Compliance ISO 42001

ISO/IEC 42001

Not legal advice, and not a statement that Tracekit meets any clause or control (about these pages).

Scope

ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, was published in December 2023 (edition 1; no amendment had been published on the date we checked). It sets requirements for an AI management system in an organisation that provides or uses AI systems. It is voluntary, and organisations can be certified against it. Clauses 4 to 10 are requirements on the management system; Annex A (normative) lists reference control objectives and controls, and Annex B gives implementation guidance for them. ISO's text is copyrighted, so this page cites clause and control numbers and titles only: read the standard for what each one requires. The Annex A titles come from public sources that agree with each other (see Sources), not from the standard itself. A management system is people, processes and records; a tool is at most one of its controls. Each row says what Tracekit can contribute to a clause or control, and what the clause still needs from you.

Mapping

Requirement	What Tracekit provides	Evidence to show	Your responsibility / limits
6.1.3 AI risk treatment and 8.3 AI risk treatment	A control you can choose for risks from what agents do with their tools: the signer decides each call against a policy before it runs (deny, hold for a person, flag, allow), and detection rules look across calls (experimental) (policy).	The policy file and its policy_hash; decisions by rule id.	Assessing the risks (6.1.2, 8.2), choosing controls and judging what risk remains. Rules match text: they are tripwires (limits). Only calls routed through Tracekit are decided.
7.5.3 Control of documented information	Records protected against undetected change: each one signed, chained to the one before and covered by a signed checkpoint. With a witness the operator doesn't run, a rewrite of what it cosigned is detected (experimental). Bundles verify offline, and old formats keep verifying (format v2).	Verify reports: Integrity and Assurance lines.	Which information you keep, who may read it, availability, backups, retention and disposal. Tamper-evident is not tamper-proof: a deletion shows, it isn't prevented. In dev mode the agent can rewrite the records (guarantees).
8.1 Operational planning and control	Operating criteria for agent actions, written as a policy and applied before every routed call. Lint refuses an invalid policy, and each decision names the hash of the policy it was made under, so a planned change shows in the records.	The policy file; policy_hash across decisions.	The other operational processes, and planning changes.
9.1 Monitoring, measurement, analysis and evaluation	Measurable records: denied, held and flagged calls, approvals, signed gaps and coverage, per run (verdicts).	Verify reports (--json) over time.	Deciding what to monitor, how, when, and analysing the results.
9.2 Internal audit	Evidence an auditor can check without trusting the operator: bundles, a verifier the auditor installs, and a trust config built from independent sources. A run-set bundle shows that no run was left out (auditor guide).	Bundles; the auditor's own verify reports.	The audit programme and the auditors' independence.
10.2 Nonconformity and corrective action	Nonconformities in agent behaviour are records: a call that ran against its decision is a signed capture.gap{executed_against_policy}; incidents and their resolution, with who resolved them and the reason given, are signed (experimental, incidents).	The policy and gaps report lines; incident.* records.	Finding causes and taking corrective action.
A.3.2 AI roles and responsibilities	Roles the signer enforces: approvers, break-glass, agent approvers (experimental) and operators, each named in signer.yaml. Records name who acted in each role (approvals).	signer.yaml; approver identities on approval records.	Defining and allocating the roles.
A.6.2.6 AI system operation and monitoring	Each routed tool call decided and recorded; tracekit view (stable). Detection and incidents, webhooks, the LLM gateway and the egress observer (all experimental) widen what is watched (incidents, gateway, egress).	Bundles; coverage matrix line; incident records.	Monitoring the model's performance and outputs. Actions no capture path sees leave no record (limits).
A.6.2.8 AI system recording of event logs	Automatic, signed, hash-chained records of each tool call, decision, approval and result, written by a signer the agent can't control in system and server modes; signed gaps where something was missed (format v2).	Run and run-set bundles; verify reports.	Which events to log beyond agent actions, and keeping the logs. Records hold commitments to content, not content.
A.8.4 Communication of incidents	Signed incident records, delivered at least once to a webhook you run (experimental, webhooks); bundles of the affected runs to share.	incident.* records; webhook deliveries; bundles.	Communicating incidents to users and other interested parties. Tracekit notifies no one outside your own systems.
A.9.2 Processes for responsible use of AI systems and A.9.4 Intended use of the AI system	The policy says which tool uses are allowed, which wait for a person and which are denied, and every routed call is decided against it before it runs. The server pack holds a tool the policy doesn't know for a person (unknown_tools: ask, packs).	The policy; decisions under it.	Defining responsible and intended use. Only calls routed through Tracekit are decided.
A.10.2 Allocating responsibilities and A.10.3 Suppliers	For Tracekit as a supplier: open source under the MIT licence, provided as is; a public format spec, threat models and limits; stable and experimental parts labelled (what's stable); a second, independently written verifier. For third-party tools: the MCP gateway and the tool executor record every call they run for an agent (experimental).	The threat models and limits pages; T2 records naming the service in via.	Evaluating Tracekit and every other supplier, and allocating responsibilities between you, your providers and your customers.
A.10.4 Customers	Bundles your customers can verify themselves, against keys they pin, without trusting you (auditor guide).	Bundles and the trust inputs you give customers (your log's verifier key).	What you commit to customers.

Not covered by Tracekit

• Clauses 4 and 5: context of the organisation, leadership, AI policy, roles at management level.
• 6.1.2, 6.1.4, 8.2 and 8.4: AI risk assessment and AI system impact assessment. Tracekit's records can inform them; they are yours to do.
• 6.2, 6.3 and 7.1 to 7.4: objectives, planning of changes, resources, competence, awareness and communication.
• 9.3 Management review and 10.1 Continual improvement.
• Annex A families A.2 (policies related to AI), A.4 (resources for AI systems), A.5 (assessing impacts of AI systems) and A.7 (data for AI systems).
• A.6.1 and A.6.2.2 to A.6.2.5: responsible development, requirements, design documentation, verification and validation, deployment. A.6.2.7 AI system technical documentation is yours to write; it can cite Tracekit's public docs.
• A.3.3 Reporting of concerns, A.8.2, A.8.3 and A.8.5: information for users, external reporting and information for interested parties. A.9.3 Objectives for responsible use.

Sources

Checked on 2026-10-18.

• ISO catalogue page for ISO/IEC 42001:2023: https://www.iso.org/standard/42001. It refused automated access on the check date; the same catalogue record was read at https://committee.iso.org/standard/42001 (published 2023-12, stage 60.60, edition 1).
• IEC webstore record of the same standard: https://webstore.iec.ch/en/publication/90574
• Clause titles: the standard's table of contents, which ISO's Online Browsing Platform shows: https://www.iso.org/obp/ui/en/#iso:std:iso-iec:42001:ed-1:v1:en
• Annex A titles, cross-checked: NIST's crosswalk from the AI RMF to ISO/IEC 42001 (based on the draft standard), https://airc.nist.gov/docs/NIST_AI_RMF_to_ISO_IEC_42001_Crosswalk.pdf, and two further public control lists that agree with it for every control cited here.