ISO 42001 Compliance

ISO 42001 Compliance (compliance-team-iso42001) is Alireza Rezvani's community Claude plugin for compliance teams working with ISO/IEC 42001:2023, the international management-system standard for AI, known as an AI Management System or AIMS. It packs one skill, iso42001-specialist, with three Python tools and four reference guides, and it works at the internal-audit level: finding gaps, building the AI risk register and planning internal audits. What you can do with it - Score your AIMS evidence against Clauses 4 to 10 (full, partial or missing) and get a gap list ranked by what to close first before a stage 1 certification audit - Build the AI risk register Clause 6.1.2 asks for: each risk scored by likelihood and impact, mapped to the Annex A controls that treat it, with the ones that need more treatment flagged, following the ISO/IEC 23894 risk process - Draft a 12-month Clause 9.2 internal audit plan with quarterly scope, auditor assignments and independence checks, tracked against a rolling 3-year cycle - Map ISO 42001 obligations to the EU AI Act, NIST AI RMF, ISO/IEC 23894, ISO/IEC 38507 and ISO 27001, so evidence you already have can be reused - Walk through each clause and the Annex A controls with the audit evidence a certification body expects How it works The tools are plain Python with no extra packages. Each reads a JSON file you supply (an evidence inventory, a list of risks or an audit scope), and runs on a built-in sample if you give it none. Answers come back in a fixed shape: the bottom line, the decision, the clause and control evidence, next steps, and the call left to your compliance officer. How to install it In Claude Code, run /plugin marketplace add alirezarezvani/claude-skills, then /plugin install compliance-team-iso42001@claude-code-skills. The same skill also ships inside his ra-qm-skills bundle. Good to know - It's a community project by Alireza Rezvani, not from ISO or a certification body. - The maker scopes it tightly: it isn't an executive AI strategy tool, it isn't for EU AI Act conformity assessment, and it doesn't replace ISO/IEC 23894 or 38507. - As its README notes, ISO 42001 governs the management system; it doesn't set AI risk thresholds, model evaluation methods or technical controls. - Its gap scores, registers and plans are working documents for your compliance team to review, not legal advice or a certification decision.

• “Run a gap analysis of our AIMS evidence against Clauses 4 to 10. What do we close first before the stage 1 audit?”

  Copy

• “Build our AI risk register and map each risk to the Annex A controls that treat it.”

  Copy

• “Plan our Clause 9.2 internal audits for the next 12 months, with auditor independence checks.”

  Copy

• “Does our AI policy cover everything Clause 5.2 expects?”

  Copy

• “Which of our ISO 27001 controls can we reuse for ISO 42001?”

  Copy