ISO/IEC
42001, 42005 and the 27001 controls that touch agent execution
42001 is a management-system standard: it is certified against an organisation, not a product. What a product can do is produce the operational evidence that a management system requires, in a form an assessor will accept.
42001 — where operational evidence is required
| Requirement area | Evidence ApexClaw produces |
|---|---|
| Documented operational controls | The active policy, versioned, with every decision recording the version it was taken under. |
| Monitoring and measurement | A signed record per decision and effect, including refusals and undeterminable outcomes. |
| Nonconformity and corrective action | Revocation records and their consequences, showing what was prevented and when. |
| Control of documented information | Hash-linked records with separated checkpoint keys, checkable offline. |
| Competence and human roles | Approval records naming the role required and the separately authenticated approver. |
Mapped means we assert the control addresses the requirement. Evidence-backed means the control emits an artifact a reader can verify. Conformity readiness means the evidence an assessor would request is assembled. Certification means an accredited third party assessed the system and issued a certificate — ApexClaw holds none, and displays none.
42005 — impact assessment inputs
An impact assessment needs traceable facts about what the system actually did, not a description of what it was intended to do.
Traceable action records
Each governed action carries its requesting identity, principal, policy version, decision and outcome.
Recorded refusals
Actions the system declined are part of the record, which is what lets an assessment reason about the control's effect rather than its intent.
Stated unknowns
Outcomes that could not be determined are recorded as unknown rather than resolved into a convenient value.
Certification is an organisational outcome
ISO/IEC 42001 certification is issued to an organisation by an accredited certification body following an audit of its AI management system. No product can confer it. ApexClaw holds no certification and displays no badge.