AI Assurance DirectoryTools for ISO/IEC 42001
Listed tools whose cited public page names this framework. Read the ISO/IEC 42001 explainer first. Related reading is on the articles index.
-
6clicks (ISO 42001)
GRC with a pre-configured ISO/IEC 42001:2023 AIMS, Hailey AI mapping, SoA and Hub & Spoke. Cross-maps ISO 27001 and the EU AI Act. Homepage names SaaS, sovereign cloud or on-prem, and cloud, on-premises, air-gapped or hybrid.
-
AI Verify Testing Framework
Testing framework of 11 internationally recognised AI governance principles for Traditional and Generative AI. Mapped to NIST AI RMF (13 Oct 2023), NIST AI 600-1 (29 May 2025) and ISO/IEC 42001 (21 July 2025). IMDA/PDPC MVP 25 May 2022; GitHub 7 June 2023.
-
Apptega (ISO 42001)
ISO 42001 compliance software with pre-built questionnaires, evidence collection, Audit Manager and harmonized multi-framework controls. Assigns tasks to internal teams and shares updates with auditors. The page names 12,000+ compliance programs and a Foresite Cybersecurity customer quote.
-
Arthur (Agent Security & Governance)
Discovers agents across endpoints, cloud and private data centers; traces tool calls; enforces policies and guardrails. Official page names fully hosted SaaS, on-prem, or hybrid. An Arthur column maps product evidence to ISO 42001, the EU AI Act and NIST AI RMF.
-
Asenion AI Control System
Asenion AI Control System turns EU AI Act, ISO/IEC 42001 and NIST AI RMF requirements into Assess, Verify and Witness controls with audit-grade evidence. Asenion is ISO/IEC 42001 certified for the Control System. A homepage quote names the former Fairly brand.
-
ControlMap (ISO 42001)
MSP-native GRC platform with ISO/IEC 42001 in a 63+ framework library: mapped controls, evidence and reporting. Partners import the framework to client tenants and cross-map against current frameworks. 2026 release notes add ISO 42001 Jump Start and an ISO 27001 crosswalk.
-
Credo AI
Enterprise AI governance with GAIA assistant, Agent Registry, 300+ integrations and ready-to-deploy policy packs for the EU AI Act, NIST AI RMF and ISO 42001. Named sectors: insurance, financial services, federal and healthcare.
-
Drata (ISO 42001)
Compliance automation that maps ISO 42001 AI-management-system controls, evidence, ownership and risk so enterprises can run an AIMS and stay audit-ready. Help Center also names an AIMS policy template and automated evidence collection. Not a model-assurance tool.
-
Holistic AI
Identify, Protect and Enforce platform: shadow-AI discovery, agentic red-teaming and framework assessments for the EU AI Act, NIST AI RMF and ISO 42001. Guardian Agents (Sentinel watch/detect; Operative act/enforce) via the HAI Guardian SDK. 15+ read-only integrations.
-
Hyperproof (ISO 42001)
Compliance operations platform with an out-of-the-box ISO 42001 AIMS template (Annex A) in a 160+ framework library. Guide covers Clauses 4–10, Annexes A–D and AI risk vs impact assessments. Crosswalks name NIST AI RMF. Audit Module for inviting the auditor.
-
IBM watsonx.governance
IBM AI governance product: enterprise inventory, shadow-AI detection, policy enforcement, and Compliance Accelerators that name the EU AI Act, ISO/IEC 42001 and NIST AI RMF. Sold for cloud and on-prem. Infosys 2,700+ use cases; US Open court-fairness case.
-
ISMS.online (ISO 42001)
ISMS.online ISO 42001 page (Updated 14 July 2026): pre-configured templates and frameworks, dynamic risk management and document management. Certification described as valid three years with annual surveillance. ARM path from gap analysis to certification.
-
ModelOp
Enterprise AI Command Center (Center 3.3) that maps each use case to the EU AI Act, NIST AI RMF and ISO 42001, orchestrates reviews, generates model cards, and adds inline agent prompt-injection blocking. MADE integrates 50+ technologies.
-
Monitaur
AI governance for inventory, a 33-control library, FlightSim pre-deployment simulation (vendor: AI pen test) and Automate Record production logging mapped to NIST AI RMF, ISO 42001 and the EU AI Act.
