ISO 42001 AIMS
AI inventory, risk assessment, oversight, monitoring, and treatment records.
Fixture

AIMS write cockpit

Create AI-system inventory and risk records that can later link to CTM AI-security evidence, agent governance, assessor rooms, and ISO 42001 export packages.

2
2
1
1

AI inventory

2 systems - 1 approved assessments
SupportSupport Copilot

Draft customer support responses for human review before send.

in scopehighrequires_treatment
SecurityVendor Questionnaire Assistant

Draft security questionnaire responses from approved evidence only.

approvedmediumapproved
third party

Support Copilot

in scopehigh

Draft customer support responses for human review before send.

Customer OperationsOwner
OpenAIProvider
gpt-5.4Model
AI governance leadReview owner
DeploymentSaaS support console
ScopeSingapore support team; human review required before external send.
EvidenceB.10.2:manual:manual://iso42001/support-copilot-scope.pdf

Data classes

support ticket textcustomer metadata

Latest AIMS risk assessment

12 Jun 2026
requires treatment

High-risk customer-support AI use case awaiting treatment closure.

criticalInherent risk
highResidual risk
5/5Impact
4/5Likelihood
Treatment planAdd weekly privacy sample review before approval.
Due10 Jul 2026
Risk evidenceB.10.2:manual:manual://iso42001/support-copilot-risk.pdf

Impact assessment proof

3 stakeholder groups mapped

Structured ISO 42001 AIMS impact review covering affected users, customer-data handling, notice, oversight, and residual harm before production approval.

Affected stakeholderssupport agents, support leads, customers
Impact categoriesprivacy: Customer ticket content and metadata can be summarized by the model. | fairness: Tone and prioritization must not vary by customer segment. | operational: Incorrect responses may increase support rework or customer frustration.
Mitigationshuman review: required_before_send | privacy sampling: weekly | restricted actions: refund approval,account suspension
Rights and safetycustomer rights: Human review before outbound send protects correction and escalation. | safety: No medical, legal, financial, refund, or account-suspension decision authority.
Data subject considerationspersonal data: Support ticket text can include personal data and account context. | retention: No model-side retention beyond the approved vendor contract.
Residual impactResidual customer-impact risk remains high until weekly privacy sampling and final customer notice are approved.

Workshop writes

Live writes require CYBERG7_API_URL; fixture mode shows the workshop workflow without persisting changes.

Create AI system

Create risk assessment