This document pre-answers common auditor evidence requests for ISO/IEC 42001:2023. Each section maps to a control and provides what we can demonstrate from automated code-level analysis, what requires additional organizational evidence, and supporting data.
Auditor may ask: "Show me your AI system impact assessment."
Evidence provided:
Additional evidence needed: This control requires organizational evidence: AI impact assessment documentation.
Auditor may ask: "Demonstrate responsible AI design and development practices."
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Auditor may ask: "Show me your AI system technical documentation."
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Auditor may ask: "Demonstrate AI system testing and validation processes."
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Organizational policy / process documentation.
Auditor may ask: "What are your defined AI system deployment criteria?"
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Organizational policy / process documentation.
Auditor may ask: "Show me your AI system event logging mechanism."
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Auditor may ask: "How do you ensure data quality for AI systems?"
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Organizational policy / process documentation.
Auditor may ask: "Demonstrate data provenance tracking for AI data."
Evidence provided:
Additional evidence needed: Remediation in progress — see the Gap & Remediation Plan. Expected closure: [ORG TO COMPLETE: Target remediation date].
Auditor may ask: "Show me your documented data preparation procedures."
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Organizational policy / process documentation.
Auditor may ask: "How do you control data acquisition for AI systems?"
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Auditor may ask: "How do you provide transparency about AI system use?"
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Auditor may ask: "What mechanisms exist for reporting AI system issues?"
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Organizational policy / process documentation.
Auditor may ask: "Show me your AI system use procedures."
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Human-oversight and AI-use procedures.
Auditor may ask: "How is human oversight of AI systems maintained?"
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Human-oversight and AI-use procedures.
Auditor may ask: "Show me your ongoing AI system monitoring process."
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Auditor may ask: "How do you control third-party AI components?"
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Auditor may ask: "Demonstrate AI supply chain security controls."
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Disclaimer: Code-level controls only. Coverage percentages reflect how many framework controls have matching RepoScope detectors. This is a development aid, not a certification tool — auditors make the final determination.
Note: Code-level AI management controls only. ISO/IEC 42001 requires organizational policies, risk assessments, and process evidence that are beyond the scope of code scanning. This is a development aid for identifying code-level control gaps, not a certification tool — consult a qualified auditor for formal certification.