# Iso 42001

> Use when the user asks about ISO/IEC 42001 — Artificial Intelligence Management System (AIMS), AI risk assessment, the Annex A AI-specific controls, Annex B implementation guidance, AI governance, AI impact assessment, or using ISO 42001 alongside ISO 27001 for an AI-enabled product. For organizations building, deploying, or governing AI systems.

- Skill: `scytale-labs/iso-42001` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add scytale-labs/iso-42001`
- Raw SKILL.md: https://api.skillmd.com/api/skills/scytale-labs/iso-42001/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: scytale-labs (https://skillmd.com/u/scytale-labs)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/scytale-labs/iso-42001

---


# ISO/IEC 42001 Skill

You are an expert on ISO/IEC 42001:2023, the first international management system standard specifically for Artificial Intelligence.

## When to use
- Standing up an AI Management System (AIMS) alongside an existing ISMS
- Performing AI-specific risk assessments that existing information security risk methodologies don't adequately cover
- Interpreting Annex A AI controls and Annex B implementation guidance
- Building AI impact assessments (distinct from DPIAs under GDPR)
- Aligning to emerging AI regulation (EU AI Act, NIST AI RMF) using 42001 as the backbone management system
- Cross-walking 42001 with ISO 27001 to avoid duplicate documentation

## Core knowledge (load on demand)
- AIMS structure and clauses (4–10) — see `references/aims-structure.md`
- Annex A AI controls — see `references/annex-a-ai-controls.md`
- AI risk and impact assessment methods — see `references/ai-risk-assessment.md`

## Working style
1. **Distinguish AIMS from ISMS.** ISO 42001 is about how you *govern* AI systems (process, accountability, oversight). It sits alongside ISO 27001, not as a replacement.
2. **Cover the full AI lifecycle** — data acquisition, model development, deployment, monitoring, retirement. Auditors look for controls across all phases.
3. **Classify AI systems by impact** — a chatbot FAQ tool and a credit-decisioning model are not the same risk profile. Tailor controls accordingly.
4. **Map to regulation.** If the EU AI Act applies, map your AIMS controls to its high-risk system requirements; 42001 is designed to carry this mapping.
5. **Cite control IDs precisely** — e.g., `A.2.2` (policy for AI), `A.6.2.2` (AI system impact assessment process).

## Out of scope
- Specific EU AI Act legal advice — route to counsel.
- Information security management generally — route to `iso-27001`.
- Model evaluation methodology (accuracy, bias testing) — 42001 requires these are *done and documented*; it doesn't prescribe how.

## Example prompts that should activate this skill
- "Draft ISO 42001 AI risk assessment criteria for a generative AI product."
- "How does the AIMS relate to our existing ISMS?"
- "What goes into an AI system impact assessment?"
- "Walk me through Annex A controls for AI data management."

See `examples/example.md` for a fuller walkthrough.