Your computer and eiso: how data is created and kept, and how the functions connect (diagram) Expand
① Overview: what your computer and eiso each do
Your computer (or in-house server)
  • Create and keep basic data: records, results, inspections and measurement results from actual work
  • Current documents and forms: manuals, procedures, guidelines and forms
  • Keep outputs: Word and Excel files of eiso results (step folder\Output)
  • The original files are always held and managed by your company
Designate folders and filesThe text is read inside the browser and used only for AI writing. Files are not sent to the server, and the text read is not stored on the server.
Results on screenYou can use them directly as copy, Word, Excel, print or PDF.
Save to a folder on my computerAs Word and Excel files in the Output folder under the step folder in the folder you chose (Chrome and Edge).
Print and PDFUse the print window to print or choose "Save as PDF".
eiso (web and AI)
  • AI writing and analysis: creates the AI context analysis, risk assessment, impact assessment, statement of applicability, registers and audit results, and shows them on screen
  • Consent to save: your company chooses whether to save and where to save
  • Past work: find results saved in this browser (10 per step) by date and view them again
  • Company Workspace (optional): stored on the server, encrypted per company, with sharing, review and approval among staff members
② How to create folders on your computer (recommended)

You only need to do this once. The folders your company creates hold the original documents and records, and the Output folders are created automatically when eiso saves.

1Create one storage folder

In File Explorer (⊞ Win + E), open "Documents", the D: drive or an in-house shared folder, create a new folder (Ctrl + Shift + N) and name it eiso Storage Folder.

2Create your company's data folders

Inside it, create an AI Management System folder (an Information Security Management System folder if you operate only ISO/IEC 27001), and inside that, a 00_Documents folder and a folder for each step you operate, numbered (for example 01_AI Context Analysis).

3Choose it once in eiso

The first time you select "Save to a folder on my computer" in the operation results, choose the eiso Storage Folder, and allow the browser's request to view and save to the folder. From then on, it saves without asking.

How it looks when finished
  • Storage folder you choose once
  • Folders your company creates (original documents and records)
  • Folders eiso creates automatically when saving (Output)
  • eiso Storage FolderAnywhere: "Documents", the D: drive or an in-house shared folder
    • AI Management SystemYour original documents and records (Information Security Management System if you operate only ISO/IEC 27001)
      • 00_DocumentsManuals, procedures, guidelines, AI policy and statement of applicability (current versions): the folder read by 10 Documented Information Management
      • 01_AI Context AnalysisMaterials to designate for this step: business plan, AI system list, interested parties' opinions and so on
      • 09_Operational ControlThe master AI operational control register (Excel) and the original text of approved prompts (for example Prompts\AIP-QA-001_Rev2.1.txt): the register holds only location, revision number and fingerprint
      • … for each step you operate (numbered)
    • ICT Management System Operationeiso results
      • 05_AI Risk Assessment
        • OutputExample: AI Risk Assessment_Customer Support Chatbot_2026-10-22_143000.xlsx
      • … for each step you save
    • Management System Operation · Operational Data · Training MaterialsResults of other functions are also stored by function
Creating a new folder in Windows
  1. ① On the left, click where to put it (Documents, D: drive or a shared folder).
  2. ② At the top, click "New" › "Folder".
  3. ③ Type a name and press Enter.
What you doKeyboard
Open File Explorer⊞ Win + E
New folderCtrl + Shift + N
RenameF2
Copy and paste a step folderCtrl + C → Ctrl + V
Mac (Finder) new folder⌘ + Shift + N

Quick way: create one step folder (including forms and records), copy and paste it, and change only the names. If several people share it, place it on an in-house shared folder (NAS). If you already use a folder, do not create a new one; choose that folder.

③ What is kept where
MaterialWhere it is createdWhere it is keptRelationship with eiso
Basic data (AI system list, usage records, monitoring indicators, incidents, complaints)Your company's workStep folders on your computerWhen you operate, you designate the folder and eiso reads, processes and analyzes it (not stored on the server)
Current documents, AI policy and statement of applicabilityManagement System Establishment (eiso) → approved by your company00_Documents on your computerIn the Documented Information Management step, the list and revision history are organized
Original text of approved promptsYour companyOperational Control step folder on your computer (09_Operational Control\Prompts)eiso does not keep the original text; it records only the location, revision number and fingerprint (SHA-256) in the register
eiso results (analyses, assessments, registers, reports)eiso(AI)Screen → on consent to save: step\Output (Word and Excel) · saved copy in this browser · Company WorkspaceWhat is saved in this browser or the Company Workspace is carried over by the next step, and the copy saved in this browser can be viewed again in "Past work"
Content being enteredYour company (input fields)This browser (automatic, not stored on the server)Continue writing with "Load previous input"
④ The order for operating one step
  1. Accumulate basic data from your regular work (AI usage records, indicators, incidents and so on) in the step folder.
  2. In Operate, choose the operation standard and step, and designate that folder (or file).
  3. Click "Write with AI" and the result appears on screen. Review the content.
  4. Consent to save: choose among Save in this browser, Save to a folder on my computer and Save to Company Workspace (you do not have to save).
  5. If needed, distribute by print, PDF or Word, and next time find the work by date in "Past work" and view it again.
⑤ Download the follow-along material (PPT)

This is a 20-page guide to print and keep beside your computer and follow page by page (for ICT Management System Operation). The order is creating numbered folders (follow-along 1 to 8) → connecting with eiso (9 to 17) → checklist, and each page has a check box.
⬇ Download the follow-along PPT (20 pages, Korean, ICT)

On a shared PC, click "Clear all" in "Past work" when you finish. Saving to a chosen folder works in Chrome and Edge; other browsers save to the download folder. The folder names are recommendations; if you already use a folder, choose it as it is.

ICT Management System Operation (ISO/IEC 42001): operate the AI management system of an organization that uses AI in its work in 16 steps

In simple terms, this guide divides the work of planning and operating so that your company uses AI safely into 16 steps. In each step, AI writes a draft, and your company makes the final judgment and approval. The order follows the ISO/IEC 42001 implementation sequence: Plan (AI context analysis → selection of AI by task, project and department → AI system inventory → AI risk assessment → AI system impact assessment) → Do (control implementation and statement of applicability → verification and use approval → operational control (company-wide AI operational control register) → monitoring during use, change and revision management) → Evaluate and improve (internal audit → identification and monitoring of legal requirements → management review → corrective action → improvement).
The evaluation criteria have the same meaning in every step: the 6 axes for task selection (6 criteria for choosing tasks in which to use AI), the usage scope LEVEL (the scope in which AI is used, from individual 1 to company-wide 4), likelihood × severity (a score of 1 to 25 multiplying how likely something is by the damage), the 7 areas of impact assessment, and human oversight (the authority of people to correct and stop AI results). Details are in "Evaluation method" below.

This platform operates mainly on ISO/IEC 42001 and, if you wish, also operates ISO/IEC 27001 (information security) together on the basis of the statement of applicability (see "Standards operated together" below). It covers everything in the 16 steps below, from context analysis and objective setting to nonconformity and corrective action and improvement. The target standards of Management System Operation Guide do not include ISO/IEC 42001 or 27001. The initial establishment (manual and procedures) is done in Management System Documentation.

When operating two standards together: choose an operation method ISO/IEC 42001 (AI) · ISO/IEC 27001 (information security)

Choose only when operating ISO/IEC 42001 (AI) and ISO/IEC 27001 (information security) together. If you operate only one standard, you do not need to choose, and the guide below applies as it is. The two standards share the same Harmonized Structure (HS), so they can be operated together or separately for each standard. The operation guide and outputs below differ according to the method you choose. The usage fee is the same under either method.

Integrated operation Default
  • Uses the 16 steps once for both standards.
  • The inventory, risk register and operational register are kept as one, with the applicable standard marked on each line.
  • A statement of applicability is kept separately for each standard, and overlapping controls are implemented once using a correspondence table.
  • How to use each standard separately is added at the end of the result.
Suitable when: the same scope and the same responsible organization operate both standards together and are audited togetherView as integrated operation ›
Independent operation by standard
  • Choose one standard at a time and use the 16 steps of that standard.
  • Documents, registers, statements of applicability and results kept in this browser are separate for each standard.
  • ISO/IEC 27001 appears with information security names (information asset inventory, information security risk assessment and so on).
  • The other standard is referred to only through the control correspondence table.
Suitable when: the scope, responsible organization or certification timing differ by standard, or only one standard is operated firstView as independent operation by standard ›

If you do not choose, the integrated operation guide is shown.

View the operation guide in detail Scope · usage fee · division of roles · 16 operation steps · evaluation method Expand

Independent operation by standard: each standard is operated separately

The two standards are operated separately. In Operate, if you choose both standards and set the operation method to independent operation by standard, tabs for the operation platform of each standard (ISO/IEC 42001 · ISO/IEC 27001) appear, and each platform uses the 16 steps of that standard separately. If you choose a standard below, the detailed operation steps of that standard are shown.

