ISO/IEC 42001

ISO/IEC 42001 certifies your AI management system, and the certification is yours to hold. NeuralTrust supplies the operational evidence and enforcement it rests on.

Coverage at a glance

Clause	Requirement	Coverage
4	Context	🟢 Partially covered
5	Leadership	🟢 Partially covered
6	Planning	✅ Covered
7	Support	🟢 Partially covered
8	Operation	✅ Covered
9	Performance evaluation	✅ Covered
10	Improvement	🟢 Partially covered

Clauses 4 to 10

Clause	What it asks	What NeuralTrust contributes
4 — Context	Understand your AI footprint and interested parties	The Registry inventories what each gateway may reach: model providers on the LLM plane, MCP servers on the MCP plane, each an entry plus the credential that reaches it
5 — Leadership	Policy, roles, accountability	Roles and permissions per product, SSO and SCIM provisioning, and break-glass as the auditable emergency path
6 — Planning	Risk assessment and treatment	The detector catalog defines what is looked for; TrustGuard and TrustGate policies apply the treatment, each with an Observe mode that measures before it enforces
7 — Support	Resources, competence, documented information	Audit logs and TrustGuard findings as retained documented information
8 — Operation	Operational planning and control	The gateway is the control point: policies decide budgets, rate limits, what may be said and which tools may run, scoped by who calls and what they touch; access levels decide who reaches which server
9 — Performance evaluation	Monitoring, measurement, analysis	Alerts across both products with correlation and deduplication, and SIEM forwarding as OCSF Detection Findings
10 — Improvement	Nonconformity and corrective action	Findings carry the detector, the side, the decision and its evidence; policy history records what changed and when

Annex A controls

Control	Evidence
A.5 — Assessing impacts of AI systems	Findings per policy and detector, with severity and evidence summary
A.6 — AI system life cycle	Request-level records through the gateway, with end-user attribution tying traffic behind a shared key to the person a client was serving
A.7 — Data for AI systems	Data Loss Prevention detects PII and secrets on input and output, and masks them where the Transform action is set; credential redaction runs before any record is written
A.8 — Information for interested parties	⚪ Not covered — neither product enforces AI-identity disclosure
A.9 — Responsible use of AI systems	Enforced guardrails, rate limits, budgets and request size limits
A.10 — Third-party relationships	The Registry bounds every provider and MCP server a gateway may reach; Indirect Prompt Injection inspects what a third-party tool returns, and its tool descriptions

Residency

Clause 8 and Annex A.7 both turn on where records live, which your deployment decides:

Deployment	Where records live
Self-hosted / hybrid	Your own infrastructure, entirely
SaaS	The NeuralTrust region your workspace was provisioned in

On hybrid, evaluated traffic never leaves your perimeter — the link back to NeuralTrust carries configuration only. On SaaS the region is fixed at provisioning. See Data handling.

Your evidence pack

Inventory — registry entries for model providers and MCP servers per gateway.
Control configuration — the policy set in force, its mode and its scope.
Operating evidence — findings, and the request bodies behind them, credential-redacted and capped at 1 MiB.
Administrative trail — audit logs retained 365 days, exportable as CSV or JSON.
Retention statement — every record carries its retention plan and an absolute expiry stamped when written.

Where NeuralTrust stops

Clauses 4, 5, 7 and 10 are partly covered because the rest is organizational: scoping and stakeholder analysis, writing your AI policy, competence records, and the corrective-action process itself. Annex A.8 is not covered at all. Clause and Annex A identifiers do not ship as tags on findings. This page is the mapping.

See also EU AI Act, OWASP LLM Top 10 and NIST AI RMF.

Overview

Organization

Identity & Access

Telemetry

Audit & Compliance

Deployment

Coverage at a glance

Clauses 4 to 10

Annex A controls

Residency

Your evidence pack

Where NeuralTrust stops

​Coverage at a glance

​Clauses 4 to 10

​Annex A controls

​Residency

​Your evidence pack

​Where NeuralTrust stops

Coverage at a glance

Clauses 4 to 10

Annex A controls

Residency

Your evidence pack

Where NeuralTrust stops