ISO/IEC 42001

Where Chio Contributes

Chio contributes to operational clauses and reference controls for logging and third-party relationships.

Clauses 4 (context), 5 (leadership), most of 6 (planning), 7.1 through 7.4 (resources, competence, awareness, communication), and 10 (improvement) are largely organizational and are marked org-owned below.

Coverage Legend

Main Body Clause Mapping

Clauses 4 and 5: Context and Leadership

Clause 6: Planning

The underwriting inputs in the rows above come from chio-underwriting, which classifies an agent into one of four risk tiers: Baseline, Guarded, Elevated, and Critical, from evidence references (receipt history, reputation, certification, runtime assurance, settlement exposure, and metered billing). Its evaluator is fail-closed and emits typed reason codes, such as low_reputation, missing_certification, and pending_settlement_exposure. The tier and its reasons populate the risk column of a 6.1.2 risk assessment and an 8.2 impact assessment; the assessment artifact itself stays operator-owned.

Clause 7: Support

Clause 8: Operation

Clauses 9 and 10: Performance Evaluation and Improvement

Annex A Reference Controls

Annex A of ISO 42001 supplies a reference set of AI-specific controls. Control IDs follow the pattern A.x.y. Chio's strongest Annex A contribution is to A.6 (life cycle), A.7 (data), A.8 (information sharing), A.9 (use), and A.10 (third-party).

Statement of Applicability Patterns

A typical ISO 42001 Statement of Applicability names each Annex A control, states whether the control is applicable, justifies the decision, and identifies implementation evidence. Chio makes the evidence column concrete.

A.6.8:
  title: Recording of event logs
  applicability: applicable
  implementation_evidence:
    - chio signed receipt per invocation (allow or deny)
    - merkle checkpoint batches signed by kernel keypair
    - chain integrity verified via chio receipt checkpoint verify
    - per-receipt inclusion proofs emitted to inclusion-proofs.ndjson on export

A.7:
  title: Data for AI systems
  applicability: applicable
  implementation_evidence:
    - SqlQueryGuard column constraints
    - vector store guard for retrieval governance
    - response_sanitization for output redaction
    - data_flow guard for cross-tool transfer limits

Audit Evidence Patterns

Internal audit under Clause 9.2 needs repeatable evidence assembly. Chio's evidence export plus the receipt query API are the mechanical answer.

# Export the evidence package for the audit window.
# --since / --until are Unix seconds (Q1 2026 here).
$ chio evidence export \
    --policy-file ./policy.yaml \
    --receipt-db ./receipts.sqlite3 \
    --since 1767225600 \
    --until 1775001599 \
    --require-proofs \
    --output ./q1-iso-42001-evidence

# Sample the Annex A.6.8 event-log surface (100 allow + 100 deny).
# chio receipt list emits one JSON receipt per line (JSON Lines).
$ chio receipt list --receipt-db ./receipts.sqlite3 \
    --outcome allow --limit 100 > samples/allow.jsonl
$ chio receipt list --receipt-db ./receipts.sqlite3 \
    --outcome deny --limit 100 > samples/deny.jsonl

# Produce a compliance certificate for one governed session,
# an anchor for the management review.
$ chio cert generate \
    --session-id acp-session-01HQ0A... \
    --receipt-db ./receipts.sqlite3 \
    --output ./session-certificate.json

Known Gaps

• A.7.3 Data quality: out of scope at the tool-governance layer. Data-quality programs run in the data platform.
• A.7.5 Data preparation: out of scope. Preparation pipelines are operator-owned.
• A.6.3 SDLC evidence: Chio's own build pipeline enforces clippy, tests, and canonical JSON, but the customer's SDLC for their agent and its tool servers is operator-owned.
• Management review outputs: Chio's compliance certificates summarize operational posture, but the written management-review minutes remain an organizational artifact.

For the regulation-driven mapping against Article 19, Article 14, and Annex IV, see EU AI Act. For SOC 2, HIPAA, and PCI DSS control mappings, see Compliance Frameworks.