The AI Tutor will answer grounded in this lesson's cited source (portal_guide: AUD-ISO-101) and key concepts — authority Informational. Not yet enabled.
This journey is for a certification-body auditor, an internal audit lead, or a consultant auditing an organisation against ISO/IEC 42001:2023. It is deliberately separate from the EU AI Act journey: the Act is a legal regime with statutory deadlines, the standard is a certifiable management system, and this product never presents one inside the other.
Read these three things first
The platform certifies nothing. Conformity is decided by an accredited certification body, never by a tool. Every register carries that disclaimer, and if you ever see the product imply otherwise, raise it — we would treat it as a defect.
The platform does not assert that its records are true. It records what an organisation asserts, with provenance, versioning and an append-only review history. Verifying the underlying facts is your job, and the product is built on that assumption.
In the demonstration environment the data is synthetic. Every register says so on screen. What is not synthetic is the machinery: append-only logs, version chains, segregation-of-duties enforcement, frozen snapshots and role gating. Those are the product, and those are what this journey asks you to test.
Three categories you should keep apart as you work
| Category | Meaning | Who is accountable |
|---|---|---|
| Product-generated | Records the platform computed — snapshots, exports, coverage | The platform; reproducible |
| Organisation assertion | Something the customer stated, uploaded or approved | The customer |
| Inferred | A classification or mapping the platform derived | Nobody, until a named human confirms it |
Where you will work
Everything in this path is performed in the customer platform at app.trustedaigov.io, signed in with a read-only external-auditor account scoped to a single organisation.