The Evidence ISO 42001 Auditors Actually Ask For

Auditors reward evidence you can produce on demand. Policies get skimmed; queries get run.

Evidence that consistently passes

• Impact assessments stored with the model, linked to a specific version.
• A queryable log of model deployments — who deployed which version, when, and against which evaluation results.
• Bias and performance metrics with thresholds encoded in code, not slides.
• Incident records that include the log slice, the affected users, and the remediation.

Evidence that consistently fails

• Static screenshots of dashboards.
• Policy documents without corresponding system artifacts.
• Post-hoc reconstructions built from application logs after the audit is announced.

Build the evidence trail in production, not in the two weeks before the audit.