  • Outputs and storage: document numbers, registers and statements of applicability are separate for each standard. Step results kept in this browser are also separate for each standard, so the results of one standard do not pass to a step of the other standard.
  • Between standards: overlapping controls are described in the control correspondence table only as "the same evidence can be used". Correspondence means related, not identical, so check each standard against its original text.
  • When operating only ISO/IEC 27001: because 6 Impact Assessment has no separate clause, write it briefly as "Not applicable (handled in the risk assessment)". The statement of applicability covers the 93 controls of Annex A.
  • Usage fee: the same as integrated operation. TBA for the first standard and TBA for each additional standard (1 year from the payment date, excluding VAT).
  • When switching to integrated operation: if you choose integrated operation above, the two standards are used in one flow. Because the results kept differ by method, paste in the results you need and continue.
Step name comparison (ISO/IEC 42001 ↔ ISO/IEC 27001) Expand
StepISO/IEC 42001 operation (AI management system)ISO/IEC 27001 operation (information security management system)
1AI Context AnalysisInformation Security Context Analysis
2AI Policy, Roles and Responsibilities, and ObjectivesInformation Security Objectives
3AI SelectionSelection of Scope Targets
4AI System InventoryInformation Asset Inventory
5AI Risk AssessmentInformation Security Risk Assessment
6AI System Impact AssessmentImpact Assessment (Not Applicable)
7Control ImplementationControl Implementation and Statement of Applicability
8Verification and Use ApprovalControl Implementation Verification and Approval
9Operational ControlOperational Register Management
10Documented Information ManagementDocumented Information Management
11Monitoring During UseInformation Security Monitoring and Change Management
12Internal AuditInternal Audit
13Identification and Monitoring of Legal RequirementsIdentification and Monitoring of Legal Requirements
14Management ReviewManagement Review
15Nonconformity and Corrective ActionNonconformity and Corrective Action
16ImprovementImprovement
View operation steps in detail: choose a standard (this changes together with the platform tabs in Operate)

ISO/IEC 27001 operation guide (independent operation by standard)

The ISO/IEC 27001 (information security management system) operation platform runs on the same 16-step framework as ISO/IEC 42001 operation, but in each step the names, tasks and outputs follow the body of ISO/IEC 27001:2022 and the 93 controls of Annex A. AI selection, AI impact assessment and AI use approval are not used on this platform. The AI instructions on the server follow the same criteria as below.

Scope: organizational, physical and logical boundaries: the scope of the information security management system (4.3) is defined by the boundaries of the organization (departments and sites), physical (buildings and server rooms) and logical (networks, systems and cloud), and also records interfaces and dependencies with other organizations (cloud services, outsourcing and suppliers). For parts left outside the scope, the reasons are recorded. Step 1 Information Security Context Analysis drafts the scope, and step 4 Information Asset Inventory collects the assets within that scope.
One cycle of information security management: identify information assets (step 4) → risk assessment (step 5: designate risk owners) → risk treatment and statement of applicability (step 7: 93 controls, approved by risk owners) → verify control implementation, and approve introduction and changes (step 8) → operational register management (step 9: access rights, backup, logs and patches) → monitoring and information security incident management (step 11) → internal audit (step 12) → management review (step 14) → corrective action and improvement (steps 15 and 16). When a significant change, incident, new threat or legal change occurs, return to step 5 and assess again (8.2).
Usage fee: platform pass TBA for 1 standard, TBA for each additional standard (excluding VAT): counted as the same operation pass as the ISO/IEC 42001 platform. If you choose ISO/IEC 27001 first, it is TBA; if you already have another operation standard, it is TBA. For 1 year from the payment date, you can use all 16 steps (within the daily number of AI writing requests). You do not pay in advance; the cost is shown when you click "Write with AI".

Division of roles: eiso plans, your computer holds basic data, and eiso performs the overall analysis

eiso: PlanYour computer: actual work and basic dataeiso: processing, analysis and synthesis of information
Creates the plans and criteria for each step, proposed changes to forms and documents (information asset inventory, risk assessment sheet, statement of applicability, operational register), and drafts of tables and checklists.While doing actual work with the changed forms, your company accumulates basic data (asset list, access rights review, backup test, log review, incident report) on your computer (or in-house server). No separate aggregation or analysis is needed.When you operate, designate the folder or file of that step; eiso reads it only inside the browser (not stored, not used for AI training), then processes, analyzes and synthesizes it and revises the plans and forms.
Recommended folder structure: what your computer does in each step and the basic data to designate to eiso Expand
StepRecommended folderWhat is done on your computer (basic data)Materials to designate during operation (analyzed by eiso)
1Information Security Management System\01_Information Security Context AnalysisOrganize the list of interested parties and requirements, the list of external dependencies (cloud and outsourcing), and the draft scopeOrganization chart, network diagram, list of sites, security clauses in customer contracts, existing ISO documents, previous audit and management review results
2Information Security Management System\02_Information Security ObjectivesHave the information security policy and topic-specific policies approved, then publish and distribute them; record indicator results against objectivesExisting policies and objectives, indicator results of the past period, management review decisions
3Information Security Management System\03_Selection of Scope TargetsCollect the information processed, systems and external links for each task and processDivision-of-duties chart, process list, information flow diagram, list of external links
4Information Security Management System\04_Information Asset InventoryMaintain the information asset inventory (reflecting new and retired assets); confirm owners and classificationAsset management register, system list, cloud contracts, license list
5Information Security Management System\05_Information Security Risk AssessmentDesignate risk owners; collect vulnerability inspection and incident recordsInformation asset inventory, vulnerability inspection results, incident and failure records, previous risk assessment sheet
6Information Security Management System\06_Impact Assessment (Not Applicable)(Not applicable)(Not applicable)
7Information Security Management System\07_Control Implementation and Statement of ApplicabilityApprove the statement of applicability and treatment plan (risk owner); designate those responsible for control implementationRisk assessment results, existing statement of applicability, list of policies and procedures
8Information Security Management System\08_Control Implementation Verification and ApprovalCollect evidence of control implementation (configuration screens, checklists, training records); records of approval of introduction and changesEvidence of implementation for each control, test and acceptance records, change requests
9Information Security Management System\09_Operational Register ManagementUpdate the operational register; periodic review of access rights; backup restoration tests; patch recordsSystem operation register, access rights list, backup and restoration test records, patch and vulnerability remediation records
10Information Security Management System\10_Documented Information ManagementKeep current versions of documents in the 00_Documents folder and treat old versions as obsoleteThe entire Information Security Management System\00_Documents folder
11Information Security Management System\11_Information Security Monitoring and Change ManagementLog review and indicator measurement records; incident reporting and handling recordsLog review records, indicator results, information security incident register, change management records
12Information Security Management System\12_Internal AuditConfirm the audit schedule and auditors; prepare audit recordsOrganization chart, statement of applicability, risk assessment results, previous audit results, audit records
13Information Security Management System\13_Identification and Monitoring of Legal RequirementsMaintain the register of legal and contractual requirements; compliance check recordsLegal register, security clauses in customer contracts, personal information processing status, compliance inspection records
14Information Security Management System\14_Management ReviewHold the management review meeting; prepare the minutes9.3.2 inputs (results for indicators, audits, incidents, risks and objectives), status of actions from the previous management review
15Information Security Management System\15_Nonconformity and Corrective ActionRecords of corrective action implementation and effectiveness confirmationAudit findings, incident reports, corrective action register
16Information Security Management System\16_ImprovementRecords of implementation and effect confirmation of improvement tasksManagement review decisions, corrective action results, indicator trends
Operation steps Expand

Operation steps

The sixteen steps are connected to one another. The result of an earlier step becomes the input of the next step (for example, information asset inventory → risk assessment → risks requiring treatment → statement of applicability and treatment plan). Choose the step you are going to carry out now and click it. You may use a single step on its own; if this is your first time, proceed in order starting from 1 Information Security Context Analysis. Because this standard has no clause for 6 Impact Assessment, only "Not applicable" is written.

