How AI Infrastructure Monitoring Supports an ISO 42001 Management System

Infrastructure monitoring can supply audit evidence for four of the ten requirement areas in ISO 42001, the international standard for managing AI in an organization. Nemko, a testing and certification company, groups the standard's requirements into those ten areas.

The four areas are risk and opportunity management, resources, documented information, and operational planning and control. The other six need records that managers write and approve, such as the AI policy and leadership meeting minutes.

What ISO 42001 Requires From an AI Management System

ISO/IEC 42001 sets requirements for building, running and improving an AI management system (AIMS), the policies, roles and processes an organization uses to govern its AI. ISO published it in December 2023 together with the IEC, a second international standards body.

The standard runs on Plan-Do-Check-Act, a repeating cycle of planning work, doing it, checking the results and fixing gaps. An organization measures its AI systems against the plan in the check step, using monitoring data.

ISO 42001 is the first certifiable international standard for AI management systems, according to Certiprof, a certification body for professionals in ISO standards. ISO names three earlier AI standards that give definitions and guidance for the same work:

1. ISO/IEC 22989: sets the terms and concepts for AI, so teams describe their systems in the same words.
2. ISO/IEC 23053: describes a common framework for AI systems built on machine learning.
3. ISO/IEC 23894: gives guidance on managing AI risk, which an organization can use inside its ISO 42001 risk process.

What Are the Ten ISO 42001 Requirement Areas?

Nemko's summary groups the standard's requirements into ten areas, from the AI policy to day-to-day operations:

1. AI management system: the organization runs a management system that covers its AI at each stage of a system's life.
2. Organizational context: the organization names the internal and external factors that shape its AI work.
3. Leadership and commitment: senior leaders drive the management system and its improvement.
4. AI policy: the organization sets a written AI policy.
5. Roles, responsibilities and authorities: the organization defines each person's role and reporting line.
6. Risk and opportunity management: the organization runs a risk assessment to find and treat AI risks and opportunities as part of continuous improvement.
7. AI system impact assessment: the organization assesses how its AI systems affect people and society, and records the results.
8. Resources and competence: the organization provides the people, skills and resources for its AI systems.
9. Documented information: the organization controls the documents and records behind its management system.
10. Operational planning and control: the organization plans, runs and controls its AI processes, including process changes.

Each area draws its main evidence from one of two places:

Which ISO 42001 Requirement Areas Get Evidence From Infrastructure Monitoring?

Telemetry, the health and usage readings each server sends to a monitoring system, supplies evidence for four of the ten areas.

Zettabyte's zWARE software tracks GPU, network card, power and system health on GPU clusters in fine detail. It flags faults as they happen and starts automated recovery.

Auditors also check Annex A controls, the reference practices an organization picks from the standard. Each of the four areas has a matching control or risk source, listed in Standards Australia's identical edition of the standard:

1. Risk and opportunity management: alerts show when a hardware fault or overload appeared, and recovery events show how the team handled the fault. Annex C of the standard names system hardware issues as a source of AI risk, so hardware alerts belong in the risk assessment.
2. Resources and competence: control A.4.5 asks for documentation of the computing resources behind each AI system. A GPU, network and power inventory drawn from monitoring data gives that documentation. Training and hiring records cover the competence half of this area.
3. Documented information: a timestamped, searchable telemetry archive counts as a controlled record once the organization sets its retention period and access rules.
4. Operational planning and control: control A.6.2.6 asks for monitoring of AI systems in operation, and control A.6.2.8 asks for event logs. Monitoring records and change histories show whether each process ran to plan.

Sprinto, a compliance software company, says ISO 42001 monitoring has to cover model performance, data behavior and real-world outcomes as well as system uptime. GPU and power readings cover the uptime part, so controls A.6.2.6 and A.6.2.8 also need model and data monitoring.

Which ISO 42001 Areas Depend on Management Records?

Six areas depend on documents that managers write and approve, such as policies, meeting minutes and role charts:

1. AI system impact assessment: a written record of how each AI system affects people, groups and society. GPU and power readings don't measure those effects.
2. Organizational context: a documented analysis of the internal and external factors that shape the organization's AI work.
3. Leadership and commitment: minutes, approved policies and budget decisions that show senior leaders driving the management system.
4. AI policy: the written policy, with its approval and version history.
5. Roles, responsibilities and authorities: org charts and responsibility matrices that set accountability for each decision.
6. AI management system: the combined AIMS documents that show how the organization manages AI across each system's life.

How ISO 42001 Differs From an Information Security Standard and the EU AI Act

Certiprof's comparison gives the scope of each framework:

1. ISO 42001: a certifiable standard for the governance and lifecycle of AI systems, including bias, explainability and human oversight.
2. ISO 27001: a certifiable standard for protecting the confidentiality, integrity and availability of information. Many organizations use it as a base to implement ISO 42001 faster.
3. EU AI Act: an EU law that sorts AI systems by risk level and sets legal duties for each level.

When Does the EU AI Act Require More Monitoring Evidence Than ISO 42001?

The EU AI Act asks for more evidence from 2 December 2027, when its high-risk rules take effect for tools used in hiring, credit scoring and education. AI built into regulated products, such as medical devices, follows on 2 August 2028.

The EU set those dates through the Digital Omnibus on AI, an amending law in force since 27 July 2026. The high-risk rules were due on 2 August 2026 before that law.

An organization can pass an ISO 42001 audit with strong processes and a limited sample of evidence, according to Pivot Point Security, a compliance consulting firm. A high-risk system has to pass the EU's formal pre-sale check, called a conformity assessment.

The firm says that assessment needs a dated record for each system across its life, and a missing record can't be rebuilt after launch. It also lists automatic event logging for traceability among the AI Act duties that ISO 42001 doesn't require in the same detail.

An organization supplying a high-risk system should start capturing logs for each system before launch. The monitoring built for ISO 42001 then also produces records for the EU assessment.

How Do You Build an ISO 42001 Evidence Trail From Monitoring?

Three practices in Zettabyte's data center security guide produce records for an ISO 42001 audit:

1. Continuous monitoring: the guide recommends security information and event management (SIEM) tools that flag anomalies and unauthorized access in real time. Those alerts become dated records for risk management and operational control.
2. Audit trails: logs record each user's interactions with data and infrastructure. Those logs count as controlled records of who changed which systems.
3. Planned audits and certification checks: the guide calls for audits at planned intervals and for checking a provider's certifications. It lists ISO/IEC 27001 and SOC 2, an independent report on a company's security controls, as certifications to look for in a provider.