ISO/IEC 42001 Nonconformity & Corrective Action Tracker
A register for the nonconformities your AI management system raises. For each one, record where it came from, the clause or Annex A area, how serious it is, the root cause, the correction that fixes the instance and the corrective action that removes the cause, then check the action worked. The dashboard shows open items by severity, what is overdue and which causes keep coming back.
Loaded with sample data for a fictional insurer. Saved in your browser only. A template, not certification advice.
You are looking at sample data for a fictional insurer. Edit anything, or . Your changes are saved in this browser only.
Open
6
7 recorded
Overdue
2
past due or check date
Awaiting check
1
effectiveness not yet verified
Repeat causes
1
patterns to escalate
Open by severity
Overdue
Due in the next 14 days: NC-004
Repeat-cause detection
- Process / method cause, Annex A.6 AI system life cycleNC-003, NC-006: Same primary cause category against the same requirement.
Flags the same cause category against the same requirement, root causes that share most key words, and failed effectiveness checks, all within 12 months. A repeat usually means the earlier corrective action fixed the symptom, not the cause.
Closed: 1 · effectiveness checks passed: 1
TL;DRWhat this tracker does
5 points
- ISO/IEC 42001 clause 10.2 expects you to react to a nonconformity, correct it, find its cause, act so it does not recur, check the action worked, and keep records of all of it.
- Log each nonconformity with its source (internal audit, external audit, incident, complaint, monitoring), the clause or Annex A area, a description and a severity (major, minor or observation).
- Work the root cause with a 5-whys chain or AI-adapted fishbone categories, then record the correction and the corrective action separately, with an owner, a due date and an effectiveness check.
- The dashboard shows open items by severity, overdue actions and checks, and repeat causes across the last 12 months.
- Free to use, saved in your browser. CSV and Markdown export are part of Pro.
What an auditor looks for in your corrective action records
At a surveillance or Stage 2 audit, the auditor will pick a few nonconformities and follow each one end to end. They want to see that the cause was analysed rather than assumed, that the action chosen addresses that cause, that someone owned it and finished it, and that you went back later and checked it worked. A register where every entry says "retrained the user" and closes the same day usually prompts a finding against clause 10.2 itself.
AI systems add causes that a classic ISO 9001 or ISO/IEC 27001 log rarely sees: data drift nobody investigated, prompts changed outside change control, a supplier swapping the underlying model, an impact assessment that was not revisited when an input feature changed. The fishbone categories here include Data, Model / technology and Suppliers for that reason, and repeat-cause detection uses them to show when the same weakness keeps producing findings.
Feed the dashboard into your management review: the status of nonconformities and corrective actions is one of the inputs leadership is expected to consider. To rehearse how findings are raised and handled in a certification audit, try the Stage 2 audit lab.
Frequently asked questions
What does ISO/IEC 42001 clause 10.2 require for nonconformities?
When a nonconformity occurs, the organisation reacts to it (controls and corrects it and deals with the consequences), evaluates whether action is needed to remove its cause so it does not recur or occur elsewhere, implements that action, reviews whether the action was effective, and changes the management system if needed. Documented information is kept as evidence of the nature of the nonconformity, the actions taken and their results. This tracker gives each of those steps a field.
What is the difference between a correction and a corrective action?
A correction fixes the instance in front of you: roll back the prompt, update the missing impact assessment, contact affected customers. A corrective action removes the cause so the problem does not come back: add the impact-assessment trigger to the release checklist, put prompt changes under change control. Auditors often find organisations that only ever record corrections, which is why the tracker keeps them as separate fields.
How do auditors grade major and minor nonconformities?
Grading rules belong to each certification body, so check yours. In common practice a major nonconformity is a requirement not met at all, or a breakdown that puts the management system outcomes at risk, and it usually has to be resolved before certification is recommended. A minor is an isolated lapse where the requirement is largely met, normally closed through an accepted corrective action plan. An observation is a weakness that is not yet a nonconformity.
How does repeat-cause detection work?
Within a 12-month window it flags nonconformities that share the same primary cause category against the same clause or Annex A area, pairs whose root-cause statements share most of their key words, and any item whose effectiveness check came back not effective. A repeat usually means an earlier corrective action addressed the symptom rather than the cause.
Where is my data stored, and is this tool free?
Entries are saved in your own browser with localStorage; nothing is sent to PlayCISO, and clearing site data or using a private window removes them. Logging, root cause analysis and the dashboard are free. Exporting the register to CSV or Markdown is part of Pro ($5/month or $40/year).
Is this certification advice?
No. It is a template and tracker built from the published structure of ISO/IEC 42001, with sample data for a fictional insurer. It does not reproduce the standard. Your certification body decides how findings are graded and closed.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.