ISO/IEC 42001 and NIST AI RMF
Place action evidence inside your management system.
ISO/IEC 42001:2023 addresses an AI management system. NIST AI RMF provides a voluntary risk-management framework. A receipt is one input to those broader organizational processes.
ISO/IEC 42001:2023 overview NIST AI RMF evidence guideTopic-level alignment only. Use the applicable standard and qualified reviewers for clause-level interpretation, scope, and conformance assessment.
What the evidence can contribute.
Permission Protocol’s suggested mappings below are for review. Confirm the fields available in your integration and whether the artifact is independently signed. Authorization evidence alone does not prove execution, complete coverage, or compliance.
Roles and responsibility
- Potential receipt or decision evidence
- A named approver connected to a specific authorization.
- Your team must establish
- Establish organizational roles, competence, delegated authority, and accountability beyond the individual decision.
Operational controls
- Potential receipt or decision evidence
- The action, policy reference, decision, and available timestamps for a configured gate.
- Your team must establish
- Define the control, implement the enforced path, test it, and govern changes and exceptions.
Documented information
- Potential receipt or decision evidence
- A signed authorization artifact where supported by the selected integration.
- Your team must establish
- Manage retention, access, integrity, retrieval, and completeness across the evidence lifecycle.
Review and improvement
- Potential receipt or decision evidence
- Authorization samples that can be included in a review or evaluation.
- Your team must establish
- Conduct risk assessments, management reviews, audits, and corrective actions. A receipt does not perform these activities.
Build an evidence pack for one workflow.
Agree the requirement with your reviewer. Collect the configuration, approval records, verification results, exception handling, and tests for the chosen path. Evaluate gaps before expanding.