ISO/IEC 42001 is the certifiable one, which means an auditor will eventually ask to see the management system rather than hear about it. UrNammu seeds all 38 Annex A controls and attaches them to the AI systems, agents and policies they govern, so the evidence an audit needs is produced as a by-product of running the estate rather than assembled the month before.
Coverage roll-ups per system and across the estate, with evidence attached to each control
Seeded Annex A controls, by clause
A.2 Policies related to AI
3The AI policy, its alignment with other organisational policies, and its review.
A.3 Internal organisation
2AI roles and responsibilities, and reporting of concerns.
A.4 Resources for AI systems
5Documentation of data, tooling, compute and human resources.
A.5 Assessing impacts of AI systems
4The impact assessment process, its documentation, and impacts on individuals and society.
A.6 AI system life cycle
9Responsible design and development, requirements, verification and validation, deployment, operation and monitoring, technical documentation and event logs.
A.7 Data for AI systems
5Data acquisition, quality, provenance and preparation.
A.8 Information for interested parties
4System documentation, external reporting, incident communication.
A.9 Use of AI systems
3Processes and objectives for responsible use, and intended use of the system.
A.10 Third-party and customer relationships
3Allocating responsibilities across suppliers and customers.
How UrNammu covers it
A.6 life cycle maps to lifecycle status
Systems move through Draft, Under Review, Approved, Deployed and Retired with staged sign-off at each gate, and A.6.2.8 event logs are not a separate exercise — the proxy already records model calls, tool use and policy decisions per system.
A.5 impact assessments, attached to the system
Risk assessments and EU AI Act classifications live on the system record, and DPIAs and impact assessments attach as evidence artifacts, so A.5.3 documentation points at something real.
A.10 third parties, observed rather than asserted
Provider security posture is audited and graded A to F, agents’ MCP servers and tools are allowlisted and observed at the proxy, and shadow AI discovery finds the suppliers nobody declared.
Audit-ready output
Every mutation writes an audit log entry linked to the user and the entity. Reports build from templates, export to PDF, CSV or JSON, and can be scheduled to land in an auditor’s or board’s inbox on a cadence.
Frequently asked questions
Does UrNammu certify us against ISO 42001?
No — certification comes from an accredited body. UrNammu holds the management system and produces the evidence and coverage an auditor asks for, which is the part that usually takes the months.
How does this relate to our existing ISO 27001 work?
ISO/IEC 42001 is deliberately structured like the other management system standards, and much of the security control work is shared. UrNammu’s crosswalk inherits assessments between Annex A controls and SOC 2 criteria so the overlap is not re-evidenced.
All 38 Annex A controls, or a subset?
All 38, seeded with their Annex A identifiers across clauses A.2 through A.10, alongside 19 EU AI Act articles, 19 NIST AI RMF controls and 20 SOC 2 criteria — 96 controls in total.
UrNammu is governance software, not legal advice. Control mappings and derived risk tiers are inputs to your own legal and compliance review.
Other frameworks
EU AI Act
Classify each AI system’s EU AI Act risk tier, derive the obligations that follow, and evidence them control by control against 19 seeded articles.
EU AI Act Compliance Software →NIST AI RMF
Operationalise the NIST AI Risk Management Framework: 19 seeded controls across Govern, Map, Measure and Manage, assessed per system with evidence.
NIST AI RMF Software →SOC 2
Bring the AI estate into SOC 2 scope: 20 seeded Trust Services Criteria per system, with access, change and monitoring evidence produced by the proxy.
SOC 2 Compliance for AI Systems →