ISO 42001 AIMS
AI inventory, risk assessment, oversight, monitoring, and treatment records.
AIMS write cockpit
Create AI-system inventory and risk records that can later link to CTM AI-security evidence, agent governance, assessor rooms, and ISO 42001 export packages.
2
2
1
1
AI inventory
2 systems - 1 approved assessmentsembedded
Vendor Questionnaire Assistant
approvedmedium
Draft security questionnaire responses from approved evidence only.
GRC LeadOwner
CyberG7Provider
router-managedModel
Compliance LeadReview owner
DeploymentEvidence OS questionnaire workspace
ScopeDrafting only; no external answer can be sent without human approval.
Evidence
B.3.6:manual:manual://ai-questionnaire-assistant-approval.pdfData classes
Latest AIMS risk assessment
09 Jun 2026Approved with human review and citation gates.
highInherent risk
mediumResidual risk
3/5Impact
3/5Likelihood
Treatment planNo active treatment plan.
Due09 Sept 2026
Risk evidence
B.3.6:manual:manual://ai-questionnaire-assistant-assessment.pdfImpact assessment proof
3 stakeholder groups mappedLightweight AIMS impact review for evidence-grounded drafting, with human approval before external questionnaire submission.
Affected stakeholderssecurity reviewers, sales engineers, customers
Impact categoriesaccuracy: Drafted answers can misstate control operation if evidence is stale. | confidentiality: Questionnaire data must remain inside approved evidence sources.
Mitigationsevidence citation required: true | human approval required: true
Rights and safetysafety: No autonomous contractual or compliance attestation.
Data subject considerationspersonal data: No customer personal data should be used in generated responses.
Residual impactResidual impact is medium because answers remain draft-only until human approval.