[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C247FT6CP95CPXTZ8S38QP":3,"skill-same:01M6C247FT6CP95CPXTZ8S38QP":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":13,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":61,"install":62,"resources":75},"01M6C247FT6CP95CPXTZ8S38QP","iso42001-specialist",null,"ISO\u002FIEC 42001:2023 AI Management System (AIMS) specialist for compliance teams running internal audits. Three decisions: (1) Where are the gaps against Clauses 4-10 and what do we close first? (2) What goes in the AI risk register and which Annex A controls treat each risk? (3) What's the 12-month internal audit plan that satisfies Clause 9.2? Use when preparing for certification, scoping internal audit cycles, or onboarding AI systems into an existing ISMS (27001) \u002F QMS (13485) program. NOT an executive AI strategy skill (see chief-ai-officer-advisor). NOT EU AI Act compliance (see compliance-team-eu-ai-act).","mne20114-hash\u002Fgest35bi","mne20114-hash","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F224168109?v=4","01M6C0JCR7334CZ39YWTZXX2NG","01M6C0JCWN0NBWMQTW1CPG2Z4G",0,"MIT","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fra-qm-team\u002Fcompliance-team-iso42001\u002Fskills\u002Fiso42001-specialist\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"iso42001 specialist","certification","use","management","strategy","decisions","system","audit plan","plan","team","risk register","isms","first","risk","NIST","eu ai act","compliance","audit","scheduler","teams","2026-11-10 10:12:30",false,"---\nname: \"iso42001-specialist\"\ndescription: \"ISO\u002FIEC 42001:2023 AI Management System (AIMS) specialist for compliance teams running internal audits. Three decisions: (1) Where are the gaps against Clauses 4-10 and what do we close first? (2) What goes in the AI risk register and which Annex A controls treat each risk? (3) What's the 12-month internal audit plan that satisfies Clause 9.2? Use when preparing for certification, scoping internal audit cycles, or onboarding AI systems into an existing ISMS (27001) \u002F QMS (13485) program. NOT an executive AI strategy skill (see chief-ai-officer-advisor). NOT EU AI Act compliance (see compliance-team-eu-ai-act).\"\nlicense: MIT\nmetadata:\n  version: 1.0.0\n  author: Alireza Rezvani\n  category: ra-qm-team\n  domain: ai-management-system-compliance\n  updated: 2026-05-13\n  python-tools: aims_gap_analyzer.py, ai_risk_register_builder.py, aims_audit_scheduler.py\n  frameworks: iso-42001, iso-23894, iso-38507, nist-ai-rmf, eu-ai-act-mapping\n---\n\n# ISO\u002FIEC 42001 AI Management System Specialist\n\nInternal-audit-grade operating skill for ISO\u002FIEC 42001:2023. **Three decisions, no executive AI strategy:**\n\n1. **Where are the AIMS gaps against Clauses 4–10?** — coverage scoring per clause + remediation priority\n2. **What's the AI risk register, and which controls treat each risk?** — Annex A.2–A.10 control mapping per ISO 23894 risk method\n3. **What's the Clause 9.2 internal audit plan?** — 12-month schedule with scope, frequency, auditor independence checks\n\nThis skill is **NOT a chief-ai-officer-advisor replacement**. CAIO decides whether to build\u002Fbuy a model and what business risk to accept. This skill operates the management-system discipline that captures those decisions in audit-ready evidence.\n\nThis skill is **NOT an EU AI Act compliance skill**. ISO 42001 is a voluntary management-system standard; EU AI Act is binding product-safety regulation. They overlap (a high-risk AI system per Article 6(2) of the AI Act typically requires the QMS in Article 17, which ISO 42001 can satisfy in part) but the artefacts differ. See `compliance-team-eu-ai-act` for Article-level conformity assessment.\n\nThis skill is **NOT a substitute for ISO 23894 + 38507**. 42001 is the management system; 23894 is the AI risk methodology that feeds Clause 6.1; 38507 is the governance lens. The `ai_risk_register_builder.py` tool implements the 23894 process; treat the references as the methodology bridge.