ISO 42001 & the EU AI Act: Documenting AI Workflows for Compliance

Teams that put real processes into their AI workflows are now hitting a question the older compliance standards never answered: how do you document the AI work itself? Two frameworks are filling that gap — ISO/IEC 42001, the international AI management system standard, and the EU AI Act (Regulation (EU) 2024/1689), whose transparency obligations begin applying from August 2026. Both are less prescriptive than teams expect, but both lean hard on the same thing: documented, reviewable records of how your AI systems actually run.

This guide explains what each framework actually asks you to write down, where they overlap, and how to capture the AI workflow SOPs — the step-level procedures, the approval records, the human-oversight logs — without reconstructing them from memory.

What ISO/IEC 42001 Requires You to Document

ISO/IEC 42001 (published December 2023) is the first certifiable international standard for AI management systems — an "AIMS." It follows the same Harmonized Structure as ISO 27001 and ISO 9001, with certifiable requirements in clauses 4 through 10. Certification is voluntary, but it is becoming a practical signal for AI-first vendors because it formalizes exactly the governance discipline the EU AI Act pushes toward.

The core requirement is simple to state and hard to do well: you must maintain documented information that proves you ran an AI lifecycle — from scoping and risk assessment to approval, operation, and ongoing review. In practice that means:

• AI policy and objectives — the top-level commitment and measurable targets for responsible AI use.
• AI risk assessments — a documented record of the risks each AI use case poses and the controls you applied.
• AI system life-cycle records — evidence of how each system was designed, tested, deployed, monitored, and, where relevant, retired.
• Approval and oversight records — who signed off on an AI use case, with what rationale, and who provides human oversight.
• Controls from Annex A — the standard's control set, which includes data quality, transparency, and AI system documentation controls.

Notice what both ISO 42001 and its older siblings share: the mandatory items lean toward records and evidence, while the operational detail — the actual step-by-step procedures — is largely sized to your operation. That is exactly where recording the real workflow beats writing a policy from memory.

What the EU AI Act Asks for (and When It Applies)

The EU AI Act is risk-based rather than standard-based. Obligations scale with how risky a system is classified, and the AI Act does not prescribe documentation for minimal-risk systems. But for high-risk AI systems, the requirements are explicit and documentation-heavy. Under Chapter III, providers of high-risk systems must maintain a quality management system (Article 17), keep the technical documentation (Article 11), retain the automatically generated logs (Article 12 and 19), and document human oversight (Article 14), data governance (Article 10), and risk management (Article 9). Deployers must keep logs for at least six months (Article 26).

Most teams reading this will never be classified as high-risk providers — they are deployers or builders of internal tools. But two things still matter for almost everyone. First, the transparency obligations under Article 50 begin applying on 2 August 2026: providers and deployers of generative and interactive AI systems must disclose AI-generated content and inform people they are interacting with an AI. Second, even "minimal-risk" teams increasingly adopt ISO 42001-style governance proactively, because a documented record of how you run your AI systems is the cheapest way to demonstrate good practice long before any regulator asks.

Whether you are a provider or a deployer, the practical deliverable is the same: documented AI agent and workflow records that show how the system was set up, how it runs, and who watches it.

The Overlap: AI Workflow SOPs Are the Missing Evidence

Lay ISO 42001 and the EU AI Act side by side and one gap dominates: neither framework tells you how the AI gets its process in the first place. They assume the AI system executes well-defined procedures, and then they ask you to document that those procedures exist, are approved, and are followed. That "procedure" layer is precisely the AI workflow SOP — the step-level definition of what the agent is supposed to do.

This is why AI teams increasingly encode their procedures as skills and executable SOPs rather than prose in a PDF. An executable SKILL.md file is documentation and instruction in one artifact: it describes the procedure in a form a reviewer can read and an agent can run. That gives compliance reviewers something concrete to inspect and gives the team a single source of truth for what the agent was approved to do.

The trap teams fall into is writing these procedures by hand after the fact. Reconstructed-from-memory SOPs drift from what the agent actually does, and drift is what fails an audit. When the underlying workflow is browser-based — an AI agent filling a form, checking a portal, pulling a report — recording the workflow while it runs captures the exact steps and screens that a written reconstruction would get wrong.

How to Capture AI Workflow SOPs Without Writing Them by Hand

The dependable way to keep AI workflow documentation accurate is to harvest it from the actual execution rather than from memory. Recording a browser workflow click-by-click produces a step-accurate procedure in roughly the time the task takes — far faster than writing and screenshotting each step afterward, and far less likely to silently omit a step.

For anything an agent does inside a browser — onboarding a customer record, running a compliance check, generating a reconciliation — a recorded workflow becomes the evidence trail you can attach to an ISO 42001 control or an EU AI Act log requirement. When the process changes, you re-record rather than reverse-engineering prose, so the documentation tracks reality instead of drifting from it. That currency is exactly what auditors probe in both regimes.

Keep Sensitive AI Documentation Local

AI compliance records can be among the most sensitive material a company holds — internal risk assessments, oversight decisions, workflow details inside customer systems. Where that documentation lives matters as much as what it says. A privacy-first, local-first workflow recorder keeps your AI SOPs and their evidence on your own devices rather than shipping sensitive operational detail to a third-party cloud. That control matters doubly when the documentation itself describes the AI systems handling that data.

Currency is the other half of the story. A compliance file full of stale AI procedures is a finding waiting to happen. Assign an owner to each workflow, review on a cadence, and fold capture into the work itself so the records reflect what the system does today — not what you documented six months ago. Auditors asked to see an audit-proof change trail will quickly separate a living registry from a static one.

FAQ: ISO 42001 and EU AI Act Documentation