ISO/IEC 42001:2023 A.6.2.6: AI system operation and monitoring

What else in your programme already covers this

This control maps to 40 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

EU AI Act · 7 controls

EUAI-Art.13 Transparency and provision of information to deployers
EUAI-Art.14 Human oversight
EUAI-Art.15 Accuracy, robustness and cybersecurity
EUAI-Art.20 Corrective actions and duty of information
EUAI-Art.26 Obligations of deployers of high-risk AI systems
EUAI-Art.72 Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems
EUAI-Art.9 Risk management system

NIST AI Risk Management Framework (AI RMF 1.0) · 5 controls

AIRMF-MN-4.1 Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management
AIRMF-MS-1.2 Appropriateness of AI metrics and effectiveness of existing controls is regularly assessed and updated, including reports of errors and impacts on affected communities
AIRMF-MS-2.4 The functionality and behavior of the AI system and its components, as identified in the MAP function, are monitored when in production
AIRMF-MS-3.1 Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts
AIRMF-MS-4.3 Measurable performance improvements or declines based on consultations with relevant AI actors including affected communities, and field data about context-relevant risks and trustworthiness characteristics, are identified and documented

CIS Controls v8 · 4 controls

CIS-13.1 Centralize Security Event Alerting
CIS-13.6 Collect Network Traffic Flow Logs
CIS-8.2 Collect Audit Logs
CIS-8.9 Centralize Audit Logs

NIST Cybersecurity Framework 2.0 · 4 controls

NIST-CSF-DE.AE-06 Information on adverse events is provided to authorized staff and tools
NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles
NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring

NIST SP 800-53 Rev 5 · 4 controls

NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-PL-7 PL-7 Concept of Operations
NIST800-SC-38 SC-38 Operations Security
NIST800-SI-4 SI-4 System Monitoring

SOC 2 · 4 controls

SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
SOC2-CC7.2 CC7.2 Monitoring system components for anomalies
SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

ISO 27002:2022 · 3 controls

5.37 Documented operating procedures
8.16 Monitoring activities
8.32 Change management

ASEAN Guide on AI Governance and Ethics · 2 controls

AIGE-OM-9 Deployment, monitoring and review
AIGE-P7 Robustness and Reliability

APRA CPS 234 · 1 control

CPS234-30 Detection and Response Mechanisms

Australia National Framework for the Assurance of AI in Government (2024) · 1 control

5.4 5.4 Monitor and evaluate

FedRAMP High · 1 control

CA-7 Continuous Monitoring

NIST SP 800-218 · 1 control

SP800-218-RV.3.4 Document Lessons Learned

NSW AI Operational Policy (2026) · 1 control

5.4.2.e 5.4.2 e Monitoring

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 A.6.2.6 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

If you hold NIST AI Risk Management Framework (AI RMF 1.0)78.9% covered · 8 gaps If you hold EU AI Act57.9% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

See the released pairs, $299 each Browse the graph free