\n\n## Keywords\n\nISO 42001, ISO\u002FIEC 42001:2023, AI Management System, AIMS, AI governance, AI risk management, ISO 23894, AI risk assessment, ISO 38507, AI compliance, AI audit, internal audit AI, Annex A controls, AI risk register, AI policy, AI impact assessment, conformity declaration, AI lifecycle, AI risk treatment, NIST AI RMF, NIST AI Risk Management Framework, ISACA AI audit, BSI AIC4, AI assurance, responsible AI, AI ethics governance, AI system inventory, third-party AI risk, AI vendor management, AI change management, AI incident management\n\n## Quick Start\n\n```bash\n# Decision A: AIMS gap analysis against Clauses 4-10\npython scripts\u002Faims_gap_analyzer.py                           # embedded sample (mid-stage AI SaaS)\npython scripts\u002Faims_gap_analyzer.py path\u002Fto\u002Faims_evidence.json\n\n# Decision B: AI risk register + Annex A control mapping\npython scripts\u002Fai_risk_register_builder.py                    # embedded 7-risk sample\npython scripts\u002Fai_risk_register_builder.py path\u002Fto\u002Frisks.json\n\n# Decision C: Clause 9.2 internal audit 12-month plan\npython scripts\u002Faims_audit_scheduler.py                        # embedded 4-domain sample\npython scripts\u002Faims_audit_scheduler.py path\u002Fto\u002Fscope.json\n```\n\n## Key Questions (ask these first)\n\n- **Does the AIMS scope statement (Clause 4.3) name every AI system, including embedded models and third-party AI services?** If \"AI features added by our SaaS vendors\" is not in scope, the AIMS is incomplete.\n- **Does the AI policy (Clause 5.2) commit to lawful use AND beneficial purpose AND human oversight AND continual improvement?** Missing any of the four = nonconformity at certification.\n- **Has the AI risk assessment (Clause 6.1.2) been re-run since the last material model change?** Concept drift is not a one-time event.\n- **Who signs the AI impact assessment for high-impact systems (Annex A.5.4)?** If no signed accountability, the control is missing.\n- **What's the internal audit cadence (Clause 9.2)?** ISO management-system standards expect ≥ once per 3-year cycle per clause; mature programs do annual.\n- **Is there a documented procedure for AI incidents (Annex A.9.3)?** Untreated post-deployment monitoring is the #1 nonconformity in early adopters.\n\n## Core Responsibilities\n\n### 1. AIMS Gap Analysis (Clauses 4–10)\n\n**The framework:** ISO 42001 follows the Annex SL high-level structure shared with ISO 9001 \u002F 27001 \u002F 13485. Clauses 4–10 are the management-system requirements; Annex A controls A.1–A.10 are the AI-specific operational controls.\n\n| Clause | What it requires | Common gap |\n|---|---|---|\n| **4. Context** | AI scope, interested parties, external context | Scope omits third-party AI services |\n| **5. Leadership** | AI policy, roles, accountability | Policy treats \"AI ethics\" as marketing copy, not commitment |\n| **6. Planning** | AI risk + impact assessment, objectives | Risk register doesn't link to controls |\n| **7. Support** | Resources, competence, awareness, documented info | Competence requirements undefined for ML engineers |\n| **8. Operation** | Operational planning, AI system lifecycle | Lifecycle stages not mapped to Annex A controls |\n| **9. Performance** | Monitoring, internal audit, management review | Drift monitoring exists in code but not in management review inputs |\n| **10. Improvement** | Nonconformity, corrective action, continual improvement | CAPA loop separate from existing 13485\u002F9001 CAPA — duplication |\n\n**Run** `aims_gap_analyzer.py` with an evidence inventory JSON to score each clause (full \u002F partial \u002F missing) and get a prioritized remediation list.\n\nSee `references\u002Fiso42001_clauses.md` for the full clause-by-clause walkthrough with audit evidence expectations.\n\n### 2. AI Risk Register + Annex A Control Mapping\n\n**The framework:** Clause 6.1.2 requires AI risk assessment; Clause 6.1.3 requires risk treatment. Annex A provides 38 controls organized into 10 control categories (A.2–A.10). The risk register must show each identified risk linked to ≥ 1 control that treats it.\n\n**Annex A control categories (the 10):**\n\n| ID | Category | Example controls |\n|---|---|---|\n| **A.2** | AI policy | A.2.2 AI policy, A.2.3 alignment with other policies |\n| **A.3** | Internal organization | A.3.2 AI roles & responsibilities, A.3.3 reporting concerns |\n| **A.4** | Resources for AI systems | A.4.2 data resources, A.4.3 tooling, A.4.4 human resources |\n| **A.5** | Assessing impacts | A.5.2 AI system impact assessment, A.5.4 documentation of impact assessment |\n| **A.6** | AI system lifecycle | A.6.2.2 objectives, A.6.2.3 lifecycle phases, A.6.2.4 verification & validation |\n| **A.7** | Data for AI systems | A.7.2 data management, A.7.3 data quality, A.7.4 data provenance, A.7.5 data preparation |\n| **A.8** | Information for interested parties | A.8.2 system documentation, A.8.3 user information, A.8.4 communication of incidents |\n| **A.9** | Use of AI systems | A.9.2 intended use, A.9.3 monitoring of operation, A.9.4 logging of system events |\n| **A.10** | Third-party & customer relationships | A.10.2 supplier relationships, A.10.3 customer relationships |\n\nISO\u002FIEC 23894:2023 provides the AI-specific risk-management process (the methodology); 42001 Annex A provides the controls. The risk register is the bridge.