AITBM

TIER 2 · AI MANAGEMENT AND IMPACT ASSESSMENT

ISO/IEC 42001 and 42005 to AITBM Mapping

Relates management-system and impact-assessment evidence to AITBM scoring, governance, and assurance inputs.

Tr-3Tr-4

How to use this crosswalk

External requirements, controls, threats, and practices identify evidence to collect or tests to run. Only measured evidence from the assessed deployment determines AITBM rubric placements, IVP, ORP, ACI, MVT findings, and ERS.

Mapping content last verified 2026-08-13. No endorsement by the external framework owner is implied.

ISO/IEC 42001 & 42005

Management system and impact assessment

ISO/IEC 42001:2023 · ISO/IEC 42005:2025 · ISO/IEC 42006:2025

ISO/IEC 42001 specifies an AI management system and ISO/IEC 42005 provides AI system impact-assessment guidance. This public-scope AITBM crosswalk does not reproduce the licensed normative text and does not claim clause-by-clause or control-by-control completeness.

Publicly Described ISO Scope / Evidence Primary AITBM Relationship Evidence Use / Boundary
Establishing and implementing an AI management systemTr-3, Tr-4; ACI provenance contextApproved ownership and operating records may support applicable criteria; management-system existence is not proof of technical effectiveness
Maintaining and continually improving an AI management systemRf; ACI event, coverage, freshness, and monitoring contextExercised corrective-action, reassessment, evaluation, and telemetry records remain subject to AITBM evidence rules
AI system impact assessmentSDG inputs for graph-derived Cp; Rf; ACI provenanceDependencies, affected parties, harm scenarios, reversibility, and mitigations may inform the assessment; impact labels do not set Cp or ERS
Management-system audit and certification evidenceTr-3 and ACI provenance/independence contextCertification artifacts may support provenance when applicable; certification is not an AITBM score and does not attest every technical rubric

Key findings

  • ISO conformity, certification status, and impact ratings do not automatically change an IVP anchor, ORP value, ACI value, or ERS.
  • Cp remains graph-derived under GDCP; impact-assessment records may populate and verify the SDG but never directly assign Cp or an ERS band.
  • AITBM does not determine ISO conformity or certification and is not specified or endorsed by ISO or IEC.
  • EN ISO/IEC 42001:2026 is a European adoption identical to ISO/IEC 42001:2023, not a new ISO edition.

ISO/IEC 42001 reference →