ISO 42001 and EU AI Act
Records for ISO 42001 and the EU AI Act.
When an auditor or a customer asks how your company governs its use of AI, the answer is already on the record.
What auditors ask
Each question, and where the answer is.
Which AI tools do people use, and who approved them?
The AI tool register: owner, purpose, status, allowed data and next review for each tool.
ISO 42001 A.9.4, A.10.3EU AI Act Scoping for Art. 26 and 50
Is there an AI policy, and is it kept up to date?
Numbered policy versions that cannot be edited, each with an owner and a review date.
ISO 42001 5.2, A.2.2, A.2.4EU AI Act Art. 4
Do staff know the rules, and did they agree to them?
Each person agrees to the exact text of a version, with the time. Reminders after 7 days.
ISO 42001 7.3, 7.4EU AI Act Art. 4
Who is responsible for AI here?
Five roles checked on the server. Every tool and every risk has a named owner.
ISO 42001 5.3, A.3.2EU AI Act Art. 26(2), if high-risk
What could go wrong with AI, and what is being done?
The risk register: likelihood times impact, owner, mitigation, due date and history.
ISO 42001 6.1, 8.2, 8.3EU AI Act Art. 26(5), if high-risk
How do people check text before it goes into an AI tool?
The scanner checks pasted text and text files in the browser. Summaries keep counts only.
ISO 42001 A.9.2EU AI Act None directly
Who hears when something is due or overdue?
Alerts in the app and by email: overdue risks, reviews due, unagreed policies, high or critical scans.
ISO 42001 9.1EU AI Act None directly
How do I know these records were not changed?
An activity trail that shows if any record was changed, as CSV with each record’s hash.
ISO 42001 7.5.3EU AI Act None directly
| The auditor asks | Where it is in Openn Shield | ISO 42001 | EU AI Act |
|---|---|---|---|
| Which AI tools do people use, and who approved them? | The AI tool register: owner, purpose, status, allowed data and next review for each tool. | A.9.4, A.10.3 | Scoping for Art. 26 and 50 |
| Is there an AI policy, and is it kept up to date? | Numbered policy versions that cannot be edited, each with an owner and a review date. | 5.2, A.2.2, A.2.4 | Art. 4 |
| Do staff know the rules, and did they agree to them? | Each person agrees to the exact text of a version, with the time. Reminders after 7 days. | 7.3, 7.4 | Art. 4 |
| Who is responsible for AI here? | Five roles checked on the server. Every tool and every risk has a named owner. | 5.3, A.3.2 | Art. 26(2), if high-risk |
| What could go wrong with AI, and what is being done? | The risk register: likelihood times impact, owner, mitigation, due date and history. | 6.1, 8.2, 8.3 | Art. 26(5), if high-risk |
| How do people check text before it goes into an AI tool? | The scanner checks pasted text and text files in the browser. Summaries keep counts only. | A.9.2 | None directly |
| Who hears when something is due or overdue? | Alerts in the app and by email: overdue risks, reviews due, unagreed policies, high or critical scans. | 9.1 | None directly |
| How do I know these records were not changed? | An activity trail that shows if any record was changed, as CSV with each record’s hash. | 7.5.3 | None directly |
Openn Shield gives your auditor records for these requirements. It holds no ISO 42001 certification, does not certify you and is not legal advice.
EU AI Act
For companies that use AI tools.
Most companies are deployers: they use AI systems others build. These duties most often apply.
AI literacy, Article 4
Since 2 February 2025, companies must take measures for their staff’s AI literacy. A policy people agreed to is one; training is up to you.
Transparency, Article 50
Deepfakes and AI text published to inform the public must be disclosed, with some exceptions. Shield does not label content.
High-risk uses, Article 26
Uses such as screening job applicants bring more duties. Shield records the tool, owner and risks, not the system’s own logs.
Banned practices, Article 5
Some uses, such as emotion recognition at work, are banned. Mark them Restricted. Shield cannot stop a person using a website.
The Act applies in stages and its guidance is still being written. Check the current text, or ask a lawyer, before you rely on a date.
Downloads
Records you can hand over.
Owners, admins and auditors download them at any time; the full ZIP is for owners. Each download is written to the activity trail.
- The AI tool register, as CSV
- Who agreed to each policy version, and when, as CSV
- The risk register, as CSV
- Saved scan summaries, counts only, as CSV
- The activity trail, with each record’s hash, as CSV
- Every record in the workspace, as a ZIP of JSON files
Show how your company uses AI.
Try every feature for 7 days.