The optional AI management (ISO/IEC 42001) module keeps the records an ISO/IEC 42001 audit asks for about your own AI in one place: the AI you build, provide or use, its risks and effects on people, your AI policy and controls, and how you check it's working. It links to your suppliers, so AI you use through suppliers is covered too. New to the standard? Read ISO/IEC 42001 explained first.
Please read: SupplierVault isn't affiliated with or endorsed by ISO or IEC. Our descriptions of the clauses and controls are our own summaries, not the standard's text, so buy the standard (for example from BSI) and check your approach against it. Using SupplierVault doesn't by itself make your organisation compliant or certified: only an accredited certification body can certify you, after its own audit. The starter policy is a starting point, not legal advice. The same note is in the module under About this module, and on the evidence pack and policy.
Switching it on
An admin opens Modules & forms and switches on AI management (ISO/IEC 42001). It's off for every organisation until you switch it on, and choosing a ready-made setup doesn't switch it on. Once on, AI management appears in the menu under Lifecycle. Switching it off again hides it but keeps everything you've saved.
It comes with the Professional plan and above, and your free month. To change it, you need to be an admin, or have a custom role that can manage suppliers or set-up.
The six tabs
| Tab | What it's for |
|---|---|
| Readiness | Headline numbers and a "Ready for audit?" checklist: policy approved, roles named, AI systems listed and assessed, controls decided, objectives set, supplier AI approved, internal audit and management review done, nonconformities closed. Suppliers that use AI and reviews coming up are listed here too. |
| AI register | Every AI system you develop, provide or use, with its purpose, owner, data, the people it affects, human oversight and EU AI Act category. Each system has its own risk assessment and impact assessment with sign-off. Suppliers that use AI are listed on the Readiness tab: click Add to register to bring one in. The system links to the supplier and shows its AI use answers. |
| Policy and objectives | A starter AI policy in our own words, to edit and approve, with roles and responsibilities and AI objectives you can measure. Download the policy as a Word document. |
| Statement of Applicability | All 38 Annex A controls by number, each with our plain-English description. Record whether it applies and why, how far it's in place, who owns it and the evidence (a link or an uploaded file). Download it as a spreadsheet. |
| Clauses 4 to 10 | The main requirements of clauses 4 to 10, in our own words, each with a status and evidence. |
| Audits and reviews | Plan and record internal audits. Findings become nonconformities with corrective actions as tasks, and observations can go to Service improvement. Record management reviews, with the figures from SupplierVault filled in for you. |
Sign-off and yearly reviews
Assessments and the policy are signed off by a named person from Stakeholders. SupplierVault also records who was signed in when it was signed off, and shows "recorded by" if that's someone else. Signing off sets a review date a year ahead and creates a task for it. If the policy is edited after approval, it shows "Changed since approval" until it's approved again.
The evidence pack
Click ISO/IEC 42001 evidence pack at the top of the page to download a printable pack for your certification body's auditor: your scope, policy and approval, roles, objectives, AI register with assessments, Statement of Applicability, clauses checklist, internal audits, management reviews and nonconformities. Print it or save it as a PDF from your browser.
Access by area
If you use access by area, an AI system linked to a supplier follows that supplier's area, so people only see the systems for suppliers they can see. Their readiness numbers count only what they can see.
Try it first
The live demo has the module switched on, with a few example AI systems, assessments and a part-completed Statement of Applicability.