Tasks and outputs by step Expand
StepClauseWhat you doOutput (example)
1 Information Security Context Analysis4.1 · 4.2 · 4.3 · 4.4 (Amd 1:2024)External and internal issues (cyber threat trends, dependence on cloud and outsourcing, laws and contracts, technology change, judgment on the relevance of climate change), interested parties and their requirements, which of these the information security management system will address (4.2 c), scope: the boundaries of organization, sites, networks, cloud and outsourcing and the interfaces and dependencies with other organizations (4.3 c), the scope document (draft), and processes and their interactions (4.4)."Interested parties", "Internal and external issues", "Scope (draft)" (boundaries, interfaces, dependencies, and excluded parts with reasons), "Process map".
2 Information Security Objectives5.1 · 5.2 · 5.3 · 6.2 · 6.3 · A.5.1 · A.5.2 · A.5.4Information security policy (draft): checked against a) to d) of 5.2 (appropriate to the purpose of the organization, framework for objectives, commitment to satisfy requirements, commitment to continual improvement) and e) to g) (documented, communicated, available to interested parties), list of topic-specific policies (A.5.1: access control, asset management, cryptography, backup, incident management, suppliers, remote working, acceptable use and so on), roles, responsibilities and authorities (5.3 · A.5.2: information security manager, performance reporting system), no more than 3 information security objectives (6.2: consistent with the policy, measurable, reflecting risk assessment and treatment results, monitored, communicated and updated; achievement plan: what, resources, who is responsible, deadline and evaluation method), and planning of changes to the management system (6.3)."Information security policy (draft)" (including the 5.2 comparison table), "Topic-specific policies", "Roles, responsibilities and authorities", "Information security objectives and achievement plan".
3 Selection of Scope Targets4.3 · 4.4 · A.5.12 · A.5.14For each task and process within the scope, organize the information processed (type, classification level, whether personal information is included), the systems and services used, information transfer routes and external interfaces (customers, suppliers and cloud; A.5.14 information transfer), and the importance of the task and availability requirements, to decide the targets of the information asset inventory and risk assessment. The 6-axis evaluation for AI selection is not used."Target tasks and processes".
4 Information Asset InventoryA.5.9 · A.5.10 · A.5.11 · A.5.12 · A.5.13 · A.5.23 · A.5.34 · 6.1.3Information and associated assets (information, software, hardware, services (including cloud), people and facilities), one line per asset, with owner (A.5.9), classification (A.5.12: the level criteria are set first), labelling (A.5.13), acceptable use (A.5.10), return (A.5.11), cloud services (A.5.23), and whether personal information is included (A.5.34). Decide whether risk assessment will be done by group of assets. Draft the statement of applicability (Rev.0.1) from the 93 controls of Annex A, making only a first judgment of "applicable / under review / excluded (proposed)" (finalized in step 7)."Information asset inventory", "Classification criteria", "Draft statement of applicability".
5 Information Security Risk Assessment6.1.1 · 6.1.2 a)~e) · 8.2First, risk criteria: a) define the risk acceptance criteria and the criteria for performing assessments (consequence and likelihood scales, level calculation, criteria for requiring treatment); c) identify, for each asset (or scenario), the risks associated with loss of confidentiality, integrity and availability of information within the scope, and determine the **risk owner**; d) analyse the consequences, likelihood and level; and e) compare them with the acceptance criteria to set treatment priorities. Existing controls (Annex A numbers) are recorded to avoid duplicate treatment, and opportunities (6.1.1) are recorded separately. 8.2: reassess at planned intervals and when significant changes occur."Risk criteria" (scale tables and acceptance criteria), the sheet (information security risk assessment, likelihood x impact formula), "Opportunities", and "Summary of risks requiring treatment" (R number, risk owner, level).
6 Impact Assessment (Not Applicable)(No separate clause. Handled under 6.1.2 d) analysis of results.)ISO/IEC 27001 has no impact assessment clause. State briefly "Impact assessment: not applicable" with the reason, and where in 5 Risk Assessment the risks with large consequences for people and customers (such as personal information leakage) were addressed. Whether a statutory personal information impact assessment (for public institutions, etc.) applies is "to be confirmed"."Impact assessment: not applicable" (reason and linked risk R numbers).
7 Control Implementation and Statement of Applicability6.1.3 a) to f) · 8.3 · Annex Aa) treatment option for each risk (reduce, avoid, transfer, accept); b) determine the necessary controls (from any source); c) compare the determined controls with the 93 controls of Annex A to confirm that no necessary control has been omitted; d) the **Statement of Applicability**: necessary controls, justification for inclusion (risk R number, law, contract, policy), implementation status, and justification for excluding Annex A controls (one line for each of the 93); e) risk treatment plan; f) approval of the treatment plan and acceptance of residual risks by the risk owners. If your company has provided its decision for each control (applicable or excluded) in the request or in your company materials (a Statement of Applicability file), that decision is the correct answer and the document is written as a final version (Rev.1.0); if not, it is written as a proposed version (Rev.0.x, with the "Customer decision" column left blank). Control numbers and names follow Annex A of ISO/IEC 27001:2022 exactly (to be confirmed if uncertain)."Statement of Applicability", "Risk treatment plan", "Request for acceptance of residual risks".
8 Control Implementation Review and Approval8.1 · 8.3 · A.5.8 · A.8.25~A.8.29 · A.8.32For each control in the treatment plan, determine the evidence and the method of verifying effectiveness to confirm implementation, and judge the result (implemented, partial, not implemented); where insufficient, record the action and deadline. For the introduction of and changes to new systems and services, the approver approves after confirming information security requirements (A.5.8 Information security in project management; A.8.26 Application security requirements), testing and acceptance (A.8.29) and change management (A.8.32). 8.1: processes, products and services provided externally are also subject to control."Control implementation check" and "Introduction and change approval record".
9 Operations Register ManagementA.5.9 · A.5.15~A.5.18 · A.5.23 · A.8.2~A.8.6 · A.8.8 · A.8.9 · A.8.13 · A.8.15 · A.8.32Group the operations register of information processing systems and services according to the "operations register classification" (department, division, project, site). For each system, record the owner, granting and periodic review of access rights (A.5.15 to A.5.18; A.8.2 to A.8.5), configuration (A.8.9), capacity (A.8.6), backup and restore testing (A.8.13), log retention (A.8.15), technical vulnerabilities and patches (A.8.8), cloud services (A.5.23), change history (A.8.32) and the next review date. If a register already exists, keep its numbers and write "Updates in this revision". The revision numbering rule Rev.N.M is the same as for the ICT operations register."Operations register", "Access rights review", and "Check results" (review deadline passed, backup not tested, etc.).
10 Documented Information Management7.5.1 · 7.5.2 · 7.5.3 · A.5.37Without writing new documents, organize the document list, old versions and duplicates using the current versions in your company folder (Information Security Management System\00_Documents), and check the documented information required by ISO/IEC 27001: 4.3 scope, 5.2 policy, 6.1.2 risk assessment process, 6.1.3 risk treatment process, 6.1.3 d) Statement of Applicability, 6.1.3 e) treatment plan, 6.2 objectives, 7.2 evidence of competence, 7.5.1 b) documented information determined by the organization as necessary, 8.1 operational planning and evidence of controls, 8.2 risk assessment results, 8.3 treatment results, 9.1 monitoring and measurement results, 9.2 audit program and results, 9.3 management review results, and 10.2 nonconformities and corrective actions; plus the documents required by controls marked "applicable" in the Statement of Applicability (documented operating procedures A.5.37, etc.). Missing documents are referred to "to be prepared in Management System Establishment"."Document list" (current Rev, approval date, owner, retention), "Check of required documented information", and "Reference documents by process" (for each of the 16 steps).
11 Information Security Monitoring and Change Management9.1 · A.5.7 · A.5.24~A.5.28 · A.6.8 · A.8.8 · A.8.15 · A.8.16 · A.8.329.1: determine what is to be monitored and measured, the methods, when, by whom, and when the results are analysed and evaluated and by whom (information security performance and effectiveness of the management system), and analyse the results. Information security incident management: reporting (A.6.8) → assessment and decision (A.5.25) → response (A.5.26) → evidence collection (A.5.28) → lessons learned (A.5.27), with planning and preparation (A.5.24). Logging (A.8.15), monitoring activities (A.8.16), change management (A.8.32), technical vulnerabilities (A.8.8) and threat intelligence (A.5.7). Only incidents that are nonconformities are passed to 15. Statutory reporting and notification deadlines are "to be confirmed"."Measurement indicators", "Information security incident register" and "Change management records".
12 Internal Audit9.2.1 · 9.2.2 (see ISO 19011 and ISO/IEC 27007)The audit program (frequency, methods, responsibilities, planning requirements and reporting, reflecting the results of previous audits); the criteria and scope of each audit; selection of auditors (objectivity and impartiality, no auditing of one’s own work); a checklist for each unit (main clauses 4 to 10 plus the Annex A controls marked "applicable" in the Statement of Applicability: excluded controls are not asked about; see ISO/IEC TS 27008 for control assessment); and the tracing sequence (risk assessment → treatment plan and Statement of Applicability → evidence of control implementation: access rights reviews, backup restore tests, logs, patches, incident handling records). Reports are written only from actual audit records."Audit program", "Checklist by department", and, for a report, "Findings" (recording the main clause and Annex A together).
13 Legal Requirements Identification and Monitoring4.2 · A.5.31 · A.5.32 · A.5.33 · A.5.34 · A.5.35 · A.5.36Identify legal, regulatory and contractual requirements (A.5.31) and record them in a register: personal information protection, information and communications network and cyber intrusion response, notices on electronic finance and cloud (given as information security and personal information results; only statute names are stated, and articles and effective dates are to be confirmed), contractual security requirements (customer security pledges, SLAs, cloud terms), intellectual property rights (A.5.32), protection of records (A.5.33) and privacy and protection of PII (A.5.34). Compliance checks: compliance with policies, rules and standards (A.5.36) and independent review of information security (A.5.35). AI regulations are outside the scope of this standard and are not recorded (if your company uses AI, they are covered under ISO/IEC 42001 operation)."Register of legal and contractual requirements", "Compliance check" and "Changed regulations and action plan".
14 Management Review9.3.1 · 9.3.2 a)~g) · 9.3.39.3.2 inputs: a) status of actions from previous management reviews; b) changes in external and internal issues; c) changes in the needs and expectations of interested parties; d) information security performance (nonconformities and corrective actions, monitoring and measurement results, audit results, fulfilment of information security objectives); e) feedback from interested parties; f) results of risk assessment and status of the risk treatment plan; g) opportunities for continual improvement. Summarize each item ("insufficient" if none). 9.3.3 results: document decisions on opportunities for improvement and any need for changes to the management system."Management review inputs" (a to g), "9.3.3 decisions" and "Follow-up action register".
15 Nonconformity and Corrective Action10.2 a)~g) · A.5.27For each nonconformity: a) reaction (control and correct it, deal with the consequences); b) evaluate the need for action to eliminate the cause (review, root cause, similar nonconformities); c) implement the action; d) review its effectiveness; e) change the management system if necessary; and document it. Distinguish information security incidents from nonconformities (not every incident is a nonconformity), and feed lessons learned from incidents (A.5.27) back into updates of the risk assessment (5) and the Statement of Applicability (7). Record the main clause and the Annex A control together in the findings."Nonconformity and corrective action register".
16 Improvement10.1 · 9.3.3Continually improve the suitability, adequacy and effectiveness of the information security management system: collect improvement opportunities (management review decisions, audit observations, incident trends, threat trends, technology changes) as tasks and link them to the information security objectives (6.2). Do not mix this with eliminating the causes of nonconformities (corrective action)."List of improvement opportunities", "Improvement task register" and "Proposal for next-year operation and objective adjustments".
Evaluation method (common to all steps) Expand
  • Risk criteria (6.1.2 a): Risk acceptance criteria and criteria for performing risk assessments are set first in Step 5 and used by every step. If your organization has no criteria, use this example: consequence (impact, 1 to 5) × likelihood (1 to 5) = 1 to 25; 1 to 6 low · 7 to 12 medium · 13 to 19 high · 20 to 25 critical; 6 or below is accepted, 7 or above requires treatment.
  • Judging consequence (impact): Consider the effect of a loss of confidentiality, integrity and availability on the business, legal requirements, customers and reputation separately, and use the highest value (state which attribute it is).
  • Risk identification method: Use either an asset-based method (assets · threats · vulnerabilities) or a scenario-based method, whichever suits your organization. The standard does not prescribe a method (see ISO/IEC 27005:2022). Record existing controls to avoid duplicated treatment.
  • Risk owner (6.1.2 c): Assign for each risk a person with the responsibility and authority to manage it. The risk owner approves the treatment plan and accepts the residual risk (6.1.3 f).
  • Treatment options: reduce (apply controls) · avoid (stop the activity) · transfer (insurance, outsourcing contract) · accept.
  • Statement of Applicability (6.1.3 d): One line for each of the 93 Annex A controls (organizational A.5: 37 · people A.6: 8 · physical A.7: 14 · technological A.8: 34): the control needed, the justification for inclusion (risk number, law, contract, policy), implementation status, and the justification for exclusion. For control attributes (preventive, detective, corrective; confidentiality, integrity, availability), see ISO/IEC 27002:2022.
  • Information classification (A.5.12): Example: public · internal · confidential · top secret. If your organization has classification criteria, use them. The classification level determines labelling (A.5.13), transfer (A.5.14) and access rights (A.5.15).
  • Triggers for reassessment (8.2): planned intervals (at least once a year is recommended), significant changes (systems, organization, suppliers), information security incidents, new threats or vulnerabilities, changes in laws or contracts.
  • Audit judgement: conformity · observation · minor nonconformity · major nonconformity. Record both the main clause and the Annex A control in each finding.

