ISO 42001 documentation is the policy set, the AI system inventory and the records a Stage 2 auditor can sample. A blank template is a start. A filled record is what the certification body opens. This page separates mandatory items from files that are merely useful.

What ISO 42001 documentation Stage 2 will actually sample

Picture a shared drive the night before Stage 1. Twelve folders. Three of them hold PDFs. The rest are headings. The sampler will not praise the folder tree. The sampler will open the inventory, pick a system, and ask for the risk line, the impact note and the name of the owner.

ISO 42001 documentation is the set an auditor can open without calling your founder. ISO/IEC 42001:2023 calls the system an AI management system, the AIMS. Clauses 4 to 10 say what must be established. Annex A, 38 controls from A.2 to A.10, says which controls you claim in the Statement of Applicability. A template is a start. A filled record is what Stage 2 samples.

Seven Step Consulting does not issue certificates. A certification body does. Before you book Stage 1, check that the body is accredited for this standard and that the scope is current on the NABCB or IAF directory. This page lists no logos.

Mandatory records and the useful extras

The AI policy is ISO 42001 documentation only after someone in top management has signed it. The scope page is ISO 42001 documentation. A pitch deck is not. Roles are ISO 42001 documentation when each AI system has a named owner. “AI team” is not a name.

The AI system inventory is the center of the ISO 42001 documentation you will be asked to share. Purpose, status, owner, provider and whether the model is yours or a hosted API all belong on the row. A hosted model is still your system to govern.

A risk register becomes ISO 42001 documentation when each line has a score, an owner and a treatment. An AI risk assessment that only repeats “accuracy” will not satisfy a sampler who asks who could be harmed. An AI impact assessment is ISO 42001 documentation if it names who could be harmed and what you changed. ISO/IEC 23894 can guide the risk method. ISO/IEC 42005 can guide the impact method. The dated record is still yours.

The Statement of Applicability is ISO 42001 documentation that tells the certification body which Annex A controls you claim and why others are out. Operating procedures are ISO 42001 documentation when a live ticket follows them. A procedure no release has ever used is a wish.

Competence records are ISO 42001 documentation. A training calendar with no names is a plan. Internal audit and management review minutes are ISO 42001 documentation the Stage 2 team expects to exist before the visit. Do the internal audit early enough to fix what it finds. Management review has to discuss AI performance, incidents and objectives. An old ISO 27001 slide is a different meeting.

Incident and supplier files are ISO 42001 documentation when a third-party model or an outage can affect customers. If personal data enters prompts or training sets, note it. The main DPDP Act duties on notice, security and fiduciary obligations commence on 13 May 2027. Do not treat the full rulebook as already in force. Rules 1, 2 and 17 to 21 are the live parts now.

ISO 42001 documentation set showing the AI policy, inventory and records an auditor samples
Record Place in the system What Stage 2 samples
AI policy Mandatory Signed policy and a review date
Scope Mandatory Systems, sites and any exclusion reason
Roles Mandatory A named owner per AI system
AI system inventory Mandatory Purpose, status, owner, provider
Risk register Mandatory AI risk assessment with treatment
Impact assessment Mandatory when people are affected AI impact assessment and the change you made
Statement of Applicability Mandatory Include or exclude, with reasons
Operating procedures Mandatory for controls you claim A procedure that matches a live ticket
Competence records Mandatory Names, dates and the skill covered
Internal audit Mandatory A report that sampled a live system
Management review Mandatory Minutes with AI inputs and actions
Incident records Procedure mandatory; files when events happen A logged case or an explained nil period
Supplier records Mandatory when third parties are in scope Assessment plus the contract clause

Useful, and easy to overbuy: a dashboard, a poster of the RACI, a second wording of the same policy for the website, and a pile of blanks you never date. Keep them if they help a team work. Do not show them to a sampler as if they were the system.

A template becomes ISO 42001 documentation on the day the fields are filled. Before that it is stationery. Keep ISO 42001 documentation under document control. A file named Final_v7 on a laptop is how versions drift. After certification, the same folders have to survive surveillance audit. A green status from the implementation month will not.

