ISO/IEC 42001 Documented Information Register
One list of the documents and records your AI management system runs on. It starts with what an AIMS typically needs, from the scope and AI policy to management review results and corrective actions. Give each one an owner, a version, a location, a review cycle and a retention period, and the flags show what an auditor would find missing. Each pre-loaded item links to the PlayCISO tool that helps you produce it.
The pre-loaded list is a starting point: check the ISO/IEC 42001 text for the definitive list. Loaded with sample data for a fictional lender. Saved in your browser only. A template, not certification advice.
You are looking at sample data for a fictional lender. Edit anything, or (17 typical items, fields empty). Your changes are saved in this browser only.
Ready
50%
approved with no flags
Missing owner
2
nobody accountable
Review overdue
3
0 never reviewed
Missing retention
3
no retention period set
By status (8 documents, 10 records)
Flagged items
Reviews due in the next 30 days
Next review = last review + frequency. Items reviewed on change, and records that are retained rather than reviewed, are not scheduled.
TL;DRWhat this register does
5 points
- ISO/IEC 42001 clause 7.5 expects the documented information your AI management system needs to be identified, kept current, approved, available where needed, protected and retained. This register lists it in one place.
- It starts with the 17 documents and records an AIMS typically needs: scope, AI policy, objectives, risk assessment process and results, risk treatment plan and SoA, impact assessment, competence evidence, operational records, monitoring results, internal audit, management review and nonconformities. Check the standard text for the definitive list.
- For each item record whether it is a document or a record, its owner, version, location, review frequency, last review, retention period, access classification, linked clause and status.
- Flags show items with no owner, an overdue review or no retention period, and each pre-loaded item links to the PlayCISO tool that helps produce it.
- Free to use, saved in your browser. CSV and Markdown export are part of Pro.
How auditors test documented information
At Stage 1 the auditor checks that the documented information the standard asks for exists. At Stage 2 and surveillance audits they sample it: is this the approved version, who owns it, when was it last reviewed, where is the record of the last risk assessment, how long will you keep it? A register that answers those questions for every item makes that part of the audit short.
AI adds records that a classic ISO/IEC 27001 register may not have: impact assessment results per AI system, model release and monitoring records, and competence evidence for data scientists and AI security engineers. Build the scope with the AIMS scope builder, the SoA with the SoA builder, objectives with the objectives planner, competence evidence with the competence matrix, and keep nonconformities in the nonconformity tracker.
Before an audit, index the evidence itself in the evidence binder and take the register's flags into your management review.
Frequently asked questions
What documented information does ISO/IEC 42001 require?
An AIMS typically needs its scope, AI policy, AI objectives, the AI risk assessment process and results, the risk treatment plan and Statement of Applicability, the AI system impact assessment process and results, evidence of competence, operational planning and control records, monitoring and measurement results, the internal audit programme and results, management review results, and records of nonconformities and corrective actions. Clause 7.5 also covers documented information the organisation itself decides is necessary. This list is a starting point: check the standard text for the definitive list.
What is the difference between a document and a record?
A document is maintained: it is kept current and version-controlled, like the AI policy or the risk assessment process. A record is retained: it is evidence of what happened, like an internal audit report or the results of a risk assessment, and is not edited afterwards. The register keeps them apart because they are controlled differently: documents get review cycles, records get retention periods.
What does clause 7.5 expect for control of documented information?
In plain terms: documented information is identified and described (title, date, author or reference), in a suitable format, reviewed and approved for suitability, available and suitable where and when it is needed, adequately protected (for example against loss of confidentiality or integrity), and controlled for distribution, access, storage, changes, retention and disposition. The fields in this register map to those expectations.
What do the flags mean?
Missing owner: nobody is accountable for keeping the item current. Review overdue: the last review plus the review frequency is in the past. No review recorded: the item has a review cycle but no review date. Missing retention: no retention period is set, so nobody knows when it can be disposed of. No location: the controlled copy cannot be found. An auditor sampling documented information usually checks exactly these.
How long should AIMS records be kept?
ISO/IEC 42001 leaves retention periods to you. Set them from your legal, regulatory and contractual obligations and from what you need for audits, typically at least one full certification cycle. The sample uses illustrative periods for a fictional lender; they are not recommendations.
Where is my data stored, and is this tool free?
Everything is saved in your own browser with localStorage; nothing is sent to PlayCISO, and clearing site data or using a private window removes it. The register, flags and dashboard are free. Exporting to CSV or Markdown is part of Pro ($5/month or $40/year).
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.