\n\n**Run** `ai_risk_register_builder.py` with an identified-risks JSON to produce a structured register with mapped controls + residual-risk verdict per ISO 23894 risk-treatment options.\n\nSee `references\u002Faims_controls_annex_a.md` for the full 38-control catalogue with audit evidence per control.\n\n### 3. Clause 9.2 Internal Audit Plan\n\n**The framework:** Clause 9.2 requires \"internal audits at planned intervals to provide information on whether the AIMS conforms to the organization's requirements and is effectively implemented and maintained.\" That's the management-system requirement; the **how often** and **how deep** are organizational choices.\n\n**Mature-program defaults:**\n\n- Cover every clause + every applicable Annex A control over a 3-year cycle (rolling)\n- Annual full-system audit covering Clauses 4, 5, 9, 10 (the \"always relevant\" clauses)\n- Quarterly or semi-annual deep dives on Clauses 6, 7, 8 by domain (per AI system or per lifecycle phase)\n- Auditor independence: nobody audits their own work; A.6 lifecycle owner cannot audit Clause 8 operation\n\n**Run** `aims_audit_scheduler.py` with a scope JSON (AI systems in scope, prior-year findings, certification cycle phase) to produce a 12-month plan with auditor assignments and independence checks.\n\nSee `references\u002Faims_implementation_guide.md` for the maturity model and rollout sequencing (year 1 establish, year 2 certify, year 3+ continual improvement).\n\n## Workflows\n\n### Workflow 1: AIMS Gap Closure for Certification (4–8 weeks)\n**Goal:** Identify gaps; prioritize remediation; close before stage 1 certification audit.\n\n```bash\n# 1. Inventory current AIMS evidence (policies, procedures, records)\npython scripts\u002Faims_gap_analyzer.py aims_evidence.json\n# 2. Review gap matrix; group by clause\n# 3. For each gap, identify owner + due date (target: close before stage 1)\n# 4. Cross-check against ISO 27001 \u002F 13485 existing artifacts — many can be reused\n# 5. Cross-check against EU AI Act obligations (use compliance-team-eu-ai-act)\n# 6. Output: prioritized remediation plan with owners + dates\n```\n\n### Workflow 2: AI Risk Register Build (1–2 weeks)\n**Goal:** Construct the Clause 6.1.2 risk register with full Annex A control coverage.\n\n```bash\n# 1. Run ISO 23894 risk identification across AI lifecycle (data, model, deployment, decommission)\n# 2. Capture each risk with: source, event, consequence, likelihood, impact\npython scripts\u002Fai_risk_register_builder.py risks.json\n# 3. For each high\u002Fcritical risk, confirm ≥ 1 Annex A control is selected as treatment\n# 4. Document residual risk acceptance with management signoff\n# 5. Cross-check with cs-caio-advisor on executive risk acceptance for \"tolerate\" decisions\n# 6. Log via management review (Clause 9.3)\n```\n\n### Workflow 3: Annual Internal Audit Plan (1 day)\n**Goal:** Produce the 12-month Clause 9.2 plan with auditor independence.\n\n```bash\n# 1. Pull last year's audit findings and certification cycle status (year 1\u002F2\u002F3)\npython scripts\u002Faims_audit_scheduler.py audit_scope.json\n# 2. Confirm auditor independence per assignment\n# 3. Confirm coverage hits every clause and every applicable Annex A control over rolling 3 years\n# 4. Submit plan for management review approval (Clause 9.3 input)\n```\n\n### Workflow 4: Cross-Framework Reuse Mapping (per system onboarded)\n**Goal:** When adding a new AI system, map ISO 42001 evidence against existing 27001 + 13485 evidence to avoid duplication.\n\n1. Pull existing ISO 27001 Annex A controls + ISO 13485 procedures relevant to the system\n2. For each ISO 42001 Annex A control, identify whether an existing artifact already satisfies it (e.g., 27001 A.8.16 monitoring activities can extend to AI system monitoring)\n3. Add the AI-specific overlay only where the existing control doesn't cover it\n4. Document mapping in the AIMS scope statement (Clause 4.3)\n\n## Output Standards\n\n```\n**Bottom Line:** [one sentence — gap severity + the one thing to close first]\n**The Decision:** [one of: gap-closure | risk-treatment | audit-scope]\n**The Evidence:** [clause numbers + control IDs from the tool, not adjectives]\n**How to Act:** [3 concrete next steps with owners + dates]\n**Your Decision:** [the call only the compliance officer or CAIO can make — risk acceptance, scope expansion, certification readiness]\n```\n\n## Adjacent Skills\n\n- `ra-qm-team\u002Fskills\u002Finformation-security-manager-iso27001\u002F` — ISO 27001 ISMS implementation (many controls reusable for AIMS A.7 data controls)\n- `ra-qm-team\u002Fskills\u002Fquality-manager-qms-iso13485\u002F` — ISO 13485 QMS (provides CAPA + management-review machinery the AIMS reuses)\n- `ra-qm-team\u002Fskills\u002Fgdpr-dsgvo-expert\u002F` — GDPR DPIA process (input to AIMS A.5 impact assessment for personal-data systems)\n- `ra-qm-team\u002Fskills\u002Fisms-audit-expert\u002F` — ISO 27001 internal audit pattern (the audit scheduler mirrors this for AIMS)\n- `ra-qm-team\u002Fskills\u002Fsoc2-compliance\u002F` — SOC 2 trust services (reusable controls for AIMS A.10 third-party relationships)\n- `ra-qm-team\u002Fcompliance-team-eu-ai-act\u002F` — EU AI Act Article-level compliance (binding regulation companion to voluntary 42001)\n- `compliance-os\u002F` — Meta-orchestrator for multi-framework programs (run AIMS as one framework among 9)\n- `c-level-advisor\u002Fchief-ai-officer-advisor\u002F` — Executive AI strategy (build-vs-buy, cost economics — different audience)\n\n## References\n\n- [iso42001_clauses.md](references\u002Fiso42001_clauses.md) — Clauses 4–10 walkthrough with audit evidence expectations, common gaps, and reusable artifacts from ISO 27001\u002F13485\n- [aims_controls_annex_a.md](references\u002Faims_controls_annex_a.md) — All 38 Annex A controls (A.2–A.10) with implementation guidance, audit evidence, and severity of failure\n- [aims_implementation_guide.md](references\u002Faims_implementation_guide.md) — 3-year maturity model (establish → certify → continually improve), rollout sequencing, integration with existing ISMS\u002FQMS programs\n- [cross_framework_mapping_ai.md](references\u002Fcross_framework_mapping_ai.md) — ISO 42001 ↔ EU AI Act ↔ NIST AI RMF ↔ ISO 23894 ↔ ISO 38507 ↔ ISO 27001 control-level mapping with mapping-confidence ratings\n\n---\n\n**Version:** 1.0.0\n**Status:** Production Ready\n","# ISO\u002FIEC 42001 AI Management System Specialist\n\nInternal-audit-grade operating skill for ISO\u002FIEC 42001:2023. **Three decisions, no executive AI strategy:**\n\n1. **Where are the AIMS gaps against Clauses 4–10?** — coverage scoring per clause + remediation priority\n2. **What's the AI risk register, and which controls treat each risk?** — Annex A.2–A.10 control mapping per ISO 23894 risk method\n3. **What's the Clause 9.2 internal audit plan?** — 12-month schedule with scope, frequency, auditor independence checks\n\nThis skill is **NOT a chief-ai-officer-advisor replacement**. CAIO decides whether to build\u002Fbuy a model and what business risk to accept. This skill operates the management-system discipline that captures those decisions in audit-ready evidence.\n\nThis skill is **NOT an EU AI Act compliance skill**. ISO 42001 is a voluntary management-system standard; EU AI Act is binding product-safety regulation. They overlap (a high-risk AI system per Article 6(2) of the AI Act typically requires the QMS in Article 17, which ISO 42001 can satisfy in part) but the artefacts differ. See `compliance-team-eu-ai-act` for Article-level conformity assessment.\n\nThis skill is **NOT a substitute for ISO 23894 + 38507**. 42001 is the management system; 23894 is the AI risk methodology that feeds Clause 6.1; 38507 is the governance lens. The `ai_risk_register_builder.py` tool implements the 23894 process; treat the references as the methodology bridge.\n\n## Keywords\n\nISO 42001, ISO\u002FIEC 42001:2023, AI Management System, AIMS, AI governance, AI risk management, ISO 23894, AI risk assessment, ISO 38507, AI compliance, AI audit, internal audit AI, Annex A controls, AI risk register, AI policy, AI impact assessment, conformity declaration, AI lifecycle, AI risk treatment, NIST AI RMF, NIST AI Risk Management Framework, ISACA AI audit, BSI AIC4, AI assurance, responsible AI, AI ethics governance, AI system inventory, third-party AI risk, AI vendor management, AI change management, AI incident management\n\n## Quick Start\n\n```bash\n# Decision A: AIMS gap analysis against Clauses 4-10\npython scripts\u002Faims_gap_analyzer.py                           # embedded sample (mid-stage AI SaaS)\npython scripts\u002Faims_gap_analyzer.py path\u002Fto\u002Faims_evidence.json\n\n# Decision B: AI risk register + Annex A control mapping\npython scripts\u002Fai_risk_register_builder.py                    # embedded 7-risk sample\npython scripts\u002Fai_risk_register_builder.py path\u002Fto\u002Frisks.json\n\n# Decision C: Clause 9.2 internal audit 12-month plan\npython scripts\u002Faims_audit_scheduler.py                        # embedded 4-domain sample\npython scripts\u002Faims_audit_scheduler.py path\u002Fto\u002Fscope.json\n```\n\n## Key Questions (ask these first)\n\n- **Does the AIMS scope statement (Clause 4.3) name every AI system, including embedded models and third-party AI services?