Operate on the ISO/IEC 27001 Operation Platform ›

ISO/IEC 42001 operation steps in detail (operated independently for each standard)

The scope, the 16 operation steps, the relationship diagram and the evaluation method below are guidance for the ISO/IEC 42001 (AI management system) operation platform. They are not mixed with ISO/IEC 27001 documents and ledgers. Go to the ISO/IEC 42001 Operation Platform ›

Scope: development · supply · use: The scope of an AI management system is broadly divided into development, supply and use. If you choose it before the operation steps in Operate below (more than one is allowed), the chosen scope applies to all 16 steps. The scope statement (4.3), AI inventory, priority risks, Annex A controls, items requiring approval, monitoring, change and revision control, and internal audit are all adapted to the roles you choose. Each step page has a table "What to do in this step, by scope".
DevelopmentSupplyUse
Design, develop, train and test AI systems and models (in-house development, development commissioned by customers)Provide AI products and services to customers (selling in-house products, integrating and reselling external AI)Use external or in-house AI in work and projects (generative AI, vision inspection, prediction models, etc.)

Standards operated together: based on the Statement of Applicability (SoA)

ISO/IEC 42001 and ISO/IEC 27001 both follow the Harmonized Structure (HS) and have the same operating structure: list of targets → risk assessment (6.1.2) → risk treatment, Annex A controls and Statement of Applicability (6.1.3) → operation (Clause 8) → monitoring, internal audit and management review. So if you also choose ISO/IEC 27001 under "Standards to operate", the 16 steps run as one flow.

  • Keep a separate Statement of Applicability for each standard, because certification scope and audits are separate for each standard (ISO/IEC 42001 Annex A: 38 controls; ISO/IEC 27001:2022 Annex A: 93 controls).
  • Overlapping controls are grouped in a control mapping table and implemented once, and the same evidence is recorded in both Statements of Applicability. A mapping means "related", not "identical", so compare the depth of requirements of each standard against the original text.
  • The output of Step 7 Control Implementation and Statement of Applicability includes the control mapping table and a Statement of Applicability sheet for each standard. The risk register, internal audit and management review are kept as one, with the applicable standard stated on each line.
  • The usage fee is charged for each standard: TBA for one standard, and TBA for each additional standard (excluding VAT).
Control mapping table (ISO/IEC 42001 Annex A ↔ ISO/IEC 27001:2022 Annex A) Expand
ISO/IEC 42001 controlContentISO/IEC 27001:2022 Annex A (related controls)
A.2.2AI policyA.5.1 Policies for information security
A.3.2AI roles and responsibilitiesA.5.2 Information security roles and responsibilities · A.5.3 Segregation of duties
A.3.3Reporting of concernsA.6.8 Information security event reporting
A.4.2~A.4.6Documentation of AI system resources (data, tools, computing, people)A.5.9 Inventory of information and other associated assets · A.5.12 Classification of information · A.6.3 Information security awareness, education and training
A.5.2~A.5.5AI system impact assessment (individuals, groups, society)— (in the 6.1.2 risk analysis)
A.6.1.2·A.6.1.3Objectives and processes for responsible developmentA.8.25 Secure development life cycle · A.8.27 Secure system architecture and engineering principles
A.6.2.2·A.6.2.3AI requirements and designA.5.8 Information security in project management · A.8.26 Application security requirements
A.6.2.4Verification and validationA.8.29 Security testing in development and acceptance
A.6.2.5DeploymentA.8.31 Separation of development, test and production environments · A.8.32 Change management
A.6.2.6·A.6.2.8Operation, monitoring and event logsA.8.15 Logging · A.8.16 Monitoring activities
A.6.2.7Technical documentationA.5.37 Documented operating procedures
A.7.2~A.7.6Data (development, acquisition, quality, provenance, preparation)A.5.12 Classification of information · A.5.34 Privacy and protection of PII · A.8.11 Data masking · A.8.33 Test information
A.8.2System documentation and information for users—
A.8.3·A.8.4External reporting and incident communicationA.5.24 to A.5.26 Incident management · A.5.5 Contact with authorities
A.8.5Provision of information to interested partiesA.5.5 Contact with authorities · A.5.6 Contact with special interest groups
A.9.2~A.9.4Responsible use and intended useA.5.10 Acceptable use of information and other associated assets
A.10.2Allocation of responsibilities (third parties)A.5.19 Information security in supplier relationships · A.5.20 Addressing information security within supplier agreements
A.10.3SuppliersA.5.19 to A.5.23 Suppliers, ICT supply chain and cloud services
A.10.4CustomersA.5.20 Addressing information security within supplier agreements (agreements with customers)
One cycle of AI management: for each task, project and division: select the AI needed (Step 3) → risk assessment (Step 5; impact assessment in Step 6 for high risk) → controls (SoA and human oversight, Step 7) → use approval (Step 8: not used before approval) → monitoring during use → change control (before changing the model, instructions, data or supplier: impact review, revalidation and approval) → revision control (versions and revision history of the inventory, risk assessment sheet, SoA, guidelines and model) (Step 11). When a trigger for reassessment (change, incident, legislation) arises, return to Step 5.
Usage fee: platform pass TBA for one standard, and TBA for each additional standard (excluding VAT): For each standard chosen, you use all 16 steps for one year from the payment date (within the daily number of AI writes). It is counted together with Management System Operation: if you already have a Management System Operation standard, an ICT standard costs TBA; if the first standard ends first and only additional standards remain, an additional TBA is charged on the additional standard chosen first to convert it to the base standard. No payment is made in advance. When you press "Write with AI", the cost is shown; if you agree, you pay on the spot and then continue writing.

