security
May 6, 2026
By Teun
AWS releases ISO/IEC 42001:2023 compliance guide for AI systems
AWS has published a compliance guide for ISO/IEC 42001:2023, the international standard for AI management systems. The guide maps the standard’s clauses and controls to AWS services and says customers can use AWS tooling to support evidence collection, monitoring, and audit preparation.
AWS Security Blog has released a new compliance guide, ISO/IEC 42001:2023 on AWS, aimed at organizations that are building and operating Artificial Intelligence Management Systems, or AIMS, on the company’s cloud platform. The guide is designed to help teams align AI workloads with ISO/IEC 42001:2023, the international standard for AI governance and risk management.
According to AWS, the document is intended for cloud architects, AI and machine learning engineers, security teams, compliance leaders, and DevOps practitioners. It explains how organizations can use AWS services to implement and operate controls that match the requirements in ISO 42001’s clauses 4 through 10, along with the AI-specific controls in Annex A.
⚡ New to this?
ISO/IEC 42001:2023 is a standard for managing AI systems, similar to how other standards define controls for security or quality. An AIMS, or Artificial Intelligence Management System, is the set of policies, roles, controls, and records an organization uses to govern AI safely and consistently. For non-experts, this matters because companies adopting AI are being pushed to show not just that models work, but that they are managed in a controlled, auditable way.
🦞 OpenClaw angle
If you run self-hosted AI agents or workflows, use this guide as a checklist for your own AIMS scope: define system boundaries, owners, and approval points before you expand deployment. Automate evidence capture now, including prompts, model versions, policy changes, and incident logs, so you are not reconstructing audits later. Treat infrastructure-as-code and config review as part of your compliance process, not just your deployment process.
AWS said the guide is meant to support customers as they deploy AI and generative AI systems in the cloud. The company said that aligning with the standard can help strengthen AI governance, improve risk management, and support responsible AI practices.
The guide also lays out how AWS services can fit into an AIMS under the AWS Shared Responsibility Model for AI. AWS says it provides the cloud infrastructure and built-in responsible AI capabilities, while customers are responsible for defining the scope of their AIMS, putting controls in place, and showing conformity during certification audits.
That division of responsibility is central to the guide. The company said the material is meant to help customers understand which parts of AI compliance AWS supports through its platform and which parts still need to be managed internally.
Inside the guide, AWS covers the ISO 42001 framework itself, including how it fits into the wider ISO AI standards family. It also provides scoping guidance for defining AI system boundaries inside an environment, which is a key step for organizations that want to establish an AIMS on AWS.
The guide includes a clause-by-clause mapping from ISO 42001:2023 to AWS services and architectural capabilities. According to AWS, that mapping covers organizational context, leadership, planning, support, operation, performance evaluation, and improvement.
AWS also describes implementation guidance for Annex A controls, including AI policies, internal organization, resources for AI systems, impact assessments, AI system life cycle management, data governance, transparency for interested parties, use of AI systems, and third-party and customer relationships. The company said these controls can be supported with AWS security architecture and AWS-native services.
Another focus of the guide is evidence collection. AWS said customers can use native tooling to gather documentation, improve operational consistency, and prepare audit-ready evidence for certification reviews. The company also recommends operationalizing AI compliance tasks through automation and infrastructure-as-code.
The guide is now available to download as ISO/IEC 42001:2023 on AWS, and AWS Security Assurance Services is listed as a contact point for further assistance.
