ISO/IEC 42001 evidence worksheet

List the AI systems within that boundary, including purchased services. For one system, name the business owner, technical contact and person who approves changes. Record who needs training or authority to carry out their responsibilities.

Evidence to gather: Inventory entry, supplier/model version, assigned responsibilities and one competence or authority gap.

Choose a credible failure or misuse scenario. Describe its causes, consequences and existing safeguards. Decide what evidence would show the safeguards work, who accepts the remaining risk and what would trigger a reassessment.

Evidence to gather: Risk entry, treatment owner, proposed test, acceptance decision and reassessment trigger.

Who could be helped or harmed by this use, including people who never interact with the system? Consider intended and unintended effects. Record whose perspective is missing and how you will check an important assumption before the next decision.

Evidence to gather: Affected groups, impact scenario, consultation or test evidence and an open assumption.

Select a safeguard from your risk treatment and find evidence from actual operation. Check a test result, change approval, supplier review or incident record. Does it match the policy and current system version? Assign any missing evidence to its owner.

Evidence to gather: Policy/control reference, dated operating record, supplier dependency and corrective action if needed.

Set an internal audit sample and reviewer, then plan management review of findings, resources and corrective actions. If seeking certification, confirm the intended scope and the certification body's competence and accreditation status. Agree the next evidence milestone before booking an audit.

Evidence to gather: Audit sample, review owner, management-review date and one corrective-action follow-up; certification scope if relevant.