Division of roles: eiso plans, your computer holds basic data, and eiso performs the overall analysis

eiso: PlanYour computer: actual work and basic dataeiso: processing, analysis and synthesis of information
Creates plans and criteria for each step, form and document change proposals (AI system inventory, risk assessment sheet, Statement of Applicability, guidelines), and drafts of tables and checklists.Do your actual work with the changed forms, and accumulate basic data (AI list, assessment results, test records, monitoring logs, incident reports) on your own computer (or in-house server). You do not need to compile or analyse it separately.When you operate, designate the folder or file of that step; eiso reads it only inside the browser (not stored, not used for AI training), then processes, analyzes and synthesizes it and revises the plans and forms.
Recommended folder structure: what your computer does in each step and the basic data to designate to eiso Expand
StepRecommended folderWhat is done on your computer (basic data)Materials to designate during operation (analyzed by eiso)
1AI Management System\01_AI Context AnalysisCompile a list of interested parties (name, internal/external, expectations, related laws and contracts), a list of AI systems (name, intended purpose, development, purchase, use, affected parties), and a draft AIMS scopeThis year's business plan, previous year's management analysis and KPI results, material on strengths and weaknesses, customer requirements and AI clauses in contracts, organization chart, existing ISO documents, internal audit and management review results
2AI Management System\02_AI Policy, Roles and Responsibilities, and ObjectivesObtain approval for the AI policy and AI objectives, publish and distribute them, and record the results of the objective indicators (monthly, quarterly) in the designated formBusiness plan, existing AI policy and objectives, KPI results of the past period, management review decisions (results of earlier steps are carried over automatically through step sharing in this browser)
3AI Management System\03_AI SelectionGather, for each project, department, division and process, the work and its current bottlenecks and the tasks for which you want to use AIDivision of duties table, organization chart, project list, process map, information classification criteria, list of AI currently in use (operation control ledger)
4AI Management System\04_AI System InventoryRegister every AI service, subscription and in-house model without omission, and correct the entries when they changeList of AI services and subscriptions, system configuration diagram and data flow, previous inventory
5AI Management System\05_AI Risk AssessmentKeep the division of duties table, project (AI task) list and organization chart up to date, carry out risk treatment actions, and record errors and incidentsDivision of duties table, project (AI task) list, organization chart, previous risk assessment ledger, generative AI usage guidelines and current Statement of Applicability, error and incident records, supplier information
6AI Management System\06_AI System Impact AssessmentCarry out mitigation actions and conduct bias and performance testsRisk assessment results, bias and performance test results, privacy impact assessment material, opinions of interested parties
7AI Management System\07_Controls and SoAReflect the controls in in-house guidelines and procedures, and keep records of implementationStep 5 risk assessment results (retrieved automatically in this browser), current Statement of Applicability, in-house AI guidelines, AI clauses in contracts, list of legal requirements, competence criteria by job
8AI Management System\08_Verification and Use ApprovalCarry out testing and validation, and keep use approval and dataset recordsTesting and validation records, use approval records, dataset list and provenance material
9AI Management System\09_Operational ControlKeep the master ledger on your own computer (or in-house server), correct the relevant line at every approval, distribution and change, and store the original text of prompts by version in the designated folderAI operation control ledger currently in use (Excel), results of Steps 4 to 8 and approval records, list of prompts and programs
10AI Management System\10_Documented Information ManagementKeep the manuals, procedures, guidelines and forms received from Management System Establishment as current versions in the AI Management System\00_Documents folder, move old versions to the obsolete folder beneath it, and fill in the document number, Rev. and approval fields on the coverThe entire AI Management System\00_Documents folder, the previous document list, the list of documents of external origin (standards, laws, supplier documents)
11AI Management System\11_Monitoring, Change and RevisionMeasure the indicators and collect logs, and record change requests, revision history, incidents and trainingMonitoring logs and indicator values, change requests and approvals, revision history, incident reports, training completion records
12AI Management System\12_Internal AuditCarry out the audit, and record the checklist results, evidence and findingsOrganization chart, division of duties, AI certification scope, status of AI utilization tasks, AI policy, Statement of Applicability, risk and impact assessment results, document list, previous audit results and audit records
13AI Management System\13_Legal Requirements Identification and MonitoringAccumulate records of legal checks and implementation records (notice, consent, training, impact assessment), and update the register every half yearPrevious AI legal requirements register, implementation records and evidence (notice screens, consent records, training records, impact assessment reports), contracts, terms of use, DPA, in-house AI guidelines
14AI Management System\14_Management ReviewHold the management review meeting and carry out the decisionsSummary of the results of each step, minutes of the previous management review, status of corrective actions, performance indicators
15AI Management System\15_Nonconformity and Corrective ActionCarry out corrective actions, and record the supporting evidence and the results of effectiveness checksInternal audit report and findings (results of Step 12 are carried over automatically), Step 13 legal compliance check results, incident reports, previous corrective action records
16AI Management System\16_ImprovementCarry out improvement tasks and record the effect (indicators before and after)Management review decisions, corrective action results, observations and improvement recommendations, trend of monitoring indicators, opinions of interested parties
Operation steps Expand

Operation steps

The sixteen steps are linked to one another. The output of an earlier step becomes the input of the next (for example: AI system inventory → risk assessment; high risk of 13 points or more → impact assessment → Statement of Applicability). Choose and press the step you want to carry out now. You may use a single step on its own; if you are starting, go in order from 1 AI Context Analysis. If you use two or more, the results stored in this browser are carried over to the other steps.