** If \"AI features added by our SaaS vendors\" is not in scope, the AIMS is incomplete.\n- **Does the AI policy (Clause 5.2) commit to lawful use AND beneficial purpose AND human oversight AND continual improvement?** Missing any of the four = nonconformity at certification.\n- **Has the AI risk assessment (Clause 6.1.2) been re-run since the last material model change?** Concept drift is not a one-time event.\n- **Who signs the AI impact assessment for high-impact systems (Annex A.5.4)?** If no signed accountability, the control is missing.\n- **What's the internal audit cadence (Clause 9.2)?** ISO management-system standards expect ≥ once per 3-year cycle per clause; mature programs do annual.\n- **Is there a documented procedure for AI incidents (Annex A.9.3)?** Untreated post-deployment monitoring is the #1 nonconformity in early adopters.\n\n## Core Responsibilities\n\n### 1. AIMS Gap Analysis (Clauses 4–10)\n\n**The framework:** ISO 42001 follows the Annex SL high-level structure shared with ISO 9001 \u002F 27001 \u002F 13485. Clauses 4–10 are the management-system requirements; Annex A controls A.1–A.10 are the AI-specific operational controls.\n\n| Clause | What it requires | Common gap |\n|---|---|---|\n| **4. Context** | AI scope, interested parties, external context | Scope omits third-party AI services |\n| **5. Leadership** | AI policy, roles, accountability | Policy treats \"AI ethics\" as marketing copy, not commitment |\n| **6. Planning** | AI risk + impact assessment, objectives | Risk register doesn't link to controls |\n| **7. Support** | Resources, competence, awareness, documented info | Competence requirements undefined for ML engineers |\n| **8. Operation** | Operational planning, AI system lifecycle | Lifecycle stages not mapped to Annex A controls |\n| **9. Performance** | Monitoring, internal audit, management review | Drift monitoring exists in code but not in management review inputs |\n| **10. Improvement** | Nonconformity, corrective action, continual improvement | CAPA loop separate from existing 13485\u002F9001 CAPA — duplication |\n\n**Run** `aims_gap_analyzer.py` with an evidence inventory JSON to score each clause (full \u002F partial \u002F missing) and get a prioritized remediation list.\n\nSee `references\u002Fiso42001_clauses.md` for the full clause-by-clause walkthrough with audit evidence expectations.\n\n### 2. AI Risk Register + Annex A Control Mapping\n\n**The framework:** Clause 6.1.2 requires AI risk assessment; Clause 6.1.3 requires risk treatment. Annex A provides 38 controls organized into 10 control categories (A.2–A.10). The risk register must show each identified risk linked to ≥ 1 control that treats it.\n\n**Annex A control categories (the 10):**\n\n| ID | Category | Example controls |\n|---|---|---|\n| **A.2** | AI policy | A.2.2 AI policy, A.2.3 alignment with other policies |\n| **A.3** | Internal organization | A.3.2 AI roles & responsibilities, A.3.3 reporting concerns |\n| **A.4** | Resources for AI systems | A.4.2 data resources, A.4.3 tooling, A.4.4 human resources |\n| **A.5** | Assessing impacts | A.5.2 AI system impact assessment, A.5.4 documentation of impact assessment |\n| **A.6** | AI system lifecycle | A.6.2.2 objectives, A.6.2.3 lifecycle phases, A.6.2.4 verification & validation |\n| **A.7** | Data for AI systems | A.7.2 data management, A.7.3 data quality, A.7.4 data provenance, A.7.5 data preparation |\n| **A.8** | Information for interested parties | A.8.2 system documentation, A.8.3 user information, A.8.4 communication of incidents |\n| **A.9** | Use of AI systems | A.9.2 intended use, A.9.3 monitoring of operation, A.9.4 logging of system events |\n| **A.10** | Third-party & customer relationships | A.10.2 supplier relationships, A.10.3 customer relationships |\n\nISO\u002FIEC 23894:2023 provides the AI-specific risk-management process (the methodology); 42001 Annex A provides the controls. The risk register is the bridge.\n\n**Run** `ai_risk_register_builder.py` with an identified-risks JSON to produce a structured register with mapped controls + residual-risk verdict per ISO 23894 risk-treatment options.