Framework · AI management

ISO/IEC 42001, with evidence behind it.

ISO/IEC 42001 is the first certifiable management-system standard for AI. The clauses ask for structure, the audit asks for operating evidence, and Meilynx produces that evidence from live traffic: what runs, what rules applied, and a record an auditor can verify.

What the standard requires

A management system that demonstrably operates.

42001 follows the familiar ISO management-system shape (context, leadership, planning, support, operation, performance evaluation, improvement) applied to AI, with Annex A controls covering the AI system lifecycle, data, and third parties.

A defined AIMS scope: which AI systems, uses, and roles are covered.
Operational controls over how AI systems are developed, deployed, and used.
Performance evaluation: monitoring, measurement, and internal audit.
Documented information that shows the system operating.

How Meilynx maps

Each clause, to operating evidence.

A specific Meilynx control for each evidential expectation, and the artifact it produces.

ISO/IEC 42001 → Meilynx controls

Requirement	How Meilynx maps	Examination artifact
Know which AI systems the organization operates ISO/IEC 42001 · Cl. 4, A.6	The inventory of models and AI systems in use is derived from live traffic through the proxy. The AIMS scope starts from what actually runs, and shadow AI use surfaces.	AI system inventory, generated from traffic
Operational planning and control of AI use ISO/IEC 42001 · Cl. 8	Policy-as-code turns the AIMS's documented rules into inline enforcement: model allowlists, data-class controls, and usage restrictions applied on every call.	Policy snapshot + enforcement records
Monitoring, measurement, analysis and evaluation ISO/IEC 42001 · Cl. 9.1	Each AI call carries monitoring telemetry (model, usage, cost, latency, and governance findings), giving the AIMS performance-evaluation clause continuous operating data instead of periodic sampling.	Monitoring telemetry + findings log
Record event logs from AI systems, at least while they are in use ISO/IEC 42001 · A.6.2.8	Each AI response the proxy delivers and each request it blocks is recorded as it happens, with the time, the model and the governance outcome, and sealed into a tamper-evident hash chain. Logging becomes a property of the traffic path.	A.6.2.8 event-logging evidence
Records that demonstrate the AIMS operates ISO/IEC 42001 · Cl. 7.5, 9.2	A tamper-evident, hash-chained audit trail of each AI response the proxy delivers and each request it blocks, with its governance decision attached, gives internal audit and certification bodies documented information whose integrity they can verify independently.	Examination-ready audit trail
Oversight of third-party AI components and providers ISO/IEC 42001 · A.10	Because the proxy sits between your applications and every LLM provider, third-party model use is observed, constrained, and evidenced at the boundary, without provider cooperation.	Provider usage record per system

Know which AI systems the organization operates

ISO/IEC 42001 · Cl. 4, A.6

Maps to · The inventory of models and AI systems in use is derived from live traffic through the proxy. The AIMS scope starts from what actually runs, and shadow AI use surfaces.

Examination artifact · AI system inventory, generated from traffic

Operational planning and control of AI use

ISO/IEC 42001 · Cl. 8

Maps to · Policy-as-code turns the AIMS's documented rules into inline enforcement: model allowlists, data-class controls, and usage restrictions applied on every call.

Examination artifact · Policy snapshot + enforcement records

Monitoring, measurement, analysis and evaluation

ISO/IEC 42001 · Cl. 9.1

Maps to · Each AI call carries monitoring telemetry (model, usage, cost, latency, and governance findings), giving the AIMS performance-evaluation clause continuous operating data instead of periodic sampling.

Examination artifact · Monitoring telemetry + findings log

Record event logs from AI systems, at least while they are in use

ISO/IEC 42001 · A.6.2.8

Maps to · Each AI response the proxy delivers and each request it blocks is recorded as it happens, with the time, the model and the governance outcome, and sealed into a tamper-evident hash chain. Logging becomes a property of the traffic path.

Examination artifact · A.6.2.8 event-logging evidence

Records that demonstrate the AIMS operates

ISO/IEC 42001 · Cl. 7.5, 9.2

Maps to · A tamper-evident, hash-chained audit trail of each AI response the proxy delivers and each request it blocks, with its governance decision attached, gives internal audit and certification bodies documented information whose integrity they can verify independently.

Examination artifact · Examination-ready audit trail

Oversight of third-party AI components and providers

ISO/IEC 42001 · A.10

Maps to · Because the proxy sits between your applications and every LLM provider, third-party model use is observed, constrained, and evidenced at the boundary, without provider cooperation.

Examination artifact · Provider usage record per system

Annex A · A.6.2.8

Event logs, at least while a system is in use.