Tasks and outputs by step Expand
StepClauseWhat you doOutput (example)
1 AI Context Analysis4.1~4.4Covers Clause 4 (context of the organization) of ISO/IEC 42001 in one output: interested party analysis (4.2, with separate rows for those affected by AI) → external issues PESTEL and internal issues (4.1) → SWOT and cross strategies (with traceable source IDs) → strategy action plan (priority, KPI, owner, deadline, budget, funding) → CEO and CFO review → linkage table to 6.1, 6.2 and 9.3.
If your organization enters the interested parties directly, they are used as they are and only the blanks are supplemented; if left blank, a general list (organization to confirm) is used. External trends and AI trends for your industry are researched on the web (with sources and reference date), and internal strengths and weaknesses are taken only from your organization's materials. Only the sections of the analysis methods you choose (SWOT, PESTEL, 7M) are written.		Interested party analysis table (ID, AI role, needs, expectations, related requirements, whether addressed by the AIMS, impact × interest management strategy, monitoring, linked clauses), entered directly or from the general list
PESTEL, internal issues (ID, basis, reference date), SWOT (source IDs), cross strategies (SO, ST, WO, WT), strategy action plan, CEO and CFO review; the main tables are also provided in Excel
Judgement on the relevance of climate change (AI computing energy and carbon), linkage table (6.1 risks and opportunities → 5 AI Risk Assessment, 6.2 AI objectives, 9.3 management review inputs), review, approval and revision cycle, and items to be confirmed
2 AI Policy, Roles and Objectives5.1·5.2·6.2Based on the results of 1 AI Context Analysis, 4 AI System Inventory, 5 AI Risk Assessment, 6 AI System Impact Assessment, 12 Internal Audit and 15 Nonconformity and Corrective Action, and on the folders and files you designate (business plan, existing policy, objectives, KPI results), the AI policy (5.2) and AI objectives (6.2) are set.
Objectives are chosen with emphasis on effectiveness and efficiency, no more than three, and for each objective the indicator, target value and achievement plan (what will be done, resources, responsibility, completion date, evaluation method) are set. The output is one Word document in the standard format, "AI Policy and AI Objectives", and by OBJ number it is carried over by 3 Selection, 5 Risk Assessment, 7 Controls, 11 Monitoring, 14 Management Review and 16 Improvement.		"AI Policy and AI Objectives" Word document: cover (document number, Rev., prepared, reviewed, approved), purpose, scope and related documents, AI policy (checked against 5.2 a) to d))
No more than three AI objectives (OBJ · effectiveness/efficiency · Annex C · source step ID · indicator, baseline and target values · frequency · responsibility · deadline) and the objective achievement plan, linkage between objectives and processes
Monitoring and reporting, communication and awareness, candidate objectives not chosen and the reasons, revision history and items to confirm
3 AI System Selection4.1·6.1·8.1From the designated folders and uploaded files (division of duties table, organization chart, project list, process map), all work within the scope (including customary work) is identified by project, department, division and process; P1, P2 and P3 are set on six axes (repetition frequency, judgement difficulty, cost of error, data confidentiality level, AI impact, need for human oversight); and only work at or above the criterion score is selected using the selection criteria (100 points: repetition frequency, judgement difficulty, expected effect, cost of error, confidentiality level, existing AI use).
For each selected task, AI already in operation is looked for first and applied in the order of extending as is → reusing a derivative → new development, and the introduction priority and schedule (batch, start, completion, owner) are drawn up. The output is the Excel "AI Selection Table" maintained by unit; only the selected tasks become the input of 4 Inventory (5 Risk Assessment takes over from the inventory), and when work or practices change, upload that file to update it (change history).		Excel "AI Selection Table": task list (division of duties) · AI six-axis evaluation · review of existing AI use · introduction priority · schedule sheets
Order of promotion: P1 extend as is → P1 reuse derivative → P2 extend as is → P1 new development → P2 derivative and new, P3 on hold
Monthly promotion schedule and promotion system (check of existing AI utilization rate and completion rate) → input to Step 4
4 AI System Inventory4.3·A.4·A.6Register the AI systems you use (or plan to use) together with purpose, AI role, supplier, model, input data, parties affected by output and scope of use (LEVEL 1 individual to 4 company-wide), and determine the assessment type (excluded, simplified, full) and scope.
Using the inventory and the chosen scope (AI role), a draft Statement of Applicability (Rev.0.1) with the first-pass applicability of the 38 Annex A controls is prepared together, so that 5 Risk Assessment selects controls on this basis. Centering on the tasks selected in Step 3, the AI systems and tasks in use or planned are registered with purpose, AI role, supplier, model, input data, parties affected by output and scope of use (LEVEL 1 to 4); with the assessment criteria your organization has reviewed, the assessment type (full, simplified, excluded) and scope are set, and passed on as input to 5 Risk Assessment, 6 Impact Assessment and 7 Statement of Applicability.		AI system inventory: purpose / role / supplier and model / data / affected parties / LEVEL / assessment type and basis / status
Scope judgement: inclusion or exclusion and basis
Missing information and items to confirm
5 AI Risk Assessment6.1.2·6.1.3·8.2·8.3Taking the Step 4 AI System Inventory as input, every AI system and task whose assessment type is full or simplified and that falls within the scope is assessed without omission. The assessment type (full, simplified, excluded) is set, risks in six categories (cause → event → consequence) are assessed by likelihood × severity (1 to 25, with the severity axis noted), and the treatment option, basis controls, comparison with the Statement of Applicability and the risk level after treatment are set. The results become the input of 6 Impact Assessment and 7 Control Implementation and Statement of Applicability.Reconciliation summary (input N = assessed M + excluded K) and consolidated register; for each task: assessment unit · LEVEL · assessment type · highest risk · risk level · grade · impact assessment · reassessment trigger
Risk details and treatment plan (Excel): cause → event → consequence / 23894 source and objective / severity axis / treatment option · basis controls · comparison with the Statement of Applicability / risk level after action
Targets of impact assessment (to Step 6) · linkage to the Statement of Applicability (to Step 7) · auditor-perspective self-check (NC and OFI candidates)
6 AI System Impact Assessment6.1.4·8.4·A.5Assesses the impact of high-risk AI systems (13 points or more) on individuals, groups and society in seven areas (safety, fairness, transparency, privacy, security, human oversight, society and environment), and determines approval, conditional approval or hold, and the deployment conditions.AI system impact assessment report: for each of the seven areas high / medium / low / basis / affected people and groups / mitigation actions
Overall judgement (approval, conditional approval, hold) and deployment gate conditions
Notice to interested parties and plan for gathering opinions
7 Control Implementation and Statement of Applicability (SoA)6.1.3 · Annex A and BTaking the Step 5 risk assessment results (basis controls and comparison with the Statement of Applicability in the treatment plan) as input, the Annex A controls chosen in risk treatment are justified in the Statement of Applicability (SoA), and human oversight (authority to review, intervene and override), legal requirements and compliance obligations, and resources and competence for AI systems are designed. By combining the Step 4 draft Statement of Applicability, the basis controls of the Step 5 treatment plan and the Step 6 impact assessment mitigation actions, all 38 controls are finalized (Rev.1.0, approved by top management), and Steps 8 to 16 add implementation status and evidence to this finalized version.Statement of Applicability (SoA): for each Annex A area (A.2 to A.10), reasons for applying or excluding / implementation method / related documents and records
Human oversight design table: oversight method / person with override authority / point of intervention / route for reporting concerns
List of legal requirements and compliance obligations, plan for resources and competence (targets of awareness training)
8 Verification and Use Approval8.1·A.6·A.7Through review, verification and validation (V&V), it is confirmed that the AI fits the requirements and intended use, and after confirming control implementation, the approver for the grade approves use (not used before approval; for high risk, after the impact assessment is complete). Controls by life cycle stage and the management of training and operation datasets are also set.Use approval record: applicable task, project and division / risk level / impact assessment / control implementation / V&V results / approval conditions and use restrictions / approver / next reassessment
Plan for review, verification and validation, and deployment gate criteria
Table of controls by life cycle stage, and register of training and operation datasets
9 Operational Control7.5·8.1·A.4·A.6·A.9Approved AI use programs (instructions and prompts, custom GPTs, automations, API integrations, in-house models) are gathered company-wide in one AI operation control ledger. Your organization chooses how to divide the ledger (by department, division, project or site, or by direct entry); each program is given a number and version, and the important content of every stage of the life cycle is linked in one line: registration → risk assessment → control method → review → approval → deployment → monitoring → change history → suspension and disposal. We either compile the ledger from the results of Steps 4 to 8, or, if you designate the ledger file you use, reflect the new results and produce an updated version (Excel).AI operation control ledger (Excel): summary sheet / program register (category, number, version, status) / risks and controls / review and approval / deployment / monitoring / change history / code table
Ledger operating rules: master owner, update timing (approval, deployment, change, incident), how to assign versions, location for storing original prompts
List of blank fields, use before approval and items needing reassessment, and next actions