Headings for the policy, before anyone signs

An ISO 42001 policy template gives you headings for purpose, scope and the commitment to responsible development and use. It does not name your models.

Buy an ISO 42001 policy template if the page is blank. Skip the purchase if legal already issued a policy the board signed.

An ISO 42001 policy template that still says “insert company name” will be a Stage 1 finding.

Compare any ISO 42001 policy template with clause 5.2 before you adopt the wording. The clause wants commitment from top management and a review you can show.

The useful part of an ISO 42001 policy template is the review cycle, not the adjectives in the opening paragraph.

Ask the seller of an ISO 42001 policy template whether the file includes roles and a pointer to the inventory. A policy that floats alone will be read against an empty folder.

An ISO 42001 policy template is one file. The system is the inventory, the risks and the impact records behind it.

Do not pay twice for an ISO 42001 policy template and a separate one-page policy that say the same thing.

When you edit an ISO 42001 policy template, put your legal entity on the face and the AI systems in an appendix the owner updates.

The one-page commitment

An AI policy template is the one-page commitment. It is narrower than the procedure set and narrower than the control catalogue.

Start with an AI policy template only when leadership has not already signed something you can amend.

An AI policy template should state who may deploy a model and who may stop it.

Leave the AI policy template in draft until the inventory exists, or the policy will describe a company you do not run.

Counsel can review an AI policy template. The product owner still has to match it to the feature you shipped.

If the AI policy template bans uses you already sell, fix the product or fix the policy before Stage 1.

Put a review date on the AI policy template. A policy with no date looks abandoned.

Translate the AI policy template into the language your delivery teams actually read, when that language is not English.

Keep the signed PDF next to the AI policy template source so nobody edits the live promise by accident.

Blanks worth buying, and the folder they should create

An ISO 42001 toolkit is a bundle of blanks: policy, inventory, risk register, impact record, Statement of Applicability and an audit plan.

The Seven Step shop sells an ISO 42001 toolkit for teams that want the headings already built. Ask for the current offer. This page does not list a price.

An ISO 42001 toolkit does not fill the owner column. Your staff do that in a working session, system by system.

Use an ISO 42001 toolkit as the folder structure, then stop buying more blanks. A sensible set looks like this: 01 policy, 02 scope, 03 roles, 04 inventory, 05 risk, 06 impact, 07 Statement of Applicability, 08 procedures, 09 competence, 10 internal audit, 11 management review, 12 incidents, 13 suppliers.

An ISO 42001 toolkit that includes dozens of policies and no inventory teaches the wrong lesson.

Check that the ISO 42001 toolkit you buy maps to clauses 4 to 10 and to Annex A, rather than stopping at a generic quality manual.

A good ISO 42001 toolkit labels each file as a record or a template so people know what Stage 2 will sample.

If you already run ISO 27001, ask whether the ISO 42001 toolkit reuses your document control procedure. Reusing the procedure is sensible. Copying an access-control objective onto a model and calling it done is how Stage 2 runs long.

The AI sample stays separate from the information-security sample. A European buyer may also ask about the EU AI Act. Most Annex III high-risk duties have applied since 2 August 2026. Your records are evidence for that conversation. They do not, by themselves, create a presumption of conformity.

After you buy the toolkit, schedule a working session to turn the ISO 42001 toolkit into records with names and dates.

How to file ISO 42001 documentation so a sampler can find it

One index page should list every current record, the owner and the version. Put the inventory at the top. Link each system to its risk line and its impact note. When a release changes a model, the index changes the same week. If two files disagree, the older one leaves the live folder.

Buy the toolkit

Buy the toolkit (Shop) if the folder is empty and you want the headings already built. We sell it through the Seven Step shop and we do not print a price on this page. Ask for the current offer at https://www.sevenstepconsulting.com/contact-us/. The implementation scope sits at https://www.sevenstepconsulting.com/iso-42001-aims-artificial-intelligence-management-system/.