Framework mapping

ISO/IEC 42001:2023 (AI Management Systems)

Publisher. ISO/IEC

Control mappings. 22 controls

Statement date. 2026-08-03

AI Management System (AIMS) requirements. Etch addresses clauses 7 (Support), 8 (Operation), and 9 (Performance evaluation) through signed governance records, bounded authority receipts, and continuous measurement primitives.

Download PDF for procurement All frameworks

Control mapping

Every row names a specific control from the framework and describes how Etch addresses it. The response prose commits to what Etch signs on the chain, not to runtime enforcement. Etch is an evidence layer.

Control ref	Control name	How Etch addresses it
`5.1`	Leadership and commitment	Bounded authority receipts record the identity, scope, and expiration of each human signer. Leadership approval of an AI system change is a signed event with a specific signer, not a document reference.
`6.1`	Actions to address risks and opportunities	The extended governance schema records invalidation_conditions on every event. When a risk trigger fires, the invalidation condition is queryable back to the specific event that flagged it.
`6.2`	AI objectives and planning	Mission field on the governance record binds the AI objective at write time. Drift detection tracks mission drift as one of the 8 categories.
`7.1`	Resources	Resource use per session is reflected in the session risk score field and the autonomy level field. Both are chain signed alongside the underlying events.
`7.2`	Competence	The authority identity on each bounded authority receipt is verifiable via the per project pubkey registry. Competence claims tie to identifiable signers.
`7.3`	Awareness	The signed model card attestation records the system_prompt_hash and policy_hash active at each session. Awareness of the operating context is chain committed.
`7.4`	Communication	Signed dissent event captures second line of defense disagreement without requiring the disagreement to reach a supersession. The record preserves the exact dissent text and identity.
`7.5`	Documented information	Every referenced document is committed by content hash via the artifact hash endpoint. A document reference on the chain cannot silently be replaced with a different document.
`8.1`	Operational planning and control	The extended governance schema records policy_hash, authority, assumptions, uncertainty, and invalidation conditions at each event. Operational plan versions are chain signed.
`8.2`	AI system impact assessment	Session risk score field records the upstream vendor's risk score at each event. Impact assessment evidence is chain signed alongside the event it assessed.
`8.3`	AI system life cycle	Supersession edge event records DAG structure over prior versions with intent enum (compat, breaking, deprecation, correction, refinement). Lifecycle transitions are queryable back to the exact transition event.
`9.1`	Monitoring, measurement, analysis	Recoverability measurement returns time to reconstruct and evidence completeness. Drift detection engine quantifies 8 dimensional drift. Corrigibility self audit measures policy suppression posture. All three are chain signed.
`9.2`	Internal audit	Session scope chain view emits a scoped bundle for an internal auditor without exposing the full project chain. Custody export bundle produces a self authenticating slice.
`9.3`	Management review	Signed postmortem event records the management review outcome with signer identity and optional retroactive confidence downgrade. Review outcome is chain signed.
`10.1`	Continual improvement	Learning persistence event chain signs the cross session knowledge update with propagation semantics enum (override_prior, augment_prior, deprecate_prior). Continual improvement decisions are chain signed.
`A.2.2`	AI system objectives	Mission field on the governance record binds the AI objective at write time. Drift comparator alerts when the mission text changes.
`A.2.3`	Risk management processes	Session risk score field and autonomy level field are chain signed alongside events. The verifier flags high autonomy events for scoped review.
`A.3.2`	Impact assessment	Model card attestation binds the exact model + system prompt + policy in force at each session. Impact assessment can be reconstructed against the specific artifacts.
`A.6.2.2`	Data quality for AI systems	Evidence field on the governance record binds source hashes. Data quality claims tie to specific source artifacts by content hash.
`A.7.4`	System documentation	Artifact hash endpoint chain signs any documentation artifact by SHA 256. Documentation cannot be silently revised without a new chain signed event.
`A.9.3`	Reporting of concerns	Signed dissent event provides a first class primitive for reporting concerns without requiring the concern to reach a supersession. The dissent text and signer identity are chain signed.
`A.10.4`	Third party relationship management	Cross chain federation lets a supplier chain event reference a customer chain event by derived chain_id. Third party relationship records are cryptographically walkable across organizational boundaries.