\n\nSee `references\u002Faims_controls_annex_a.md` for the full 38-control catalogue with audit evidence per control.\n\n### 3. Clause 9.2 Internal Audit Plan\n\n**The framework:** Clause 9.2 requires \"internal audits at planned intervals to provide information on whether the AIMS conforms to the organization's requirements and is effectively implemented and maintained.\" That's the management-system requirement; the **how often** and **how deep** are organizational choices.\n\n**Mature-program defaults:**\n\n- Cover every clause + every applicable Annex A control over a 3-year cycle (rolling)\n- Annual full-system audit covering Clauses 4, 5, 9, 10 (the \"always relevant\" clauses)\n- Quarterly or semi-annual deep dives on Clauses 6, 7, 8 by domain (per AI system or per lifecycle phase)\n- Auditor independence: nobody audits their own work; A.6 lifecycle owner cannot audit Clause 8 operation\n\n**Run** `aims_audit_scheduler.py` with a scope JSON (AI systems in scope, prior-year findings, certification cycle phase) to produce a 12-month plan with auditor assignments and independence checks.\n\nSee `references\u002Faims_implementation_guide.md` for the maturity model and rollout sequencing (year 1 establish, year 2 certify, year 3+ continual improvement).\n\n## Workflows\n\n### Workflow 1: AIMS Gap Closure for Certification (4–8 weeks)\n**Goal:** Identify gaps; prioritize remediation; close before stage 1 certification audit.\n\n```bash\n# 1. Inventory current AIMS evidence (policies, procedures, records)\npython scripts\u002Faims_gap_analyzer.py aims_evidence.json\n# 2. Review gap matrix; group by clause\n# 3. For each gap, identify owner + due date (target: close before stage 1)\n# 4. Cross-check against ISO 27001 \u002F 13485 existing artifacts — many can be reused\n# 5. Cross-check against EU AI Act obligations (use compliance-team-eu-ai-act)\n# 6. Output: prioritized remediation plan with owners + dates\n```\n\n### Workflow 2: AI Risk Register Build (1–2 weeks)\n**Goal:** Construct the Clause 6.1.2 risk register with full Annex A control coverage.\n\n```bash\n# 1. Run ISO 23894 risk identification across AI lifecycle (data, model, deployment, decommission)\n# 2. Capture each risk with: source, event, consequence, likelihood, impact\npython scripts\u002Fai_risk_register_builder.py risks.json\n# 3. For each high\u002Fcritical risk, confirm ≥ 1 Annex A control is selected as treatment\n# 4. Document residual risk acceptance with management signoff\n# 5. Cross-check with cs-caio-advisor on executive risk acceptance for \"tolerate\" decisions\n# 6. Log via management review (Clause 9.3)\n```\n\n### Workflow 3: Annual Internal Audit Plan (1 day)\n**Goal:** Produce the 12-month Clause 9.2 plan with auditor independence.\n\n```bash\n# 1. Pull last year's audit findings and certification cycle status (year 1\u002F2\u002F3)\npython scripts\u002Faims_audit_scheduler.py audit_scope.json\n# 2. Confirm auditor independence per assignment\n# 3. Confirm coverage hits every clause and every applicable Annex A control over rolling 3 years\n# 4. Submit plan for management review approval (Clause 9.3 input)\n```\n\n### Workflow 4: Cross-Framework Reuse Mapping (per system onboarded)\n**Goal:** When adding a new AI system, map ISO 42001 evidence against existing 27001 + 13485 evidence to avoid duplication.\n\n1. Pull existing ISO 27001 Annex A controls + ISO 13485 procedures relevant to the system\n2. For each ISO 42001 Annex A control, identify whether an existing artifact already satisfies it (e.g., 27001 A.8.16 monitoring activities can extend to AI system monitoring)\n3. Add the AI-specific overlay only where the existing control doesn't cover it\n4. Document mapping in the AIMS scope statement (Clause 4.3)\n\n## Output Standards\n\n```\n**Bottom Line:** [one sentence — gap severity + the one thing to close first]\n**The Decision:** [one of: gap-closure | risk-treatment | audit-scope]\n**The Evidence:** [clause numbers + control IDs from the tool, not adjectives]\n**How to Act:** [3 concrete next steps with owners + dates]\n**Your Decision:** [the call only the compliance officer or CAIO can make — risk acceptance, scope expansion, certification readiness]\n```\n\n## Adjacent Skills\n\n- `ra-qm-team\u002Fskills\u002Finformation-security-manager-iso27001\u002F` — ISO 27001 ISMS implementation (many controls reusable for AIMS A.7 data controls)\n- `ra-qm-team\u002Fskills\u002Fquality-manager-qms-iso13485\u002F` — ISO 13485 QMS (provides CAPA + management-review machinery the AIMS reuses)\n- `ra-qm-team\u002Fskills\u002Fgdpr-dsgvo-expert\u002F` — GDPR DPIA process (input to AIMS A.5 impact assessment