ISO/IEC 42001:2023 — AI Management System Readiness Attestation

Executive Summary

Acme Corp's codebase was assessed against the AI management system (AIMS) controls of ISO/IEC 42001:2023 (Annex A) (ISO/IEC 42001:2023 2023) using automated code-level analysis. The assessment covers 17 controls, of which 9 are testable at the code level (53% coverage).

• Controls implemented: 8
• Controls with gaps: 0
• Controls partially implemented: 1
• Controls outside code scanning scope: 8

Key Findings

• A.7.3 Data Provenance — 1 finding(s), severity Medium

Scope & Limitations

This assessment covers CODE-LEVEL controls only. The following areas require separate, organizational assessment:

• A.5.3 AI System Impact Assessment
• A.6.2.4 AI System Testing & Validation
• A.6.2.6 AI System Deployment Criteria
• A.7.2 Data Quality for AI
• A.7.4 Data Preparation
• A.8.4 Reporting AI System Issues
• A.9.2 AI System Use Procedures
• A.9.3 Human Oversight of AI

Disclaimer: Code-level controls only. Coverage percentages reflect how many framework controls have matching RepoScope detectors. This is a development aid, not a certification tool — auditors make the final determination.

Note: Code-level AI management controls only. ISO/IEC 42001 requires organizational policies, risk assessments, and process evidence that are beyond the scope of code scanning. This is a development aid for identifying code-level control gaps, not a certification tool — consult a qualified auditor for formal certification.

Attestation

I, the undersigned, have reviewed the above assessment and confirm that:

1. The scope and limitations are understood.
2. The identified gaps will be addressed per the remediation plan.
3. Controls outside code scanning scope are managed through separate processes.
4. I confirm organizational commitment to establishing and maintaining an AI management system (AIMS) consistent with ISO/IEC 42001:2023.

Name: Dana Lee
Title: Chief Information Security Officer
Signature: ____________________
Date: ____________________