Playbook 3 — The ISO 42001 Crosswalk
Your existing governance work already covers most of the standard's clauses
ISO/IEC 42001 is the management-system standard for AI: a set of clauses describing how an organization governs AI, not a technical specification for the model. Read against the Governance Playbook Series, most of it is already done. The useful move is a crosswalk — mapping what exists to the standard’s clauses, then naming the gaps rather than rebuilding.
The standard’s management-system requirements run through six clause areas: Context, Leadership, Planning, Support, Operation, and Performance Evaluation, with Continual Improvement closing the loop. Here is how the existing work lines up.
Leadership — the direction, policy, and roles. Playbook 1 (Governance Starter) sets the proportional-governance rule and the risk tiers; Playbook 5 (Roles Without a Department) names who owns what. That is the Leadership clause, done.
Planning — risk assessment and treatment. The AI Risk Management series is exactly this: seven categories, a scoring method, per-category treatment. It maps to the standard’s Planning clause almost line for line.
Operation — the controls that run the system day to day. Playbooks 2 through 4 (Vendor & Procurement, Data & Bias, Rollout & Lifecycle) cover what you buy, what data it touches, and how it goes live. That is the operational core.
Performance Evaluation — checking whether any of it works. The Measure Value, Risk, Costs & KPIs series, with its 30/90/180-day checkpoints, covers the measurement side, and Playbook 6 (Documentation Register) supplies the records.
Two gaps are worth naming, because they are the parts the existing series does not produce.
The first is the Support clause — the documented resourcing and competence side. The standard expects evidence that people are trained and that the system is adequately resourced. That is not a repository of policies; it is a record of who was trained on what, when, and by whom. It is the one place the new Change Management series and this standard meet.
The second is Continual Improvement — a defined cadence for reviewing and updating the management system itself, not just the individual systems. Most companies have an annual review at best. The standard wants it as a habit.
One term is worth borrowing directly: the Statement of Applicability. It lists every applicable control and, for each, whether it applies, why or why not, and its implementation status. Playbook 1’s triage already does this informally. Naming it in the register makes the alignment legible to an auditor or a client running diligence.
A crosswalk check:
- Each clause area has a named document or playbook behind it.
- The two gaps — Support and Continual Improvement — are acknowledged, not invisible.
- Your register states which controls apply and why.
- You know this is alignment, not certification: a crosswalk is not an audit.
Next: Playbook 4 closes the transparency gap that is live right now.