for personal-data systems)\n- `ra-qm-team\u002Fskills\u002Fisms-audit-expert\u002F` — ISO 27001 internal audit pattern (the audit scheduler mirrors this for AIMS)\n- `ra-qm-team\u002Fskills\u002Fsoc2-compliance\u002F` — SOC 2 trust services (reusable controls for AIMS A.10 third-party relationships)\n- `ra-qm-team\u002Fcompliance-team-eu-ai-act\u002F` — EU AI Act Article-level compliance (binding regulation companion to voluntary 42001)\n- `compliance-os\u002F` — Meta-orchestrator for multi-framework programs (run AIMS as one framework among 9)\n- `c-level-advisor\u002Fchief-ai-officer-advisor\u002F` — Executive AI strategy (build-vs-buy, cost economics — different audience)\n\n## References\n\n- [iso42001_clauses.md](references\u002Fiso42001_clauses.md) — Clauses 4–10 walkthrough with audit evidence expectations, common gaps, and reusable artifacts from ISO 27001\u002F13485\n- [aims_controls_annex_a.md](references\u002Faims_controls_annex_a.md) — All 38 Annex A controls (A.2–A.10) with implementation guidance, audit evidence, and severity of failure\n- [aims_implementation_guide.md](references\u002Faims_implementation_guide.md) — 3-year maturity model (establish → certify → continually improve), rollout sequencing, integration with existing ISMS\u002FQMS programs\n- [cross_framework_mapping_ai.md](references\u002Fcross_framework_mapping_ai.md) — ISO 42001 ↔ EU AI Act ↔ NIST AI RMF ↔ ISO 23894 ↔ ISO 38507 ↔ ISO 27001 control-level mapping with mapping-confidence ratings\n\n---\n\n**Version:** 1.0.0\n**Status:** Production Ready\n",{"name":5,"license":14,"metadata":48,"description":7},{"author":49,"domain":50,"updated":51,"version":52,"category":53,"frameworks":54,"python-tools":55},"Alireza Rezvani","ai-management-system-compliance",1778630400000,"1.0.0","ra-qm-team","iso-42001, iso-23894, iso-38507, nist-ai-rmf, eu-ai-act-mapping","aims_gap_analyzer.py, ai_risk_register_builder.py, aims_audit_scheduler.py","main","510dd2917e051cc953dc55f56fd6ef442aa01b38","claude-skills\u002Fra-qm-team\u002Fcompliance-team-iso42001\u002Fskills\u002Fiso42001-specialist","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi","https:\u002F\u002Fgithub.com\u002Fmne20114-hash","2026-10-28 07:50:31",{"source":8,"skillName":5,"commands":63,"prompt":73,"zipAvailable":74},[64,67,70],{"tool":65,"command":66},"npx","npx skills add mne20114-hash\u002Fgest35bi --skill iso42001-specialist",{"tool":68,"command":69},"bunx","bunx skills add mne20114-hash\u002Fgest35bi --skill iso42001-specialist",{"tool":71,"command":72},"pnpm","pnpm dlx skills add mne20114-hash\u002Fgest35bi --skill iso42001-specialist","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fra-qm-team\u002Fcompliance-team-iso42001\u002Fskills\u002Fiso42001-specialist\u002FSKILL.md",true,[76,82,86,90,94,100,104],{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Faims_controls_annex_a.md","REFERENCE","参考文档",10022,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fra-qm-team\u002Fcompliance-team-iso42001\u002Fskills\u002Fiso42001-specialist\u002Freferences\u002Faims_controls_annex_a.md",{"path":83,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Faims_implementation_guide.md",8548,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fra-qm-team\u002Fcompliance-team-iso42001\u002Fskills\u002Fiso42001-specialist\u002Freferences\u002Faims_implementation_guide.md",{"path":87,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fcross_framework_mapping_ai.md",9113,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fra-qm-team\u002Fcompliance-team-iso42001\u002Fskills\u002Fiso42001-specialist\u002Freferences\u002Fcross_framework_mapping_ai.md",{"path":91,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fiso42001_clauses.md",9091,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fra-qm-team\u002Fcompliance-team-iso42001\u002Fskills\u002Fiso42001-specialist\u002Freferences\u002Fiso42001_clauses.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fai_risk_register_builder.py","SCRIPT","脚本",10862,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fra-qm-team\u002Fcompliance-team-iso42001\u002Fskills\u002Fiso42001-specialist\u002Fscripts\u002Fai_risk_register_builder.py",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Faims_audit_scheduler.py",11027,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fra-qm-team\u002Fcompliance-team-iso42001\u002Fskills\u002Fiso42001-specialist\u002Fscripts\u002Faims_audit_scheduler.py",{"path":105,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Faims_gap_analyzer.py",11556,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fra-qm-team\u002Fcompliance-team-iso42001\u002Fskills\u002Fiso42001-specialist\u002Fscripts\u002Faims_gap_analyzer.py",[109,144,166,185,210,229],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":126,"publishedAt":43},"01M6C27N3H0F9RGG2KASPASH04","syllabus","Generates