10 Documented Information Control7.5Manuals, procedures, guidelines and forms are created in eiso's "Management System Establishment" and kept in the designated folder on your computer (recommended: AI Management System\00_Documents). This step reads that folder to build a document list, identifies the latest version (current version) among several versions of the same document and organizes the revision history, and tells you the related reference documents for each of the 16 step processes. It does not write new documents; missing mandatory documents are passed on to Management System Establishment to be written.AIMS document list (Excel): document number · name · type · current Rev. · revision date · approval · file location · related process · status (current · approval to be confirmed · inconsistent notation) / cleanup of old and duplicate files
Reference documents by process: for each of Steps 1 to 16, the procedures, guidelines and forms that serve as the basis for that work (number, current Rev.), check of mandatory documented information (7.5.1), list of documents of external origin
Revision history, rules for documented information management, and items to be written in Management System Establishment
11 Monitoring, Change and Revision Control9.1·7.5·A.6·A.8·A.9While approved AI is in use, important risks are monitored by indicators and thresholds (including performance degradation); change control, with impact review, revalidation and approval when changing the model, instructions, data, supplier or use; revision control of the inventory, risk assessment sheet, SoA, guidelines and model versions; and incident response and AI awareness training are operated. Monitoring results and change history are recorded in succession in the Step 9 operation control ledger.Status of approved AI use and monitoring table of important risks: indicator / measurement method and log / frequency / alert criteria / action to take when exceeded
Change control records and revision control ledger (version, revision date, reason, reassessment needed, approval)
Incident response procedure and AI awareness training plan
12 Internal Audit9.2 · Annex AIf you designate folders or files for the organization chart, division of duties, AI certification scope, AI utilization tasks, AI policy, Statement of Applicability (SoA), risk and impact assessment results and document system (source materials and reference documents), the following are produced: an annual internal audit program and the execution plan for each round (auditor independence; auditors do not audit their own work) → a checklist for each department (main clauses 4 to 10 + Annex A controls applied in the SoA) → an internal audit report if there are audit records → inputs for management review. Findings are passed on to 15 Nonconformity and Corrective Action.Internal audit program and execution plan for each round: purpose, scope, criteria, schedule, timetable by department, auditor independence
Checklist for each department: clause or Annex A control / points to check / audit method (documents, interview, site) / examples of objective evidence (controls excluded in the SoA are omitted)
Internal audit report (when audit records exist: number of nonconformities and observations, findings, conclusion, follow-up actions → 15 Nonconformity and Corrective Action) and inputs for management review
Mock audit: question and answer, one question at a time, with an AI auditor (ISO/IEC 42001); judgement and response tips for each answer, and a result report at the end (with a pass)
13 Legal Requirements Identification and Monitoring4.1·4.2·6.1.3·9.1Researches on the web the Ministry of Government Legislation (National Law Information Center, Citizen Legislation Participation Center), the competent ministries and official overseas sources (such as EUR-Lex), registers the AI-related laws and regulations applicable to the organization (AI role, business regions, personal information, automated decisions) in the AI legal requirements register, and checks every half year (January and July) and as needed for amendments and compliance status. The register is kept in this browser and becomes the basis of the next check, and is applied to risk assessment, impact assessment, SoA, use approval and management review.AI legal requirements register (Excel): rows by clause and obligation, with applicable role, applicability, whether high-impact AI applies, linked step, promulgation and effective dates, source and date checked
Changed legal requirements table; semiannual monitoring checksheet (conforming, nonconforming, not applicable, to be confirmed; evidence document number); action plan
Key schedule (next semiannual check, effective dates, end of grace periods); application to AI work; summary of management review inputs
14 Management Review9.3Management review inputs (follow-up actions from previous management reviews, changes in external and internal issues, achievement of the AI policy and objectives, AI performance and monitoring, changes in risk and impact assessments, incidents, results of 12 Internal Audit and 13 Legal Requirements Identification and Monitoring, status of corrective actions, changes in interested parties and legal requirements, adequacy of resources, opportunities for improvement) are organized to draw out decisions, resources and changes from top management. Of the decisions, nonconformities are passed to 15 Nonconformity and Corrective Action, and improvement tasks to 16 Improvement.Management review input summary (1 page): includes results of 12 Internal Audit and 13 Legal Requirements Identification and Monitoring, and the status of corrective actions
Management review outputs: decisions, resources and changes (including decisions to update the risk assessment, impact assessment and Statement of Applicability), and a decision tracking table
Guide to input materials and checklist (prepared Y/N, evidence, decisions needed); meeting facilitation; result report (as the meeting record)
Three output streams: corrective action (→ 13), reflection in the next year's business plan, and education and training (→ 6, 9), together with the follow-up action register
15 Nonconformity and Corrective Action10.2·10.1Each nonconformity is discussed with the AI, based solely on ISO/IEC 42001. In the "Nonconformity and corrective action discussion" window under Operate, you confirm G1 clause (body text, or Annex A control in the SoA) → G2 nonconformity description and grade → G3 root cause → G4 improvement measures (steps to redo) → G5 schedule and person responsible, and the result becomes an Excel nonconformity and corrective action register (31 columns, with formulas). It takes in the findings (nonconformities and observations) of 12 Internal Audit, the nonconformities and noncompliance from 13 Legal Requirements Identification and Monitoring, and AI incidents; corrects the nonconformities; establishes corrective action that finds the root cause and prevents recurrence; verifies its effectiveness; and then updates the risk assessment, impact assessment, Statement of Applicability and guidelines. Internal audit results are retrieved automatically in this browser.Nonconformity and corrective action register: source (internal audit, legal check, incident) / clause or control / description / immediate action (correction)
Cause analysis (5 Whys: shortcomings in data, algorithm, use and controls), corrective action plan, person responsible, deadline and completion criteria
Effectiveness verification; list of updates to the risk assessment, impact assessment, Statement of Applicability and guidelines; input to the next management review
16 Improvement10.1Improvement opportunities arising from the decisions of 14 Management Review, the results of 15 Nonconformity and Corrective Action, observations and improvement recommendations from monitoring, internal audit and legal checks, and the opinions of interested parties are collected. From them, improvement tasks are set to continually improve the suitability, adequacy and effectiveness of the AI management system. After implementation and effects are verified, the results feed back into the next year's operation (1 Context Analysis, 5 Risk Assessment, 6 Impact Assessment, 7 SoA, AI objectives).List of improvement opportunities: source (management review, corrective action, observation, monitoring, interested parties' opinions) / description / expected effect / priority
Improvement task plan: person responsible, deadline, resources, performance indicators (before and after) and method of verifying effects
Items to feed back into the next year's operation: updates to the risk assessment, impact assessment, SoA, AI objectives and training
Evaluation method (common to all steps) Expand
  • Six axes for task selection (six criteria for choosing tasks in which to use AI): frequency of repetition · difficulty of judgment · cost of errors (the cost if wrong) · data confidentiality level (A public · B internal · C customer and personal information) · AI impact level (recruitment, personnel evaluation, safety, qualification decisions and credit decisions are always "High") · need for human oversight → P1 introduce immediately · P2 AI draft + approval by a designated reviewer · P3 defer.
  • Scope of use LEVEL (the range in which AI is used): 1 Individual · 2 Department · 3 Site · 4 Company-wide → assessment type: excluded, simplified or formal (formal if there is exposure to external customers, large-scale processing of personal information or automated decision-making about people, LEVEL 3 or 4, or integration with live core-system data).
  • Risk score (magnitude of the risk) = likelihood (how likely it is to occur, 1 to 5, where 5 = at least once a month or on every input and 1 = less than once in 3 years) × severity (the damage if it occurs, 1 to 5, the highest value among the three axes of business, individual and society, with the adopted axis noted, e.g. 4-individual): 1 to 6 low risk · 7 to 12 medium risk · 13 to 19 high risk (impact assessment mandatory, deployment on hold) · 20 to 25 critical (immediate mitigation and report to top management).
  • Six risk categories: technical · data · ethical and social · legal and regulatory · business and supply chain · life cycle. Seven treatment options: avoid · pursue the opportunity · eliminate the source · reduce likelihood · reduce consequences (human intervention, double checking, alternative means) · transfer or share · accept.
  • Seven impact assessment areas: safety · fairness · transparency and explainability · personal information · security · human management and oversight · society and environment. If even one area is rated "High", the result is conditional approval or hold.
  • Human oversight: the real authority of a person to review, intervene in and override the decisions and outputs of AI; it is not merely watching a screen.
AI management system process map Links among the 16 processes and system performance Expand

