Frameworks & Standards
ISO/IEC 42001
ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System. It applies to organizations that develop, provide, or use AI systems.
Buyer question
"Can Legra help us govern AI systems and agents with explicit scope, ownership, risk controls, change history, operational evidence, and human oversight?"
Legra fit
| Assessment area | Legra fit | Status |
|---|---|---|
| Organizational AI management system | Legra can hold policies, objectives, responsibilities, evidence, and approvals, but the organization must establish and operate the management system. | External responsibility |
| AI system context and inventory | Workspaces, catalogs, Use Case Trees, Apps, Stories, personas, Data Products, and semantic metadata can identify AI systems, purposes, inputs, tools, owners, and affected domains. | Native fit |
| Data governance | Stable identities, provenance, validation, versioning, access boundaries, and quality metadata support governed AI data and knowledge. | Native fit |
| Lifecycle and change control | Branch isolation, review, merge gates, signed commits, task history, and events make changes to agent knowledge and executable Stories reviewable and auditable. | Native fit |
| AI risk assessment and treatment | Legra can store risks, controls, decisions, tests, and treatment evidence. The organization remains responsible for identifying and accepting model, safety, societal, and operational risks. | Partial fit |
| Supplier and model governance | Catalog and provenance records can identify external models, data, services, and dependencies, but supplier assurance and model-provider controls remain external. | Partial fit |
| Monitoring and continual improvement | Validation reports, events, tasks, provenance, and version history provide evidence for review and improvement, while management review and corrective-action ownership remain organizational processes. | Partial fit |
What Legra can say
Legra can make the governed context around an AI system operational:
- A Use Case Tree records why an agent or AI-enabled application exists.
- Personas and Stories constrain what an agent is expected and permitted to do.
- Workspaces and branches isolate data, experimentation, and production changes.
- Validation and merge gates turn declared controls into enforceable promotion conditions.
- Signed history, tasks, and events provide evidence for review, incidents, and continual improvement.
- Semantic metadata connects AI systems to their data, policies, owners, suppliers, risks, controls, and outcomes.
Assessment boundary
ISO/IEC 42001 certification applies to an organization's management system, not to a graph database or agent platform in isolation. Legra does not appoint accountable officers, define risk appetite, evaluate every model, conduct management reviews, or certify suppliers.
It supplies technical controls and queryable evidence that an organization can use inside its AI management system.