Annex A is where ISO 42001 gets concrete. This guide walks through all 38 AI controls across the 9 objectives, how you choose which apply to your organisation, and how they connect to the rest of the standard. It pairs with our guide to ISO 42001 requirements.
Annex A of ISO/IEC 42001 is the catalogue of AI-specific controls — 38 controls organised under 9 control objectives (categories A.2 to A.10). Where clauses 4–10 are the mandatory management-system requirements, Annex A is the menu of controls you draw from to treat your AI risks. You select the controls that apply to your context and justify what you include and exclude — the same Statement-of-Applicability logic used in ISO 27001.
The clauses tell you to run a management system; Annex A tells you what specific AI controls that system can deploy. Clauses 4–10 are required for every certified organisation. Annex A controls are selected based on the risks and impacts your AI systems actually carry, so two certified organisations can have very different control sets. The bridge between them is your risk and impact assessment: it decides which Annex A controls are in scope.
Each objective groups related controls. Here is what each category covers:
You don't implement all 38 controls by default. Instead, your risk and impact assessment identifies the AI risks that matter for your systems, and you select the Annex A controls that treat them — documenting your reasoning in a Statement of Applicability. A low-risk internal productivity tool and a high-risk credit-decision model will justify very different control sets. The A.5 impact-assessment controls lean directly on ISO/IEC 42005, the companion standard for AI system impact assessments.
Annex A doesn't stand alone. Annex B gives control-by-control implementation guidance — how to actually operationalise each control. Annex C catalogues potential AI-related objectives and risk sources (bias, security, explainability, fairness) to feed your risk assessment. Annex D covers applying the AIMS across specific domains and sectors. Read together, they turn the control list into a working programme.
The nonconformities auditors see most: copy-pasting the same control set across systems with very different risk profiles; excluding controls without a documented justification; and claiming a control is in place with no evidence that it operates. Annex A rewards specificity — a control mapped to a real risk, with a named owner and current evidence, is worth more than a fully populated checklist that no one maintains.
AramGRC runs the ISO/IEC 42001 gap assessment that scores your maturity against every applicable Annex A control and produces a certification-ready roadmap and Statement of Applicability — so you walk into the audit knowing which controls apply and that each is evidenced. See our ISO 42001 checklist and complete ISO 42001 guide.
Annex A contains 38 controls organised under 9 control objectives (categories A.2 to A.10).
No. Unlike clauses 4–10, Annex A controls are selected based on your AI risks. You justify which you include and exclude in a Statement of Applicability.
Clauses 4–10 are the mandatory management-system requirements; Annex A is the catalogue of AI-specific controls you choose from to treat your risks.
AI policies, internal organisation, resources for AI systems, assessing impacts, AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships.
A document recording which Annex A controls you have applied, which you have excluded, and the justification for each — the same concept used in ISO 27001.
Your risk and impact assessment identifies the risks your AI systems carry, and you select the controls that treat those risks proportionately.
Annex B provides implementation guidance for the Annex A controls — practical detail on how to operationalise each one.
The A.5 controls require AI system impact assessments, and ISO/IEC 42005 is the companion standard that gives the methodology for conducting them.
Start here — what ISO 42001 is, what it requires, costs, and how to get certified.
The world's first certifiable AI management system standard — requirements, Annex A controls, certification, cost, training and India relevance.
The standard explained in plain language.
The clauses and Annex A controls ISO 42001 asks for.
The 38 AI controls across 9 objectives (A.2–A.10), and how you select which apply.
You're here
What ISO 42001 certification costs, including in India.
A step-by-step readiness checklist for certification.
The mandatory policies, procedures and records — and what a good ISO 42001 toolkit includes.
How the AI and information-security standards differ.
The certification process, step by step.
Courses and credentials for individuals.
The role that builds and runs the AIMS — course, exam and how it differs from Lead Auditor.
DPDP Act, MeitY guidelines and RBI FREE-AI, mapped to one AIMS.
A standard, a voluntary framework and a law — how they fit together.
How smaller AI companies scope, cost and pursue certification proportionately.
Who is certifying, why the list is growing, and how to verify a certificate.