Standards
ISO 42001 and 27001: what this site helps with
Which features of this site help a law firm keep the records that ISO/IEC 42001 (AI management) and ISO/IEC 27001 (information security) ask for.
Last checked 1 November 2026.
The two standards share the same clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. Each adds its own list of controls in Annex A. The tables below name the clause or control, then the feature here that helps.
“Helps” means the feature produces a record the clause asks for. “Partly” means it covers some of it. “Not yet” means the firm needs its own process.
Policy, roles and awareness
These clauses ask a firm to set an AI policy, keep it current, name who is responsible and make sure staff know the rules.
| What the standards ask | Clauses and controls | What helps here | Coverage | Where |
|---|---|---|---|---|
| Understand the firm’s context, set the scope and say what role it plays with AI | 42001: 4 · 27001: 4 | Framework pages and the AI rules tracker | Partly | Security and privacy frameworks, AI rules tracker |
| Have a written AI policy and an information security policy | 42001: 5.2, A.2 · 27001: 5.2, A.5.1 | AI policy builder and the master firm AI policy precedent | Helps | AI policy, Firm AI policies |
| Review the policy and keep controlled versions of documents | 42001: 7.5, A.2.4 · 27001: 7.5, A.5.1 | Policy approval, versions and review dates | Helps | Firm AI policies |
| Give people roles and responsibilities | 42001: 5.3, A.3.2 · 27001: 5.3, A.5.2 | Firm roles and named people | Partly | Firm members |
| Make sure staff know the policy and their part in it | 42001: 7.2, 7.3 · 27001: 7.2, 7.3, A.6.3 | Policy acknowledgement rounds and reminders | Partly | Firm AI policies |
More detail: how each feature helps with policy, roles and awarenessExpand for more
- Understand the firm’s context, set the scope and say what role it plays with AI. The framework pages explain each standard and law that can bind a private firm, and the AI rules tracker lists court and regulator rules on AI. Both help a firm list the outside issues and interested parties clause 4 asks about. The firm still writes its own scope statement.
- Have a written AI policy and an information security policy. The AI policy builder assembles a firm AI policy from sourced sections. The master firm AI use policy precedent covers governance, verification, court disclosure, records and decisions about people. Neither is an information security policy; the firm needs one of those as well.
- Review the policy and keep controlled versions of documents. A firm policy is approved by an owner, keeps its earlier versions and records when a new version replaces an old one. The policy in force shows its review date. That gives a firm a version history to show an auditor.
- Give people roles and responsibilities. A firm workspace has owner, admin and member roles, names its people and records who approved what. The firm still decides who is accountable for AI and for security, and writes that down.
- Make sure staff know the policy and their part in it. A firm can ask its people to acknowledge a policy and send reminders to those who have not. The record of who acknowledged which version is evidence of awareness. It is not training, which the firm must still provide.
AI tools and how they are used
These controls ask a firm to know which AI tools it uses, assess their impact, watch how they run and keep people in charge.
| What the standards ask | Clauses and controls | What helps here | Coverage | Where |
|---|---|---|---|---|
| Document the AI tools and other resources the firm uses | 42001: A.4.2 | Software catalogue and software assessments | Helps | Software catalogue, Your toolset |
| Assess the impact of each AI use on people and on society | 42001: 6.1.4, 8.4, A.5 | Decision files | Partly | Decision files |
| Operate and monitor AI tools and keep event logs | 42001: A.6.2.6, A.6.2.7, A.6.2.8 | Work records, change emails and the agent access log | Helps | Your workspace, AI agents |
| Know where data comes from | 42001: A.7.5 | Sources and checked dates on every record | Partly | How we use AI |
| Tell users and other interested parties what they need to know | 42001: A.8.2, A.8.5 | Limits stated on every output | Partly | How it works |
| Use AI responsibly, for its intended use, with people in charge | 42001: A.9.2, A.9.3, A.9.4 | Green, yellow and red tasks, and agent controls | Helps | How it works, Connect your AI |
More detail: how each feature helps with ai tools and how they are usedExpand for more
- Document the AI tools and other resources the firm uses. The software catalogue profiles legal AI tools with a source and a checked date for each fact. A firm’s own software assessments and approved uses work as its register of AI tools.