The AI management system is a single system, and the 16 steps are its processes (ISO/IEC 42001 4.4). Each step takes over the output of the preceding process and leaves the same identifiers (AI number, task ID, R No, control number, approval record, OBJ) so that the next process can use them as they are. The risk criteria of step 1 and the AI policy and AI objectives of step 2 are the basis for all steps, and work follows the reference documents for each process organized in step 10 (the documents created in Management System Establishment). 11 Monitoring measures system performance, and 14 Management Review and 16 Improvement feed back into steps 1 and 2 of the next cycle.

StepProcessMain inputsMain outputs (handed over to)Process KPIs
11 AI Context Analysis
4.1 to 4.4, 5.3, 6.1.1		Business plan, management analysis, interested parties, industry trends (decisions of 14 Management Review, 16 Improvement, changes in laws from 13)AIMS foundation: issues, interested party requirements, roles, risk criteria, process map, scope (draft) → 2, 3, 4, 5, 7, 10, 14Rate of reflecting interested party requirements; whether the risk criteria are approved
22 AI Policy, Roles and Objectives
5.1, 5.2, 6.2, A.2, A.6.1.2, A.9.3		Results of 1 Context Analysis, 4 Inventory, 5 Risk Assessment, 6 Impact Assessment, 12 Internal Audit and 15 Nonconformity and Corrective Action; your company folder (business plan, KPI results); grounds for updates: 14 decisions, 16 objective adjustments, 11 progressAI policy, AI objectives (OBJ), achievement plans, link between objectives and process KPIs → 3, 5, 7, 11, 14, 16Ratio of measurable objectives; rate of achievement plans meeting the five elements; AI objective achievement rate
33 AI System Selection
6.1, 6.2, 8.1		1 Scope, 2 AI objectives, 9 Operational control register (existing AI), 4 Inventory, 16 Improvement tasksAI selection table (selected tasks, priority, schedule) → 4Number of selected tasks; utilization rate of existing AI; schedule compliance rate
44 AI System Inventory
4.3, A.4, A.10		3 Selection table, existing AI materialsInventory (assessment type, LEVEL), draft Statement of Applicability → 5, 6, 7, 8, 9, 10Zero missing registrations (quarterly reconciliation); completion rate of assessment type determination
55 AI Risk Assessment
6.1.2, 8.2		4 Inventory, 1 Risk criteria, 2 AI objectives; 11 Monitoring results, 15 Nonconformities, 13 Changes in laws (triggers for reassessment)Risk register, treatment plan (underlying controls) → 6, 7Completion rate against assessment targets; reassessment deadline compliance rate; number of high-risk or higher items
66 AI System Impact Assessment
6.1.4, 8.4, A.5		5 Risks (major), 4 Inventory, 1 Affected parties (interested parties)Impact assessment report, mitigation measures, feedback to risk assessment → 5, 7Completion rate of started targets; rate of establishing mitigation measures for areas rated "High"
77 Control Implementation and Statement of Applicability (SoA)
6.1.3, 8.3, A, B		5 Treatment plan, 6 Mitigation measures, 4 Inventory, 2 AI objectivesApproved Statement of Applicability (controls, human oversight, laws and regulations, resources, competence, communication) → 8, 9, 10, 11, 12, 13Rate of linking controls to risks that cannot be ignored (target 100%); proportion within the acceptance criteria after action
88 Verification and Use Approval
8.1, A.6, A.7		7 Approved version, 6 Mitigation measures, 4 Inventory, implementation and test materials, supplier informationV&V results, approval-for-use records (inventory), data control register → 9, 10, 11V&V pass rate; zero uses before approval; time taken for approval
99 Operational Control
8.1, A.6, A.9		8 Approval records, 7 Approved versionOperational control register (approved AI only), instruction revision numbers → 10, 11, 12100% registration of approved AI in the register; zero missing revision history entries
1010 Documented Information Control
7.5.1 to 7.5.3, A.6.2.7, A.8.2		Your company folder holding the manuals, procedures, guidelines and forms created in Management System Establishment (recommended: AI Management System\00_Documents); records of steps 1 to 9Document list (current versions), cleanup of superseded versions, check of required documents, reference documents for each process, revision history, documents of external origin → all steps (reference documents), 12, 14, 15Rate of confirming current versions; rate of meeting required documents; zero items awaiting approval confirmation; rate of complying with the check cycle for documents of external origin
1111 Monitoring, Change and Revision Control
9.1, 8.1, 8.2 to 8.4		9 Register, 7 Controls, 8 Approval conditions, 2 AI objectives, 6 Impact assessment reassessment deadlinesMonitoring results, control effectiveness, incident register (grade, initial action, notification), progress on AI objectives, AIMS performance indicators → 5 (reassessment), 6, 12, 14, 15Zero violations of approval compliance; threshold exceedances; initial incident response time; reporting deadline compliance rate; control effectiveness
1212 Internal Audit
9.2		7 Statement of Applicability, 9 Register, 11 Monitoring, 10 Document list (evidence), 2 Policy and objectives, 4 Inventory, 15 Previous findingsAudit results and findings → 14, 15Execution rate against plan; trend of findings
1313 Legal Requirements Identification and Monitoring
4.1, 4.2, 6.1.3 f, 9.1, A.8.5		7 Legal requirements, 9 Register, 4 AI systems, 1 Business regionsAI legal and regulatory register, amended laws and regulations → 5 (reassessment), 7, 10 (external origin), 14Rate of meeting deadlines for reflecting changes in laws; zero nonconformities in compliance determination
1414 Management Review
9.3·6.3		Results of steps 1, 2, 5, 9, 10, 11, 12, 13, 15 and 16, and trends in AI objectives and process KPIs (9.3.2 a to e)Decisions (AI policy, objectives, AIMS changes, resources) → steps 15, 16, 1 and 2Implementation rate of previous decisions
1515 Nonconformity and Corrective Action
10.2		Step 12 audits, step 11 incidents (handover = step 15), step 13 legal requirements, step 14 decisionsCorrective actions and effectiveness verification → step 5 (reassessment), step 7 (revision of the Statement of Applicability), step 10 (document revision), step 16On-time completion rate, recurrence rate and effectiveness verification rate
1616 Improvement
10.1·6.2		Step 14 decisions, step 15 corrective actions, results of steps 11, 12 and 13, and step 2 AI objectives performanceAdjusted AI objectives, improvement tasks and the plan for next year → steps 1, 2 and 3AI objectives achievement rate and improvement task completion rate

AI management system performance indicators (step 11 monitoring re-measures them and step 14 management review examines the trends)

  • AI objectives achievement rate (against the measurable objectives set in step 2, AI Policy, Roles and Objectives)
  • Share of non-negligible risks that fell within the acceptance criteria after treatment (effect of risk controls)
  • Zero cases of use before approval or outside the approved scope
  • Trend in the number and severity of incidents (quarterly)
  • Trend in internal audit nonconformities and recurrence of corrective actions
  • Number of processes meeting their KPIs / 16

Select the AI operation step

First choose the standard to operate (ISO/IEC 42001, and ISO/IEC 27001 if operated together) and the scope (development, supply, use), then choose the operation step and enter the work and projects that use AI and the AI systems. A draft for that step is then written according to ISO/IEC 42001 and the evaluation method above.
The platform pass covers all 16 steps. No advance payment is taken. When you click "Write with AI", the cost is shown; if you agree, payment is made on the spot and writing continues.

Run now ↓

Until AI writing is connected, please leave your request through "Contact a staff member".Enter the inputs and click "Write with AI". The output appears after the document completeness check (80 points). On-screen payment (card and simple payment) is being prepared. Before then, or if you prefer a bank transfer, click "Contact a staff member". A staff member will explain the amount and the transfer method, and will open access after confirming the deposit (eiso Pricing).

Operation track
If you choose Economic Prosperity (based on ISO 9001) or Social Value (environmental protection and social justice), you are taken to Management System Operation. Your industry is carried over, and the results of each step are passed on to one another in this browser.
Standard to operate

If you select nothing, only ISO/IEC 42001 is operated. If you also select ISO/IEC 27001, the Statement of Applicability is kept separately for each standard and the two are linked through a control mapping table (see "Standards operated together" above).

Operation mode

Shown only when two standards are selected. Integrated operation runs the two standards as one flow; independent operation writes each standard separately on its own operation platform (tab above).

Scope (AI role) *

Choose this before the operation step. You may choose more than one. The scope you choose applies to all 16 steps (inventory, risk assessment, SoA, approval, monitoring, change, audit) and is remembered in this browser.

Operation step *
Unit of selection

The table is grouped by this unit. For each project, department, division or process, you can see which AI is used and where that AI stands in the management cycle (selection → risk assessment → controls → approval for use → operations management register → monitoring → change and revision control).

Industry
Tasks and projects that use (or plan to use) AI *
AI systems and tools
Designate the basic data on your computer: designate the folder or files for this step
When you designate the basic data accumulated on your computer for this step (AI list, evaluation results, test records, monitoring logs, current forms), eiso processes, analyzes and consolidates it. Files are read only within your browser and only the text is placed in the box below; they are not sent to the server and not stored.
Designate materials
Names to mask

DOCX, XLSX, PPTX, HWPX, PDF and TXT. Files are read only within your browser and only the text is used (not stored, not used for AI training).

Materials on your computer
Summary of context and data

May be left blank if you have designated materials on your computer.

Requests
Company Workspace Company Workspace
If you select a Company Workspace in 11 Monitoring in use, 12 Internal audit, 14 Management review, 15 Nonconformity and corrective action and 16 Improvement, the company's operational data (objectives and indicator register, incidents, and the internal audit, management review and corrective action registers) is attached to the AI request as figures calculated by the server and a short summary. It is the same data as in the corresponding steps of Management System Operation (15, 17, 18, 19 and 21), and it is used only for AI writing requests and not for training. In 2 AI policy, roles and responsibilities and objectives, "Include objective-setting materials" attaches past objective performance, significant risks, management review decisions and data sources (the same materials as Management System Operation 4 Objective setting). Results can be kept with that company by "Save to workspace", and are imported into objectives, indicators and action plan items in objective and performance monitoring.

* AI-generated output is a reference draft and does not guarantee certification.: AGENT eiso.co.kr

Notes

  • Nature of the outputAI-generated output is a reference draft and does not guarantee certification. On eiso, AGENT does not artificially prepare or review the documents of a specific company (implementation consulting and training are separate from eiso: Management System Establishment and Training Inquiries). Decisions such as risk acceptance, exclusion of controls and approval for deployment are yours to make.
  • Materials you uploadCompany logos, company names, addresses, e-mail addresses and telephone numbers may be uploaded as they are.
    Please delete or replace anything that may be personal information (personal names, personal mobile numbers, personal e-mail addresses, etc.) or a trade secret (customer information, models, data details, technical know-how, etc.) before uploading. Uploaded information is not used for AI training: it is not stored on the website, and the AI (Anthropic API) does not use received content for model training.
  • Text of the standardThe text of ISO/IEC 42001 is protected by copyright, so only explanations and summaries are provided. Please check clause and control numbers and requirements against the published text of the standard.

Related materials