Why AI Use Matters Under ISO/IEC 42001
The standard expects an organization to know which AI it uses and for what, to assess the impact of significant uses, and to show a policy for responsible use. Most small businesses have none of that written down.
Controls ProctoredAI Evidences
| Control | Evidence in the Monthly Report |
|---|---|
| A.9.2 Processes for responsible use of AI | Documented AI usage policy enforced on endpoints. |
| A.4 Resources for AI systems (inventory) | AI applications in use are inventoried and classified. |
| A.5 AI system impact assessment | Impact assessments recorded for high-risk AI use cases before approval. |
Each client's report lists these controls with a status. Evidenced means the mechanism produced records in the period; Active means it is enforced with nothing to record; Not configured means the feature is off for that client.
Policy Packs Applied
Selecting ISO/IEC 42001 for a client applies these packs in one step:
- Visibility Baseline. Log every sensitive-data finding, even when nothing is blocked.
- Sensitive Documents. Contracts, financial statements, HR and medical records, customer lists and credential files may only go to approved AI apps.
The Setup Checklist
Some steps live outside the policy rules. The console hands the provider this list:
- Build the AI register (Suggest from usage) and classify each use case
- Complete impact assessments on high-risk use cases
- Publish the AI Use Policy and collect acknowledgments
What the Auditor Receives
- A monthly AI Governance Report for the client, stored with a SHA-256 digest so the copy an auditor holds can be matched to the console.
- An evidence bundle with every non-usage event in the period, the client's audit-log entries and the head hash of the audit chain.
- The AI Use Policy generated from the client's real configuration, with each employee's acknowledgment and version.
Questions
Does a small business need ISO/IEC 42001 certification?
Most do not. Its controls still give a clear structure for AI governance, and customers who certify may ask their suppliers for the same evidence.
How is the AI inventory built?
From what devices actually use. The agent inventories AI apps on every device, and the AI register's "Suggest from usage" proposes one use case per AI category it saw in the last 30 days. Nothing is approved automatically.
Are impact assessments recorded?
Yes. A high-risk use case cannot be approved until its impact assessment is complete, and the assessment, the decision and the reviewer trail are kept on the register.
ProctoredAI supports a client's compliance program; it does not by itself make a client compliant, and it is not legal advice. All frameworks · The MSP AI governance guide