-
OneTrust AI Governance
AI governance that inventories systems, agents, models, datasets and vendors; applies EU AI Act, NIST AI RMF and ISO 42001 templates; and describes runtime guardrails plus a Python AI Guard SDK on Amazon Bedrock, Microsoft Foundry, Databricks and Gemini.
-
Optro AI Governance
Enterprise AI governance that inventories models, agents and third-party apps and automates 25+ frameworks including the EU AI Act, ISO 42001 and NIST AI RMF. Shadow AI; agents draft and recommend, the team decides. fairnow.ai currently serves this product.
-
Promptfoo
Open-source gen-AI red-teaming tool that scans 50+ vulnerability types and maps plugins to the NIST AI RMF, ISO/IEC 42001 and EU AI Act. Runs locally against HTTP APIs, browsers or models. MIT-licensed.
-
Saidot
Graph-based AI governance platform: 260+ risks, 620+ controls, 110+ policies and 170+ third-party models. Product page: meet 110+ policies including ISO/IEC 42001 and NIST AI RMF, plus the EU AI Act workflow. Homepage names Azure Marketplace; ISO 27001 is the vendor ISMS.
-
Scytale (ISO 42001)
Compliance hub for an ISO 42001 AIMS: automated evidence collection, 24/7 continuous control monitoring, auditor-approved policy templates, vendor risk management and an audit dashboard. Cross-maps common controls with ISO 27001.
-
Sprinto (ISO 42001)
Autonomous trust platform for an audit-ready ISO/IEC 42001 AIMS. Heading: Get ISO 42001 ready, minus the grunt work. 4,000+ customers; AI discovery across extensions, devices, integrations and SSO; real-time policy-drift reviews; one-click Trust Centre.
-
Strike Graph (ISO 42001)
Compliance platform for ISO 42001 AIMS: pre-loaded mapped controls, 100% pre-built AIMS policy and procedure templates, Verify AI documentation checks, gap analysis, evidence dashboards and export to an external assessor.
-
Thoropass (ISO 42001)
ISO 42001 compliance and audit platform with pre-built policy templates, an AI System Impact Assessment, automated evidence collection, a Risk Register, continuous monitoring, and one-audit-multiple-frameworks evidence reuse from a single platform.
-
Trustible
AI governance platform for regulated enterprises: intake, inventory, risk triaging and continuous monitoring. Maps controls to the EU AI Act, NIST AI RMF and ISO 42001. Official 10 April 2026 Leidos story covers defense, intelligence, civil and health programs.
-
Vanta
Compliance automation covering ISO 42001, NIST AI RMF and CMMC (mapped to NIST SP 800-171/172). The ISO 42001 product page also maps evidence to the EU AI Act. Not an AI-model assurance tool.
Official documents and working-group pages
These are the primary public pages we cite for ISO/IEC 42001. They are not directory listings and are not endorsements.
- ISO/IEC 42001:2023 - AI management systems - ISO
- ISO 42001 explained: what it is - ISO
- ISO - AI management systems: what businesses need to know - ISO
- NIST AI RMF to ISO/IEC FDIS 42001 crosswalk - NIST AI Resource Center
- ISO/IEC 42005:2025 - AI system impact assessment - ISO
- ISO/IEC 42006:2025 - Requirements for bodies providing audit and certification of AIMS - ISO
Related articles
- ISO/IEC 42001 and NIST AI 100-1: the two source documents behind the crosswalk
- ISO 42001 vs NIST AI RMF for defense contractors
- Turning the ISO/IEC 42001 to NIST AI RMF crosswalk into supplier evidence requests
- An AI assurance glossary for aerospace and defense
- An AI audit evidence checklist for regulated programs
- ISO/IEC 42001 vs NIST AI RMF: a practical crosswalk
- ISO/IEC 23894 and 5338 for engineering teams
- What auditors ask for in an ISO/IEC 42001 certification audit
- ISO/IEC 42001 vs ISO 9001/AS9100 for aerospace quality systems
- ISO/IEC 42005:2025 AI system impact assessment
Questions
Why are there so few commercial tools tagged for ISO/IEC 42001?
We only tag a tool when the cited public page names this framework (or, for SAE G-34, EUROCAE WG-114, ED-324 or ARP6983). We do not infer support from a related aviation standard.
Where are the official ISO/IEC 42001 documents?
The official documents and working-group pages are listed on this page and on the ISO/IEC 42001 explainer.