Control A.6.2.8, AI system recording of event logs, sits with the AI system life cycle controls in Annex A, next to operation and monitoring (A.6.2.6) and technical documentation (A.6.2.7). The organization decides at which stages of each system's life cycle events are logged. The control sets one stage that cannot be left out: the period the system is in use.

What the control and its Annex B guidance ask the organization to keep

A logging decision for each AI system: the life-cycle stages at which it records event logs.
Logs from every period of use, the minimum the control sets.
Traceability: logs that show how the system operated, and when it ran outside the conditions it was intended for.
A retention period set by the system's intended use, the organization's retention policy and any legal requirement that applies.

What Meilynx records for the auditor

Each AI response the proxy delivers and each request it blocks, recorded as it happens.
The time, the model requested, the governance outcome with its findings, and the policy version in force.
A tamper-evident hash chain: a change to a recorded outcome breaks the chain, and an auditor can check the chain independently.
An event-logging section for A.6.2.8 in the ISO/IEC 42001 evidence package.

These records evidence the in-use stage for the AI calls routed through Meilynx. The stages to log, the retention period and the review of the logs are decisions your AIMS documents, and your certification body examines them as part of the control.

Related logging duties

One event log, three frameworks, three tests.

Article 12 of the EU AI Act and the NIST AI Risk Management Framework ask for overlapping records, so one event log can serve all three. Each is judged on its own terms: a certification body assesses the 42001 control, the Act is law with its own authorities, and the AI RMF is a voluntary reference.

ISO/IEC 42001 · A.6.2.8

A control inside a voluntary standard

Applies to the AI systems in the AIMS scope. The organization chooses the life-cycle stages that log, with use as the minimum, and keeps the logs as long as each system's intended use and its own retention policy require.

EU AI Act · Article 12

A legal design requirement for high-risk AI

A high-risk AI system must technically allow the automatic recording of events over its lifetime, for traceability. Providers and deployers each keep the logs under their control for at least six months. For Annex III systems the duty applies from 2 December 2027.

NIST AI RMF · MEASURE 2.4

Monitoring in production

NIST's voluntary framework asks that an AI system's functionality and behavior be monitored in production, without prescribing a log. A crosswalk on the NIST AI Resource Center, drafted against the final draft of 42001, pairs the standard's event-logging guidance with MEASURE 2.4, 2.6 and 3.2.

Article 12 asks for logging capability over a high-risk system's whole lifetime, and Articles 19 and 26(6) set a six-month minimum for keeping the logs. ISO/IEC 42001 leaves both choices to the organization, so a log designed for A.6.2.8 serves the Act only where its scope and retention reach that far. The Article 12 reference entry, linked below, sets out the provider and deployer duties and the dates after the Digital Omnibus.

Sources

The audit artifact

What you show a certification body.

The audit trail renders into a package aligned to the AIMS evidential clauses: scope drawn from real traffic, controls in force, monitoring results, and a record whose integrity is verifiable.

In the package

AI system inventory, auto-populated from traffic.
Control coverage across the audit period.
Versioned governance policy snapshot.
Event-logging evidence for A.6.2.8 across the audit period.
SHA-256 integrity hash over the audit chain.

FAQ

ISO/IEC 42001 and the proxy.

How does ISO/IEC 42001 relate to the EU AI Act?

They are complementary. The Act is law with obligations and timelines; 42001 is a voluntary management-system standard many organizations adopt as the organizing structure for meeting them. The operational evidence largely overlaps (logging, oversight, usage control), which is why the same Meilynx audit chain feeds both.

We're a banking organization. Why would we add 42001 to SR 26-2 model risk?

Model risk guidance covers models; 42001 covers the management system around all AI use, including the generative and agentic systems that SR 26-2 explicitly places outside model risk scope. Organizations adopt it to give that uncovered territory a defensible, auditable structure.

Build the evidence.

EU AI ActThe regulation many organizations structure their AIMS around.Examination-ready audit trailThe tamper-evident record behind the AIMS evidence clauses.SR 26-2Model risk management for U.S. banking organizations.Regulations by regionWhich AI frameworks apply where, grouped by jurisdiction.

Reference

EU AI Act Article 12: Automatic Logging for High-Risk AI After the Digital OmnibusWhat Article 12 of the EU AI Act requires high-risk AI systems to log, who keeps the logs and for how long, and when the duty applies after the Digital Omnibus.

Examination package

See exactly what an examiner receives

Request a sample examination package: model inventory, control coverage, a governance policy snapshot, and a SHA-256 integrity hash.

Get the sample package See a demo