Solutions — instrument
No software certifies you. That is not why this is unmapped.
The AI management system standard. Certifiable, which makes it the one buyers ask about most and the one where vendor claims are loosest — because a management system is a set of organisational practices and software is not one. Two separate things follow from that, and only the first is a limit on any product.
What an auditor could take from a deployment
- Operational controls (A.6, A.9)
- Bounded authority, refusals with reasons, oversight records, and a change history for what each agent was — as artefacts an assessor can sample rather than as a policy document describing intent.
- Records of AI system use
- The inventory, the provenance, and the decisions with their outcomes.
No product certifies anybody against 42001. Certification assesses your organisation: leadership commitment, competence, internal audit, management review. A deployment supplies evidence into that assessment and changes none of its requirements — and a vendor offering "42001 compliance" as a feature is describing something that does not exist.
Why there is no clause map
The paragraph above is true and it is not the reason. "You cannot be certified by a product" and "we have not encoded this instrument" are different statements, and running them together would let the second hide behind the first.
Annex A enumerates: nine control objectives and roughly forty controls, numbered. That is more enumerable than SR 11-7, which is supervisory guidance written in roman-numeral sections and which we map in ten clauses. It is the same shape as the NIST AI RMF, which is voluntary and which we map in eleven. Neither of those is a statute either. So "it is a framework rather than a law" cannot be our reason without condemning two maps we already ship.
The real reason is ordering: the instruments that create a deadline came
first. A map here would cover A.6 on the AI system life cycle, A.9 on use,
and A.10 on third-party relationships as hybrid — evidence we
supply into your assessment — and carry the certification caveat in the
map's own caveat field, where every generated pack would
reproduce it. Until then this page is what we have, and an assessor asking
for 42001 evidence is better served by the artefact list above than by a
percentage we have not earned.
RotaGrant ships no clause map for ISO/IEC 42001. The engine takes clause maps as data, so one can be authored — by you, by your counsel, or with us — and it will be scored like any other. What this page will not do is imply a mapping that does not exist, because a readiness percentage against an instrument nobody encoded is a number with no denominator.