# ISO/IEC 42001:2023 → LeanCTX mapping matrix (GL #424, H3 Epic A).
#
# Scope: Annex A controls that touch the context flow to models. The AIMS
# (management system) itself is organisational by definition — only the
# technically enforceable slices are claimed.

framework = "iso42001"
title = "ISO/IEC 42001:2023 — AI management system (Annex A controls)"
version_pin = "ISO/IEC 42001:2023 (first edition, 2023-12)"
pinned_on = "2026-06-11"
review_cycle_months = 6
disclaimer = "LeanCTX is tooling support for compliance work — not legal advice. 'Aligned' is a technical statement about enforceable controls, not a certification; ISO 42001 certification audits an organisation's management system, not a tool."
reference_pack = "iso42001-aligned"

[[controls]]
id = "ISO-A.6.2.6"
clause = "Annex A.6.2.6"
requirement = "AI system operation and monitoring: event logging during operation"
mechanism = "audit_event"
leanctx = "Always-on hash-chained audit trail + typed runtime event stream (governance events per OCP Part 5)"
evidence = "audit trail JSONL + event export"
coverage = "full"
test = "iso_a626_operation_logging_always_on"

[[controls]]
id = "ISO-A.7.4"
clause = "Annex A.7.4"
requirement = "Quality of data for AI systems: data is controlled before use"
mechanism = "pack_rule"
leanctx = "Policy-pack redaction + classification run sender-side before content enters context; declarative and reviewable"
evidence = "resolved pack redaction patterns + redaction fixtures in CI"
coverage = "partial"
gap = "LeanCTX controls runtime context data, not upstream dataset quality (completeness, representativeness)"
test = "iso_a74_context_data_is_filtered_before_use"

[[controls]]
id = "ISO-A.8.2"
clause = "Annex A.8.2"
requirement = "System documentation and information for users is available"
mechanism = "evidence_export"
leanctx = "Capability grant sets, resolved policy view (policy show), Context-IR and coverage reports are exportable artifacts"
evidence = "policy show/coverage output, IR documents"
coverage = "full"
test = "iso_a82_resolved_policy_is_exportable"

[[controls]]
id = "ISO-A.9.2"
clause = "Annex A.9.2"
requirement = "Processes for responsible use of AI are defined"
mechanism = "pack_rule"
leanctx = "Policy packs ARE the machine-enforced process definition: tool allow/deny, budgets, retention, redaction — versioned, inheritable, git-reviewable"
evidence = "pack TOML under version control + resolved chain"
coverage = "full"
test = "iso_a92_policy_pack_defines_enforced_process"

[[controls]]
id = "ISO-A.9.4"
clause = "Annex A.9.4"
requirement = "Intended use: the system is used as intended, misuse is addressed"
mechanism = "pack_rule"
leanctx = "Capability gate (default-deny) + deny_tools block out-of-scope operations; violations are recorded as tool_denied"
evidence = "denied-tool audit entries + capability check results"
coverage = "full"
test = "iso_a94_out_of_scope_use_is_blocked_and_recorded"

[[controls]]
id = "ISO-A.10.3"
clause = "Annex A.10.3"
requirement = "Suppliers/third parties: responsibilities in the AI lifecycle are addressed"
mechanism = "none"
leanctx = "Contractual/organisational; LeanCTX evidence bundles can be handed to suppliers but the duty itself is not enforceable by tooling"
evidence = "n/a"
coverage = "none"
gap = "Organisational measure — supplier contracts and reviews"

[[controls]]
id = "ISO-A.5.2"
clause = "Annex A.5.2"
requirement = "AI system impact assessment is performed and documented"
mechanism = "none"
leanctx = "Assessment is a human activity; coverage reports and Context-IR feed it with facts but do not replace it"
evidence = "n/a"
coverage = "none"
gap = "Human assessment — LeanCTX artifacts serve as inputs"
