Introduction

The ISO 42001 pack is eight controls that translate an AI management-system standard into checks that can actually run on traffic. It is the largest of the four packs and the most enforcement- oriented — and understanding what it does not cover matters as much as what it does.

Where to find it

AI Governance > Policies > System Policies > ISO 42001.

The eight controls

Control	Check	Applied on	Action
Block denied topics	`Denied Topics`	User input	Flag
Block internal identifier leakage	`Regex pattern`	User input	Block
Validate tool output before downstream execution	`Custom (LLM check)`	Tool output	Block
Block financial transaction tools	`Blocked Tools`	Tool name	Block
Block unapproved model or tool calls	`Blocked Tools`	Tool name	Block
Flag disparate outcome patterns	`Custom (LLM check)`	Agent output	Flag
Block secrets in tool input	`Credentials & Secrets`	Tool input	Block
Block production PII from training/fine-tuning pipelines	`PII detection`	Tool input	Block

Note: A control's name is a label, not its action. Six of the eight are named “Block…” and only five of those are set to Block — Block denied topics ships with the Flag action. Read the Action column, never the name, when deciding what will stop work.

Note: Packs are maintained content, not fixed product surface. The list above was read from the product and may change as the pack is updated. Treat this page as an orientation to the pack's shape and intent; the pack's own Controls tab is the current list.

What this pack is really about

Read the Applied on column and the pack's character becomes obvious. Two of the eight run on Tool input, two on Tool name, and a fifth on Tool output. Only three touch the conversation at all.

That is a deliberate reading of the standard: the risk in an AI management system is not principally what the assistant says, it is what it does — which tools it invokes, with what data, and whether downstream systems act on output nobody validated. The pack places its weight where the consequences are irreversible.

It is also the most block-heavy pack: six of eight are set to Block rather than Flag.

The prerequisite this pack assumes

Six blocking controls only block on connections that support enforcement. On an observe-only connection, the product's own guidance is explicit: "Outcomes other than Flag only run on agents connected in Control mode. On Observe-only agents the control can flag, but cannot intervene."

So adopting this pack on advisory connections gives you detection, not enforcement. That is a legitimate posture — detection is most of the evidence value — but it is not the posture the pack was written for, and it should be a decision rather than a surprise. See Connection Type & Control Mode.

What eight controls cannot do

ISO/IEC 42001 is a management-system standard. Most of it is about how your organisation is run: objectives, roles, risk assessment, competence, internal audit, management review, improvement. None of that is a runtime check, and no pack could make it one.

The pack contributes to	The pack does nothing for
Operational controls over AI system use	AI policy, objectives and management commitment
Evidence that controls were in force	Risk and impact assessment methodology
Monitoring and incident records	Competence, awareness and training
Records for internal audit to examine	Internal audit and management review themselves

"A framework pack is evidence for the clauses about operation. It is not evidence for the clauses about management, and those are most of the standard."

These controls are shared with the other packs

Six of the eight also appear in the OWASP, EU AI Act GPAI or NIST AI RMF packs — and they are the same control object, not copies.

Two things follow, and the first is the one that bites:

Tuning a control here retunes it everywhere. Loosening Flag disparate outcome patterns because ISO is noisy also loosens EU AI Act GPAI and NIST AI RMF, with no warning.
Adopting a second pack costs less than its headline count. If you already run ISO, NIST adds four new controls rather than seven — the three you share are Block unapproved model or tool calls, Block secrets in tool input and Flag disparate outcome patterns.

Adopting it

Read all eight before covering anything — The pack arrives covering nothing. That is your window to review it without consequences.
Decide the blocking ones deliberately — Six controls will stop work if they fire and your connection enforces. Each deserves a decision, not an inherited default.
Run it in detection first — Point it at assets, watch what it catches for a period, tune, and only then rely on enforcement.
Point it at assets — Until you do, nothing is governed. See Scoping & Precedence.
Record what you decided, and why — An auditor's question is not "is the pack enabled" but "why these controls, on these systems". The pack cannot answer that; only you can.

Operationalizing ISO/IEC 42001

This page covers the pack. For the standard itself — what its clauses require, what Annex A is for, what evidence looks like, and an honest table of what tooling does and does not contribute — see the framework tree:

ISO/IEC 42001 Overview
Clauses & Annex A
Evidence
Operationalizing in UnifyApps

ISO 42001 Pack