The certification body conducts surveillance under ISO/IEC 17021-1:2015, 9.6.2, with surveillance audits at least once a year (the first within twelve months of the certification decision) covering continued fulfilment of ISO/IEC 42001 and changes to the AI systems, the AIMS and its risks. Certification bodies applying the standard review the complaints and appeals received, verify that the client investigated nonconformities and implemented corrective action, and record in the surveillance report the closure of earlier nonconformities, the current statement of applicability version and significant changes since the last audit. For an AIMS that manages high-risk AI systems or AI used for sensitive purposes (health, safety, individual rights), Annex A.4 provides for client surveillance beyond the regular audits, which can mean additional audits or extraordinary surveillance measures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.