Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
How does ShipReadyMetrics support ISO 42001 preparation?
Last verifiedShipReadyMetrics maps shipped capabilities to ISO 42001 clauses — evidence collection, crosswalk, AI inventory, and risk register. Tooling supports audit prep; it does not certify. Not legal advice.
Product mapping, last verified 10 September 2026 against ISO/IEC 42001:2023 and shipped product surfaces. No guarantee of compliance. Does not replace an accredited audit. Not legal advice.
Feature → clause mapping (shipped only)
| ISO 42001 anchor | Shipped capability | Honesty boundary |
|---|---|---|
| Clause 4 — context / inventory | AI inventory under Compliance → AI governance | Records what YOU declare; does not scope the AIMS for YOU |
| Clause 6 — risk planning | AI risk register (ISO 42001 / EU AI Act) | Risk rows YOU own; not CB risk acceptance |
| Clause 6 — SoA / controls | 24-framework crosswalk incl. ISO 42001 + density layer | Coverage map, not a pass/fail grade |
| Clause 7–8 — evidence | Control-mapped evidence collection | Connectors ingest; gaps remain YOUR gaps |
| Clause 9 — review | Evidence review / met-verdict overlay | Human accept/reject; not auditor sign-off |
| Clause 5–10 — programme tracking | Obligation map in-scope mark for iso_42001 | Mark is not a determination that standard applies |
| Annex A — lifecycle / code | AI-authored-code floor, AI ROI scoring | Metrics from git markers; not full lifecycle CMDB |
| External assurance | ShipReady Passport shareable posture snapshot | Posture artifact, not ISO certificate |
What the product does not do
- Does not issue ISO 42001 certificates or act as a certification body.
- Does not replace Stage 1 / Stage 2 audits or surveillance.
- Does not determine EU AI Act applicability or conformity.
- Does not guarantee compliance — readiness is not certification.
What to do now
- Mark iso_42001 in-scope on the obligation map only if YOUR programme owns it.
- Link AI inventory rows to Annex A themes in the risk register.
- Export evidence samples for CB review — verify format with YOUR auditor.
Checklist
- ☐ Inventory matches AIMS scope statement?
- ☐ Evidence rows have owners and met-verdict decisions?
- ☐ Crosswalk density reviewed for honest gaps?
- ☐ No external claim equates Passport to certificate?
Where this shows up in ShipReady Metrics
Signed-in app → Compliance → AI governance: AI inventory, AI risk register, evidence collection, obligation map, crosswalk with ISO 42001 density honesty, met-verdict overlay, AI-authored-code floor, AI ROI scoring, ShipReady Passport. Describe in prose only — no public app-route links on this marketing page.