ISO 42001 Audit Trail Requirements: What the Standard Actually Demands

ISO/IEC 42001:2023 is an international standard for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS). ISO describes it as a management-system standard covering policies, objectives, processes, risk and opportunity management, and continual improvement.

The important distinction: ISO/IEC 42001 is not a specification for a cryptographic AI decision ledger. It does not, by itself, require SHA-256 hash chains, RFC 3161 timestamps, or independent cryptographic verification of every AI decision.

What the standard is actually about

The standard requires organisations to establish and operate an AI management system. That includes documented information, operational planning and control, monitoring and measurement, internal audit, management review, and corrective action. The exact evidence required for an organisation depends on its scope, processes, risks and implementation.

Why audit trails still matter

An AIMS needs information showing that relevant processes are operating as intended. For an AI system, useful operational evidence may include risk assessments, approvals, system changes, monitoring results, incidents, corrective actions, and records showing how governance controls were applied.

That creates a practical distinction between management-system evidence and cryptographic integrity mechanisms. The former is part of demonstrating that an AIMS operates. The latter is one possible technical method for strengthening the integrity and provenance of selected records.

Where KairoNull fits

KairoNull can complement an AIMS by capturing AI decision context at runtime, linking events to the applicable governance control state, and producing structured evidence for review. Its hash chaining and timestamping are implementation mechanisms that can make alterations detectable. They should not be presented as requirements imposed by ISO 42001.

What should not be claimed

The useful operational question

Can your AIMS produce reliable evidence that governance processes were followed, risks were assessed, controls were monitored, and relevant decisions or corrective actions can be reconstructed when reviewed?

If the answer is no, improving runtime evidence capture may materially strengthen the operational side of the management system. Whether cryptographic integrity adds enough incremental value to justify a purchase is a separate buyer question.