ISO/IEC 42001 assessment
ISO/IEC 42001 sets requirements for an AI management system. VeriProof saves an assessment for six selected requirements, so you can see what an application recorded and what your organization still needs to show.
A saved assessment is not a conformity decision or a certificate. Your organization defines the management system, and your certification body evaluates it.
What the assessment covers
| Requirement | Recorded application facts | Organization evidence |
|---|---|---|
| Clause 6.1.3: AI risk treatment | Active policy rules for the application | Risk treatment plan and Statement of Applicability |
| Clause 8.4: AI system impact assessment | Declared data classifications | Current impact assessment and its review schedule |
| Clause 9.1: Monitoring, measurement, analysis and evaluation | Verified activity records and rule checks | Monitoring plan, methods, and evaluation results |
| A.3.2: AI roles and responsibilities | Current access grants and attributed actors | Approved role and responsibility assignments |
| A.6.2.6: AI system operation and monitoring | Active rules and their recorded checks | Operation and monitoring procedures |
| A.6.2.8: AI system recording of event logs | Verified activity records and archive digests | Event logging determination and retention |
Every organization requirement also needs a scope record. It shows that your management system covers the application and that the requirement applies.
Recorded facts stay separate from the formal result. A requirement is met only when its organization evidence has a current approval.
Review a saved assessment
Open the application
Open the application, then select Compliance. ISO 42001 must be one of the application’s frameworks.
Select the assessment period
Choose the dates to review. The assessment uses activity that started in that period.
Open the ISO 42001 assessment
Select Review ISO 42001 assessment. Each requirement lists its recorded facts, what is missing, and the next step.
Add organization evidence
Select Organization evidence. An Administrator or Compliance Officer adds a PDF for a requirement and requests a review. A reviewer approves or rejects it.
Export the assessment
Download the assessment record or send the ISO/IEC 42001 evidence summary to a connected GRC platform. Verify the archive before you deliver it.
Requirement states
Each requirement shows one state, so you can see who acts next.
| State | What it means |
|---|---|
| Organization evidence needed | No evidence is approved yet. Add a PDF and request a review. |
| Evidence awaiting approval | A reviewer approves or rejects the submitted evidence, then VeriProof reassesses the requirement. |
| Accountable review needed | A recorded review is waiting for an accountable reviewer to approve or reject it. |
| Met | The organization evidence has a current approval. |
| Not assessed for these dates | The requirement has no result for the selected dates. Run an assessment for them. |
| Observations only | VeriProof summarizes recorded activity for the framework but does not assess the requirement. |
Partially met, Not met, and Contradicted by recorded activity are decided results. Open the requirement to see the evidence behind them.
Resolve rule problems
When an application has no active rule, or its rule checks fail, VeriProof opens one work item for that problem. The HIPAA, ISO/IEC 42001, EU AI Act, and SOC 2 assessments share it, so you resolve it once.
Complete the management system record
Keep the rest of your management system evidence in your GRC record. This includes your AI policy, objectives, internal audits, management reviews, and corrective actions. VeriProof does not create these organizational decisions.