Frameworks · ISO/IEC 42001:2023 · AI management
The model decided. Nobody can say what it weighed.
42001 is the first certifiable standard for running AI as a managed system rather than a project. It asks the question your credit model cannot currently answer, and it asks it before the model goes live — which is also what GAID expects of you.
One decline · what the model weighed
Application 118,402 · refused in 240ms
Location carried more weight than income. Nobody chose that. It emerged from the training data, and without 42001 nothing in the company would ever have looked.
What it actually requires
A management system, not a model card
The certificate is about how you govern AI over time: who owns it, what you assessed before launch, what you monitor after, and what happens when it drifts. Six of these you have already built for the Act.
- 4
Know which systems count
An inventory of every AI system, what it decides, and who it decides about. The credit model and Eri are both on it.
- 5
A named owner at the top
Not the team that built it. Somebody accountable for the policy, with the authority to stop a model going live.
- 6
Assess it before launch
Impact on the people subject to the decision, not just risk to the business. The same DPIA that the Act already forced you to write.
- 8
Operate it deliberately
Documented data sources, documented changes, and a record of what the model weighed when it decided.
- 9
Monitor for drift
A model that was fair at launch and unfair in month nine has failed, and nothing in your stack notices unless somebody set a threshold.
- 10
Fix and re-test
With the finding, the remediation and the retest kept together — the way an auditor reads any other non-conformity.
Why it is not optional for long
GAID already expects most of this
The directive treats automated decisions as high risk, requires a route to a human, and requires you to say a machine decided. 42001 is the certificate that proves you run that discipline continuously rather than having written it down once.
The Act asks
Can a person get a human to look again?
Section 37. A published route, not an intention. It is one of the three fixes still blocking DPIA-2026-0004 and it has no owner.
42001 asks
And who checks that it kept working?
Named owner, monitoring interval, drift threshold, and an incident path when the model behaves differently in month nine than it did at launch.
Eri is held to the same standard. An assistant that acts inside your registers is an AI system under this framework, and it appears on your audit trail under its own name for exactly that reason.
What you already hold
Most of the evidence is sitting in work you have done
42001 borrows its shape from 27001, so if you hold that certificate the management system is already in place. What is genuinely new is the bias testing and the record of what the model weighed.
Management system structure
Scope, policy, objectives, internal audit and management review all come straight from 27001.
Impact assessment
DPIA-2026-0004 covers the credit model already. 42001 wants the same assessment with a monitoring plan attached.
A route to a human
Section 37 of the Act requires it. 42001 requires you to prove it still works.
Bias testing by region
Genuinely new, genuinely unstarted, and the one that will take longest. Nobody has been assigned.
Decision records
What each decision weighed, kept long enough to answer the person who was refused.
Find out what your model would have to explain
Connect the system it runs in. Asiri returns the clauses you already satisfy through 27001 and the Act, and the short list that is genuinely new work.