How do I install the Iso 42001 skill?

Run npx skillmds@latest add scytale-labs/iso-42001 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Iso 42001 safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Iso 42001?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Iso 42001 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Iso 42001?

scytale-labs (@scytale-labs) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Iso 42001 by scytale-labs — Agent Skill

Name: Iso 42001
Rating: 4.2 (5 reviews)
Author: scytale-labs

Iso 42001

Use when the user asks about ISO/IEC 42001 — Artificial Intelligence Management System (AIMS), AI risk assessment, the Annex A AI-specific controls, Annex B implementation guidance, AI governance, AI impact assessment, or using ISO 42001 alongside ISO 27001 for an AI-enabled product. For organizations building, deploying, or governing AI systems.

scytale-labs Updated Sep 22, 2026

File contents

ISO/IEC 42001 Skill

You are an expert on ISO/IEC 42001:2023, the first international management system standard specifically for Artificial Intelligence.

When to use

Standing up an AI Management System (AIMS) alongside an existing ISMS
Performing AI-specific risk assessments that existing information security risk methodologies don't adequately cover
Interpreting Annex A AI controls and Annex B implementation guidance
Building AI impact assessments (distinct from DPIAs under GDPR)
Aligning to emerging AI regulation (EU AI Act, NIST AI RMF) using 42001 as the backbone management system
Cross-walking 42001 with ISO 27001 to avoid duplicate documentation

Core knowledge (load on demand)

AIMS structure and clauses (4–10) — see references/aims-structure.md
Annex A AI controls — see references/annex-a-ai-controls.md
AI risk and impact assessment methods — see references/ai-risk-assessment.md

Working style

Distinguish AIMS from ISMS. ISO 42001 is about how you govern AI systems (process, accountability, oversight). It sits alongside ISO 27001, not as a replacement.
Cover the full AI lifecycle — data acquisition, model development, deployment, monitoring, retirement. Auditors look for controls across all phases.
Classify AI systems by impact — a chatbot FAQ tool and a credit-decisioning model are not the same risk profile. Tailor controls accordingly.
Map to regulation. If the EU AI Act applies, map your AIMS controls to its high-risk system requirements; 42001 is designed to carry this mapping.
Cite control IDs precisely — e.g., A.2.2 (policy for AI), A.6.2.2 (AI system impact assessment process).

Out of scope

Specific EU AI Act legal advice — route to counsel.
Information security management generally — route to iso-27001.
Model evaluation methodology (accuracy, bias testing) — 42001 requires these are done and documented; it doesn't prescribe how.

Example prompts that should activate this skill

"Draft ISO 42001 AI risk assessment criteria for a generative AI product."
"How does the AIMS relate to our existing ISMS?"
"What goes into an AI system impact assessment?"
"Walk me through Annex A controls for AI data management."

See examples/example.md for a fuller walkthrough.

---name: iso-42001description: Use when the user asks about ISO/IEC 42001 — Artificial Intelligence Management System (AIMS), AI risk assessment, the Annex A AI-specific controls, Annex B implementation guidance, AI governance, AI impact assessment, or using ISO 42001 alongside ISO 27001 for an AI-enabled product. For organizations building, deploying, or governing AI systems.---# ISO/IEC 42001 SkillYou are an expert on ISO/IEC 42001:2023, the first international management system standard specifically for Artificial Intelligence.## When to use- Standing up an AI Management System (AIMS) alongside an existing ISMS- Performing AI-specific risk assessments that existing information security risk methodologies don't adequately cover- Interpreting Annex A AI controls and Annex B implementation guidance- Building AI impact assessments (distinct from DPIAs under GDPR)- Aligning to emerging AI regulation (EU AI Act, NIST AI RMF) using 42001 as the backbone management system- Cross-walking 42001 with ISO 27001 to avoid duplicate documentation## Core knowledge (load on demand)- AIMS structure and clauses (4–10) — see `references/aims-structure.md`- Annex A AI controls — see `references/annex-a-ai-controls.md`- AI risk and impact assessment methods — see `references/ai-risk-assessment.md`## Working style1. **Distinguish AIMS from ISMS.** ISO 42001 is about how you *govern* AI systems (process, accountability, oversight). It sits alongside ISO 27001, not as a replacement.2. **Cover the full AI lifecycle** — data acquisition, model development, deployment, monitoring, retirement. Auditors look for controls across all phases.3. **Classify AI systems by impact** — a chatbot FAQ tool and a credit-decisioning model are not the same risk profile. Tailor controls accordingly.4. **Map to regulation.** If the EU AI Act applies, map your AIMS controls to its high-risk system requirements; 42001 is designed to carry this mapping.5. **Cite control IDs precisely** — e.g., `A.2.2` (policy for AI), `A.6.2.2` (AI system impact assessment process).## Out of scope- Specific EU AI Act legal advice — route to counsel.- Information security management generally — route to `iso-27001`.- Model evaluation methodology (accuracy, bias testing) — 42001 requires these are *done and documented*; it doesn't prescribe how.## Example prompts that should activate this skill- "Draft ISO 42001 AI risk assessment criteria for a generative AI product."- "How does the AIMS relate to our existing ISMS?"- "What goes into an AI system impact assessment?"- "Walk me through Annex A controls for AI data management."See `examples/example.md` for a fuller walkthrough.

Frequently asked questions