AI Verify Framework Maps to ISO/IEC 42001 for AI Governance

On 21 July 2025, the AI Verify Foundation published a mapping between its AI Verify testing framework and ISO/IEC 42001:2023, the international standard for AI management systems. The mapping is intended to help organisations align their responsible AI practices with a globally recognised benchmark for AI governance.

Background on AI Verify and Its Development

AI Verify is a testing framework and set of open-source tools developed by the AI Verify Foundation, a not-for-profit subsidiary of Singapore's Infocomm Media Development Authority (IMDA). The framework helps organisations assess and document responsible AI implementation against 11 governance principles. These principles cover areas such as transparency, explainability, fairness, and accountability, providing a structured way for companies to evaluate their AI systems.

The traditional AI testing framework and software toolkit were first launched by IMDA and the Personal Data Protection Commission (PDPC) on 25 May 2022. This initial release focused on conventional AI systems, offering a standardised methodology for testing and documentation. On 7 June 2023, the framework and toolkit were open-sourced on GitHub, making them freely available for organisations worldwide to use and contribute to.

As generative AI technologies rapidly evolved, the framework was updated to address the unique risks posed by these systems. An updated testing framework covering generative AI was released on 29 May 2025, expanding the scope of AI Verify to include large language models and other generative applications. This update reflected the growing need for governance tools that could keep pace with the latest AI developments.

Understanding ISO/IEC 42001

ISO/IEC 42001:2023 is an international standard published by the International Organization for Standardization and the International Electrotechnical Commission. It specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system within an organisation. The standard provides a framework for managing risks and opportunities associated with AI, with a focus on governance, accountability, and ethical considerations.

Organisations seeking ISO 42001 compliance must demonstrate that they have robust processes in place for overseeing AI systems throughout their lifecycle. This includes defining governance structures, implementing risk management procedures, and ensuring transparency in AI decision-making. The standard is designed to be applicable to any organisation, regardless of size or industry, that uses AI in its operations.

What the Mapping Provides

The mapping between AI Verify and ISO/IEC 42001 serves as a practical tool for organisations already using or considering the AI Verify framework. It shows how the 11 governance principles in AI Verify correspond to the requirements of the international standard. For example, the principle of transparency in AI Verify aligns with ISO/IEC 42001 clauses on documentation and communication, while the principle of accountability maps to the standard's requirements for defining roles and responsibilities.

By following this mapping, organisations can use AI Verify as a stepping stone toward ISO 42001 compliance. The framework's testing tools and documentation templates help organisations gather the evidence needed to demonstrate conformity with the standard. This is particularly valuable for companies that are early in their AI governance journey and need a structured approach to meeting international requirements.

The mapping also highlights areas where AI Verify goes beyond the minimum requirements of ISO/IEC 42001. The framework's emphasis on testing and validation provides additional assurance that AI systems operate as intended, which can support an organisation's broader risk management efforts. For organisations already certified to ISO/IEC 42001, the mapping offers a way to integrate AI Verify into their existing management system without duplicating effort.

Why This Matters for AI Governance

The availability of a mapping between a widely used testing framework and an international standard represents a significant step toward harmonising AI governance practices. As more jurisdictions introduce regulations for AI, organisations face the challenge of navigating multiple sets of requirements. A mapping like this helps reduce duplication by showing how compliance with one framework can support compliance with another.

For organisations operating in Singapore or working with Singaporean partners, the AI Verify framework has become a familiar tool for demonstrating responsible AI practices. The mapping to ISO/IEC 42001 extends the utility of AI Verify beyond the local context, enabling organisations to align their practices with a globally recognised standard. This can be particularly useful for multinational companies that need to satisfy both local expectations and international requirements.

The release of the mapping also reflects a broader trend toward standardisation in AI governance. International standards like ISO/IEC 42001 provide a common language for discussing AI risks and controls, making it easier for organisations to compare practices and learn from each other. Frameworks like AI Verify, in turn, offer practical tools for implementing those standards in real-world settings.

How the Framework Works

AI Verify operates as a testing framework that evaluates AI systems against 11 governance principles. Organisations can use the framework to conduct self-assessments, documenting how their AI systems address each principle. The open-source toolkit includes software tools that automate parts of the assessment process, such as testing for bias or monitoring model performance over time.

The framework covers both traditional AI systems, such as machine learning models used for classification or regression, and generative AI systems, including large language models and image generators. For generative AI, the updated framework released in May 2025 addresses specific risks such as hallucination, misuse, and the generation of harmful content. This dual coverage makes AI Verify relevant to a wide range of AI applications.

Organisations can use the framework at any stage of an AI system's lifecycle, from development through deployment and ongoing monitoring. The documentation produced through AI Verify can serve as evidence for internal audits, regulatory reviews, or certification processes. By mapping this documentation to ISO/IEC 42001 requirements, organisations can streamline their path to certification.

Practical Implications for Organisations

For organisations considering ISO 42001 compliance, the mapping with AI Verify offers a clear starting point. Rather than building a compliance program from scratch, organisations can leverage the work they have already done with AI Verify to identify gaps and prioritise improvements. The mapping provides a checklist of sorts, showing which ISO/IEC 42001 clauses are addressed by each AI Verify principle and where additional work may be needed.

Organisations that have not yet adopted AI Verify may find the mapping useful as a way to evaluate the framework's suitability for their needs. By seeing how AI Verify aligns with an international standard, they can assess whether the framework provides the coverage they require. This can inform decisions about which tools and frameworks to invest in for their AI governance programs.

The mapping also supports continuous improvement, a key principle of both AI Verify and ISO/IEC 42001. As organisations update their AI systems and governance practices, the mapping helps ensure that changes are reflected in both their internal assessments and their compliance documentation. This alignment reduces the risk of gaps or inconsistencies between what an organisation does and what it documents.

Looking Ahead

The publication of the mapping between AI Verify and ISO/IEC 42001 is part of a broader effort to make AI governance more accessible and consistent. As the field of AI continues to evolve, tools like AI Verify and standards like ISO/IEC 42001 will likely play an increasingly important role in helping organisations manage the risks and opportunities of AI. The mapping provides a practical bridge between a national framework and an international standard, offering a model that other countries and frameworks may follow.

For now, organisations can use the mapping to understand how their current practices align with international expectations and to plan their next steps in AI governance. The availability of open-source tools and a clear mapping to an international standard lowers the barrier to entry for organisations of all sizes, making responsible AI more achievable.