- Assess the impact of each AI use on people and on society. A decision file records whether a tool may be used for a piece of work, with a supervisor’s sign-off, versions and a printable copy. It is a starting point, not a full impact assessment: it does not yet list affected people, harms and a reassessment trigger. ISO/IEC 42005:2025 gives guidance on that method.
- Operate and monitor AI tools and keep event logs. A work record notes who drafted, checked and approved a piece of AI-assisted work. A person can ask to be emailed when a court rule, regulator rule or tool record used by one of their saved work records changes. The agent access log records what connected AI apps read from the firm.
- Know where data comes from. Every catalogue fact carries its source, the date it was checked and how well it is backed. Policy sections, rules and prompts cite their sources too. This covers the site’s own content, not the data inside a firm’s AI tools.
- Tell users and other interested parties what they need to know. Pages and firm outputs say they are not legal advice and that the responsible lawyer decides. Where a stored court or regulator rule asks for AI use to be disclosed, the framework shows that duty with its source.
- Use AI responsibly, for its intended use, with people in charge. Each task is green, yellow or red, which sets how closely a person must be involved. A connected AI app plans what it may do at each stage before it starts. Firm access for AI agents is off until the firm turns it on, and single items can be hidden from agents.
Suppliers, security and the law
These controls ask a firm to manage its suppliers, control access, protect personal information and track the law it must follow.
| What the standards ask | Clauses and controls | What helps here | Coverage | Where |
|---|---|---|---|---|
| Manage suppliers and cloud services | 42001: A.10.2, A.10.3, A.10.4 · 27001: A.5.19, A.5.20, A.5.21, A.5.22, A.5.23 | Vendor questions and certification claims | Partly | Software catalogue |
| Control access and authenticate people securely | 27001: A.5.15, A.5.16, A.5.17, A.5.18, A.8.5 | App approvals and two-step sign-in | Partly | Connect your AI, Your firm |
| Protect privacy and personal information | 27001: A.5.34 | Privacy Act and OAIC guidance pages | Partly | Privacy Act and the APPs, OAIC guidance on commercial AI products |
| Identify the laws, rules and contracts the firm must follow | 27001: A.5.31 | Court notes, regulator rules and the change feed | Helps | Court AI notes, AI rules updates |
More detail: how each feature helps with suppliers, security and the lawExpand for more
- Manage suppliers and cloud services. A firm can send a vendor a set of questions, including whether it holds ISO/IEC 27001 or 42001 certification. Software profiles link each certification a vendor claims to the page for that standard. The firm still keeps its own supplier register.
- Control access and authenticate people securely. A connected AI app gets read or write access only after a person approves it, and the approval can be withdrawn. A firm can require two-step sign-in for all its members. This covers access to this site only, not the firm’s other systems.
- Protect privacy and personal information. The framework pages explain the Privacy Act and the Australian Privacy Principles, and the privacy regulator’s guidance on commercial AI products. They help a firm find its duties. They are not a privacy program.
- Identify the laws, rules and contracts the firm must follow. The library holds court practice notes and regulator rules on AI, each with its source and date. The updates feed shows what changed and when.
What this site does not cover yet
Some clauses have no feature here. A firm needs its own process for them.
| What the standards ask | Clauses and controls | What helps here | Coverage | Where |
|---|---|---|---|---|
| Run internal audits and management reviews | 42001: 9.2, 9.3 · 27001: 9.2, 9.3 | Nothing yet | Not yet | None yet. |
| Assess and treat risks, and keep a Statement of Applicability | 42001: 6.1.2, 6.1.3 · 27001: 6.1.2, 6.1.3 | Nothing yet | Not yet | None yet. |
More detail: how each feature helps with what this site does not cover yetExpand for more
- Run internal audits and management reviews. The site has no internal audit plan, audit record or management review record. A firm must run these itself.
- Assess and treat risks, and keep a Statement of Applicability. The site has no risk register and does not build a Statement of Applicability against Annex A. The rows above can help a firm decide which controls its records support.
Limits and sources
This page is a guide, not legal or audit advice. Using these features does not make a firm compliant with either standard. A certificate comes only from an accredited certification body after an audit.
The ISO texts are sold, not free. Clause and control numbers here come from ISO’s catalogue pages, the NIST crosswalk and secondary lists. Check them against a purchased copy before an audit.
The site’s own use of ISO/IEC 42001 is described on How we use AI. The framework pages for ISO/IEC 42001 and ISO/IEC 27001 say what each standard is and who it applies to.