ISO 42001 Mandatory Documents: The Essential 2026 List by Clause

The ISO 42001 mandatory documents are the records an auditor will insist on seeing, and the ones you can fail on if they are missing. Knowing exactly which they are saves weeks of drafting documents nobody asked for.

The standard uses the term documented information, split into information you must maintain, such as policies and procedures, and information you must retain, such as results and evidence. Both count as required.

This guide lists the ISO 42001 mandatory documents clause by clause, explains what each should contain and flags the optional ones. For the clause detail, see our ISO 42001 requirements guide.

Maintain versus retain: the rule behind documented information

Clause 7.5 governs documented information. Anything the standard says must be maintained is a living document, such as the scope statement or AI policy. Anything it says must be retained is a record of what happened, such as audit results.

The difference affects how you handle each file. Maintained documents need version control, approval and review. Retained records need protection from alteration and a retention period.

The clause also lets you add other documents your system needs to work. These are not mandatory in themselves, but you must control them once you decide to have them.

The authoritative clause text is described at ISO/IEC 42001:2023.

ISO 42001 mandatory documents for context and leadership (clauses 4 and 5)

The AI management system scope is mandatory, and you must keep it as documented information. It should name the AI systems, organization units, roles and locations covered. See our ISO 42001 scope guide.

The AI policy is also mandatory. It must be appropriate to the organization, give a framework for objectives, include commitments to requirements and continual improvement and be available to interested parties as appropriate.

Roles and responsibilities must be assigned and communicated. Many organizations record them in a roles document or governance charter, which is a practical way to show the requirement is met.

ISO 42001 mandatory documents for planning (clause 6)

Clause 6 produces the most important records. You need the AI risk assessment process and its results, the risk treatment process and plan, and the Statement of Applicability with justification for inclusions and exclusions.

You also need the AI system impact assessment process and the results of those assessments, plus the AI objectives and the plans to achieve them. Our ISO 42001 impact assessment guide explains the content.

These documents link together. The risk assessment drives the treatment plan, the plan drives the controls in the Statement of Applicability, and the objectives measure whether the controls work.

Our toolkit supplies drafted versions of these records, so the ISO 42001 Toolkit saves most of the drafting time.

Clause	Document or record	Maintain or retain
4.3	AIMS scope statement	Maintain
5.2	AI policy	Maintain
6.1.2-6.1.4	Risk assessment, treatment plan, SoA, impact assessment results	Maintain process, retain results
6.2	AI objectives and plans	Maintain
7.2	Competence evidence	Retain
9.2-9.3	Audit results and management review results	Retain
10.2	Nonconformity and corrective action records	Retain

Support documents (clause 7)

Competence records are required. Keep evidence that the people doing AI work have the necessary education, training or experience, such as training logs, CVs and assessments.

Awareness evidence is useful too: records that staff know the policy and their contribution. Communication arrangements should be defined, though many organizations keep this as a short procedure.

Finally, you need a way to control documented information. A document control procedure, even a simple one, shows how you version, approve, distribute and protect files.

Keep training records simple: date, topic, attendees and the competence being evidenced. Auditors compare them with the people actually doing AI work, so make sure developers, reviewers and risk owners are covered.

Operational documents (clause 8)

Clause 8 requires you to plan, implement and control the processes needed to meet requirements. Keep documented information to the extent needed to have confidence the processes were carried out as planned.

In practice this includes records from the risk assessments, risk treatment and impact assessments you perform at planned intervals, along with change records for AI systems and supplier assessments.

Operational records vary by organization, so choose what proves your processes work. An auditor will sample them, so keep them findable.

If you are unsure how much operational evidence is enough, ask what you would need to show a sceptical customer that the process really ran last quarter.

Performance evaluation records (clause 9)

Retain evidence of monitoring and measurement results, the internal audit programme and results, and the results of management reviews. These are all explicitly required.

The internal audit programme should show frequency, methods, responsibilities and reporting. The internal audit guide explains what a good report contains.

Management review records must show the inputs considered and the decisions taken. See our management review guide for the structure.

Link every record back to the clause it satisfies. A simple index column in your document register does the job and speeds up audits.

Improvement records (clause 10)

You must retain evidence of the nature of nonconformities, any subsequent actions taken and the results of any corrective action. A simple corrective action log is enough if it captures root cause, action, owner and closure evidence.

Evidence of continual improvement is also expected, even though the standard does not prescribe a form. Management review decisions and closed actions usually provide it.

Keep the log alive. An empty log at audit time suggests nobody is looking for problems.

A log that shows both small fixes and larger changes proves the improvement loop is alive.

Annex A documents that follow your controls

Annex A controls often call for specific documents: an AI system documentation set, data quality and provenance records, user information, a process for reporting concerns and supplier agreements.

Which of these you need depends on your Statement of Applicability. If you include a control, you need evidence that it operates. If you exclude it, you need a reason.

Our ISO 42001 controls guide shows what each area expects, so you can plan the documents together.

Documents that are optional but useful

Many documents are not required by the standard but make the system easier to run: a glossary, a RACI chart, a supplier register, an AI incident log and a model card template.

Add them when they solve a real problem for your team. Do not create a document just because a template includes it. Every document you create is one you must keep current.

The best test is simple: would the system be harder to operate or audit without it? If yes, keep it.

Resist adding documents because a competitor has them. Each extra file needs an owner, version control and regular review, and the audit will test all of it.

Common documentation mistakes

Typical mistakes include policies that nobody has approved, risk assessments without owners and Statements of Applicability that copy the standard with no justification.

Another is keeping everything in personal folders with no version control. Auditors look for evidence of control, not just content.

Finally, do not over-document. A slimmer set of ISO 42001 mandatory documents that people use beats a thick manual that they ignore.

Keep the list of ISO 42001 mandatory documents on one page, with owners and review dates.

Review your ISO 42001 mandatory documents before every audit to catch stale versions.

Who owns each document

Assign an owner to every document: a named role, not a team. The owner keeps it current, answers audit questions and proposes changes.

Typical owners are top management for the policy and scope, the AI governance lead for procedures, risk owners for the risk register and the internal auditor for audit records.

Add the owner, version and next review date to a simple document register. It is the first thing an auditor will ask for and the easiest way to prove control of your ISO 42001 mandatory documents.

A one-week documentation sprint

Day one: list what you already have against the table above. Day two: draft the gaps, starting with scope, policy and objectives. Day three: finish risk and impact assessment templates.

Day four: write the Statement of Applicability and the corrective action log. Day five: set up document control, assign owners and approve the set through top management.

A sprint like this gives you a complete skeleton. The real work afterwards is to operate the processes and collect records, which no sprint can fake.

ISO 42001 mandatory documents FAQ

How many documents does ISO 42001 require?

There is no fixed count. The standard lists required documented information across clauses, which usually amounts to roughly a dozen core documents and records, plus those needed for the Annex A controls you select.

Do we need a documented procedure for everything?

No. The standard asks for documented information where it says so and where you need it for the system to be effective. Many processes can be short and lightweight.

Can we use templates?

Yes, as a starting structure. Tailor them to your systems, because auditors read what is specific to your organization.

Are the Annex A documents mandatory?

Only for controls you include in your Statement of Applicability. Excluded controls need a justification instead.