tool, policy version, decision and outcome. Filter the activity, export it as JSON or send traces to Langfuse when an internal or external auditor asks for a sample.
Read request activityAnnex A.10
Review the providers behind each connection
The provider and connection risk inventory report lists observed provider state, failures and incomplete measurements. Each connection keeps its own credentials and reviewed tools, so supplier reviews start from current facts.
Understand connectionsClauses 9.1 and 9.3
Bring current figures to audits and reviews
Reports include an ISO 42001 management system starter and an AI governance evidence summary built from your policies, connection monitoring and review queues. Vanta sync sends hourly checks for policy configuration, independent approvals and audit coverage.
Sync governance evidence to Vanta
How does ISO 42001 differ from ISO 27001?
ISO 27001 addresses an information security management system; ISO 42001 addresses an AI management system. Shared document control, audit and management review processes can support both, while the AI scope, risks, impacts and selected controls still need their own assessment.
| Area | ISO 27001 | ISO 42001 preparation |
|---|---|---|
| Scope | Information and its security risks. | AI systems, their intended uses and organizational responsibilities. |
| Risk work | Risks to information security. | AI risks, impacts and the controls selected to address them. |
| Management processes | Document control, internal audits and management reviews. | Extend shared processes to cover the AI management system. |
What agent evidence can an auditor sample?
When a policy requires approval, Durin holds the requested change for independent review. An authorized reviewer approves the exact request, then the agent retries it before the approval expires. Request activity links the decision and execution outcome through the same execution identifier.
- Inspect the approval: requester, reviewer, proposed action, argument digest, policy and schema versions, and expiry.
- Match the approval and timeline events using their execution identifier. Approval required means the action has not run.
- After the exact retry, inspect the outcome separately from the decision. An allowed decision means checks passed; use the execution status to establish what happened.
[
{
"id": "event:demo-held-request",
"executionId": "00000000-0000-4000-8000-000000000001",
"decision": "approval",
"status": "approval_required"
},
{
"id": "event:demo-exact-retry",
"executionId": "00000000-0000-4000-8000-000000000001",
"decision": "allow",
"status": "completed"
}
]Use the execution identifier to connect a request’s approval decision with its final execution status. In Admin → Audit, filter the activity and choose Export a file to download JSON. Review the records alongside the approval details; metadata-only retention does not include every argument or response.
| Reference | Evidence to inspect in Durin | Your team prepares |
|---|---|---|
| Clauses 6.1.3 and 8.1 | Published access policy and the decisions it produced. | Risk assessment, treatment rationale and wider operational controls. |
| Clause 5.3 · Annex A.3 and A.9 | Approval requester, reviewer, exact scope and expiry. | Assigned responsibilities and the reasons for requiring review. |
| Clause 9.2 | Activity exports sampled during an internal audit. | The audit program, findings and follow-up records. |
Questions about ISO 42001 certification.
Does ISO 42001 apply if we use AI but don’t build it?
Yes. ISO/IEC 42001 applies to any organization that provides or uses products or services that use AI systems, whatever its size or sector. How you use AI shapes the Annex A controls you need.
Are all 38 Annex A controls mandatory?
No. Annex A is a reference set. You apply the controls your risk treatment needs and justify any you exclude in your Statement of Applicability. Clauses 4 to 10 are different: every certified management system must meet them.
Can we reuse our ISO 27001 management system?
Yes. Keep your existing ISO 27001 document control, internal audits and management reviews, and use Durin to put AI agent governance into practice. Durin enforces access policies, routes requests for independent approval when your rules require it, and records each decision and outcome for requests through its gateway. ISO 42001 reports and Vanta sync give your audit team current operational evidence, reducing the need to gather agent records by hand.
How does the certification audit work?
A certification body audits in two stages. Stage 1 reviews your documented management system and whether you are ready; Stage 2 tests whether it works in practice. Accredited certification bodies follow ISO/IEC 17021-1, with AI-specific requirements in ISO/IEC 42006. Certificates run on a three-year cycle, with surveillance audits in the first and second years and recertification in the third.
How long does ISO 42001 certification take?
It depends on your scope, how many AI systems it covers and which management systems you already run. Leave time for your controls to produce records, and for an internal audit and management review before Stage 2.
Does using Durin make us ISO 42001 certified?
No. Certification comes from an independent certification body that audits your management system. Durin records evidence for agent requests that pass through it; your team remains responsible for the AI policy, risk and impact assessments and the rest of the management system.
Have your agent evidence ready before Stage 2.
Create an account to put agent access, reviews and activity on one governed path, then download ISO 42001 reports when your auditor asks.
Create an account