ISO 42001 audit preparation guide
Using Certified Execution Records as evidence for AI transparency and accountability controls.
What auditors actually ask for
ISO/IEC 42001:2023 requires that an organisation running an AI management system can demonstrate, not only assert, that its AI systems operate as documented. In practice, auditors ask for per-execution evidence: on a given date, for a given request, what did the model receive, what did it produce, and can that record be validated independently of the operator.
A Certified Execution Record (CER) is the per-execution artefact that answers those questions. It is a signed bundle containing the input, output, model identity, and system context of one AI run, hashed and signed with Ed25519 so that anyone with the published public key can verify it.
Mapping CERs to ISO/IEC 42001:2023 Annex A
- A.6.2 AI system impact assessment — CERs provide the run-time evidence that substantiates assumptions made in the impact assessment.
- A.7.4 Data for the AI system — the input portion of each CER is a hashed, verifiable record of the data actually supplied to the model.
- A.8.2 Information for users and affected parties — CERs can be produced to a data subject as a verifiable record of a specific automated decision.
- A.9.2 Performance monitoring — a stream of CERs is the source of truth for monitoring what the AI system produced in production.
- A.10.4 Records of AI system events — CERs are individually verifiable event records with a fixed schema and a documented hash procedure.
Why cryptographic binding matters for high-assurance AI governance
Signed log streams prove that a sequence was produced by a signer. They do not, on their own, let an auditor take one line item and validate it in isolation. CERs are individually verifiable artefacts: one bundle, one hash, one signature. This gives high-assurance AI governance the non-repudiation property auditors expect from record-keeping systems in regulated domains.
What NexArt does not cover
ISO 42001 requires governance, roles, risk management, and human oversight. NexArt does not replace any of these. It supplies the operational evidence layer inside the management system so that transparency, traceability, and accountability clauses have verifiable artefacts behind them.
Frequently asked
What documentation supports AI model transparency in ISO 42001 audits?
Auditors expect artefacts that show what the AI system actually did on a given request, not only that a policy exists. A Certified Execution Record (CER) provides that per-execution artefact: a cryptographically signed bundle containing the inputs, outputs, model identity, and system context of a single AI run, verifiable independently of the vendor.
Which ISO/IEC 42001:2023 controls do Certified Execution Records support?
CERs primarily support the transparency, traceability, accountability, and monitoring clauses of Annex A, including A.6.2 (AI system impact assessment inputs), A.7.4 (data used by the AI system), A.8.2 (information for users and affected parties), A.9.2 (performance monitoring evidence), and A.10.4 (records of AI system events).
Does NexArt replace an ISO 42001 AI management system?
No. ISO 42001 is a management-system standard covering governance, roles, risk, and lifecycle. NexArt provides the execution-evidence layer inside that system: verifiable records of what the AI actually executed. It supports the operational and monitoring clauses but does not replace policy, risk assessment, or human oversight.
Are Certified Execution Records verifiable without trusting NexArt?
Yes. Each CER is signed with Ed25519 over a canonical hash of the record content. An auditor can recompute the hash, validate the signature against a published public key, and confirm the record has not been altered, without any dependency on NexArt infrastructure.
How does non-repudiation work for high-assurance AI governance?
Every CER cryptographically binds the input, output, model identity, and context of one execution into a single hashed unit, then signs it. Neither the operator nor NexArt can later alter one of those fields without invalidating the signature, giving auditors a durable non-repudiable record of the run.