ISO/IEC 42001:2023 is the first international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations. Published by the International Organization for Standardization, it provides a framework for organizations that develop, provide, or use AI systems.

The standard is not a checklist of technical features. It is a management system standard — similar in structure to ISO 27001 for information security or ISO 9001 for quality management. It defines organizational processes, policies, and controls that must be in place to govern AI responsibly.

For engineering teams, this means the standard has direct implications for how AI systems are designed, deployed, monitored, and documented. Certification requires demonstrable technical controls, not just policy documents.

Engineering teams are accustomed to building AI systems that work. ISO 42001 requires building AI systems that can be governed, audited, and explained.

The standard requires organizations to maintain records of AI system inputs, outputs, and decisions in a manner that supports auditability. This is not satisfied by application logs alone. The records must be preserved with integrity controls that prevent tampering or unauthorized modification.

It also requires risk assessment and impact analysis for AI systems, with documentation that demonstrates these assessments were conducted before deployment. Engineering teams must implement technical controls that align with the risk levels identified in these assessments.

Traceability is a core requirement. For any AI output that affects a decision, the organization must be able to trace back to the model version, input data, and configuration that produced it. This requires infrastructure that most teams do not have in place today.

The standard maps to several concrete technical requirements that engineering teams must address.

Audit trail integrity: AI system logs must be tamper-evident and independently verifiable. Standard application logging to a database is insufficient because database records can be modified by administrators. Cryptographic anchoring of AI outputs and decisions satisfies this requirement by producing self-contained proof that does not depend on the integrity of the storage system.

Model versioning and lineage: Organizations must maintain records of which model version produced which outputs. This requires a systematic approach to model versioning that goes beyond git tags — it means recording model identity as part of every output record.

Input and output preservation: For high-risk AI systems, the organization must preserve the inputs and outputs in a manner that supports later audit. The standard does not prescribe how long, but the retention period must align with the organization's risk assessment and applicable regulatory requirements.

Change management: Modifications to AI systems — model updates, training data changes, configuration adjustments — must follow a documented change management process with records of what changed, when, why, and who approved it.

Monitoring and anomaly detection: Deployed AI systems must be monitored for performance degradation, bias drift, and unexpected behavior patterns. The monitoring results must be documented and reviewed as part of the management system.

Cryptographic attestation directly addresses several ISO 42001 requirements that are difficult to satisfy with traditional infrastructure.

The auditability requirement is the most direct fit. Attestation creates a cryptographically signed, tamper-evident record of every AI output at the moment of generation. These records are independently verifiable — an auditor can confirm their integrity without trusting the system that created them. This is precisely what the standard requires.

The traceability requirement is supported by including model metadata — version, provider, configuration — in the attestation payload. Each attestation record links an output to the specific model state that produced it, creating a complete traceability chain.

The integrity requirement is inherent in the cryptographic design. Attestation records cannot be altered after creation. The digital signature proves organizational origin. The hash proves content integrity. The timestamp proves temporal ordering. Together, these properties satisfy the standard's requirement for records that support reliable auditability.

For organizations pursuing ISO 42001 certification, attestation provides the technical evidence that auditors will examine. Policies and processes describe what the organization intends to do. Attestation records prove what the organization actually did.

Engineering teams approaching ISO 42001 compliance should work in phases rather than attempting a comprehensive implementation at once.

Phase one is inventory and risk assessment. Catalog all AI systems in production, classify them by risk level, and document the inputs, outputs, and decision types for each. This inventory becomes the foundation for every subsequent control.

Phase two is output attestation for high-risk systems. Integrate cryptographic attestation into the post-generation pipeline of your highest-risk AI systems. This addresses the auditability and integrity requirements immediately for the systems that matter most.

Phase three is model versioning and lineage. Implement systematic model versioning that records model identity, training data provenance, and configuration state. Link this information to attestation records so that any output can be traced to a specific model state.

Phase four is monitoring and change management. Implement continuous monitoring for deployed models and establish a documented change management process. Ensure monitoring results and change records are preserved with the same integrity guarantees as AI outputs.

Phase five is management system documentation. Document the policies, processes, roles, and responsibilities that govern your AI operations. This documentation must align with your actual technical controls — auditors will verify consistency between what you document and what you implement.

The most common mistake is treating ISO 42001 as a documentation exercise. Writing policies without implementing corresponding technical controls will fail at certification. Auditors verify that controls are operational, not just documented.

The second mistake is relying on application logs for auditability. Standard database logs are insufficient because they lack integrity guarantees. An auditor will ask how you prevent log tampering, and the honest answer for most application logs is that you cannot. Cryptographic anchoring solves this.

The third mistake is implementing controls only for new AI systems while ignoring existing production systems. The standard applies to all AI systems within scope. Retrofitting attestation and monitoring onto existing systems is essential.

The fourth mistake is underestimating the organizational change required. ISO 42001 is a management system standard. It requires cross-functional coordination between engineering, legal, compliance, and leadership. Engineering teams cannot achieve certification alone — but they own the technical controls that make certification possible.