A free Excel Statement of Applicability for ISO/IEC 42001:2023. List every Annex A control, justify what is in and out, track implementation, and see coverage on a live dashboard.
Prefer done-for-you? Get the ISO 42001 toolkit or explore training.
Published in December 2023, ISO/IEC 42001 is the first international standard for an Artificial Intelligence Management System, or AIMS. It gives organisations a structured way to govern AI responsibly.
Where earlier standards focused on quality or information security, ISO/IEC 42001 tackles the risks specific to artificial intelligence: bias and fairness, transparency and explainability, safety, and the impact of automated decisions on individuals, groups and society.
It follows the same high-level structure as ISO 9001 and ISO 27001, so it slots neatly alongside a management system you may already run. Clauses 4 to 10 set the requirements, and Annex A provides 38 reference controls across nine objectives covering the full AI life cycle.
It applies to any organisation that develops, provides or uses AI systems, whether you train your own models, embed a vendor’s API, or deploy AI in a regulated process. The framework maps closely to emerging regulation such as the EU AI Act.
International standard for AI management
First edition, by ISO and IEC
Clauses, numbered 4 to 10
Annex A controls across 9 objectives
The SoA is a mandatory output of the standard. This workbook lists every Annex A control and
turns the SoA into a living, dashboard-driven record your auditor will recognise.
All 38 Annex A controls across the nine control objectives, A.2 to A.10.
Mark each control in or out of scope, with the justification captured right beside it.
Tick the reason each control applies: risk assessment, legal, contractual or business need.
Track each control as implemented, partially implemented, planned or not implemented.
Applicable versus excluded, implementation coverage and a breakdown by control group, live.
A clean, defensible SoA in standard Excel, no macros and nothing to install.
Include or exclude each control for your context, with a justification your auditor can follow. Nothing gets left undecided.
Track how far you have implemented the applicable controls, weighted for partial progress.
Audit-ready front page with the SoA details and the copyright and IP terms.
What an SoA is, how to complete it, and the reason codes explained.
Applicable versus excluded, implementation coverage and a breakdown by group.
All 38 controls, with applicability, reasons, status, evidence and owner.
Grab the Excel file, no macros, nothing to install.
Mark each control in or out of scope, and record the reason and justification.
Note where each applicable control sits: implemented, partial, planned or not started.
Watch the coverage dashboard and drive the gaps to done.
A complete, editable ISO 42001 document kit, mapped to the standard and ready to implement, so you never start from a blank page.
Accredited ISO 42001 training for your team, from foundation through lead implementer and lead auditor.
Hands-on help, from a gap assessment to a virtual executive who helps run the system with you.
Not sure what certification will cost? Try the free ISO 42001 cost calculator.
Yes. The tool is offered free for your organisation’s own internal use, with no sign-up wall and no macros. You may use and reproduce it internally, but not sell, rebrand or redistribute it for commercial gain. Full terms are on the Cover sheet.
ISO/IEC 42001:2023, the first edition. It covers management clauses 4 to 10 and all 38 Annex A reference controls.
The tool includes plain-English guidance so you can start straight away. For a formal implementation or certification you should still obtain the official standard from ISO or an authorised reseller. The tool summarises the requirements and is not a substitute for the standard.
Compliance asks whether you meet the requirement today. Maturity asks how embedded, documented and repeatable the approach is. They are rated separately, because you can be compliant on paper yet immature in practice, or maturing but not yet compliant. Rating both gives a truer picture.
No. This self-assessment helps you understand your position and prioritise improvements. Certification can only be granted by an accredited certification body after a formal audit.