a curated supplementary reading list from any course syllabus using Consensus academic search. Grill-me intake (syllabus input format + course audience + year range) plus a grouping forcing-options checkpoint before any search runs — so the reading list matches the course's level and recency need. Parses the syllabus to extract topics and learning outcomes, searches Consensus for recent peer-reviewed papers per topic, and produces a professionally formatted .docx with clickable Consensus links, plain-language summaries calibrated to audience level, and Bloom-higher-order discussion questions tied to course learning goals. Use when the user uploads a syllabus, course outline, or curriculum document and wants supplementary readings (e.g., 'create a reading list from this syllabus', 'find recent papers for my course') — even casual mentions with a syllabus attached should trigger this skill.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Fsyllabus\u002Fskills\u002Fsyllabus\u002FSKILL.md",[115,120,123],{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",{"categoryNo":121,"categoryName":122,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":124,"categoryName":125,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000034","行政与办公人员",[111,127,128,129,130,131,40,132,133,134,135,136,137,138,139,140,141,142,25,143],"docx","pr","create","intake","search","integrity","checkpoint","learning","js","format","direct","Rules","find","consensus","list","extract","outcomes",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":154,"publishedAt":43},"01M6C27DMGZ4D6ERNHSVA8H8RJ","pulse","Multi-source recency research skill that takes the pulse of any topic across Reddit, Hacker News, the open web, and optionally X\u002FTwitter within a configurable recent window (default 30 days). Forcing intake clarifies topic specificity, angle (trend\u002Fsentiment\u002Fproblems\u002Fopportunities\u002Fcomparison), time window, and platform scope before searching. Returns a synthesized briefing with citations, engagement metrics, and cross-platform pattern analysis. Use when the user requests multi-source recency intelligence on a topic (e.g., 'pulse on [topic]', 'what's happening with [topic]', 'what are people saying about [topic]', 'current conversation about [topic]', 'take the pulse of [topic]', 'trending: [topic]', 'find me info on [topic]'), and for competitor research, trend discovery, tool comparisons, and audience sentiment analysis.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Fpulse\u002Fskills\u002Fpulse\u002FSKILL.md",[150,153],{"categoryNo":151,"categoryName":152,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":121,"categoryName":122,"taxonomyType":118,"taxonomyTypeDesc":119},[146,155,156,128,157,130,40,158,159,132,160,161,162,163,137,138,164,139,165,25],"research","web","sentiment analysis","sentiment","Citations","analysis","discovery","open","tool","twitter","user",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":175,"publishedAt":43},"01M6C279M59X635VPD6Y9R616J","patent","Patent prior-art and landscape intelligence skill — not generic patent help. Commits to one of five sub-use-cases via forcing intake (novelty search \u002F freedom-to-operate \u002F competitive landscape \u002F acquisition diligence \u002F litigation prior-art) before any search runs. Searches Google Patents, Espacenet, USPTO, and optionally Lens.org for citation-graph signals. Output is an editable Word document (.docx) with verdict, ranked closest art (claim-text extracted), CPC-class-aware landscape, family-resolved hits, geographic coverage, FTO flags where applicable, strategy recommendations, and full audit log. Use when the user asks for patent searching or analysis (e.g., 'prior art search for [invention]', 'freedom to operate analysis for [product]'). Produces search signal, not legal advice — always recommends consulting a patent attorney before filing or licensing decisions. Trademark, copyright, and trade-secret questions are out of scope.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Fpatent\u002Fskills\u002Fpatent\u002FSKILL.md",[172,173,174],{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},{"categoryNo":121,"categoryName":122,"taxonomyType":118,"taxonomyTypeDesc":119},{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[168,127,128,176,177,178,130,131,40,160,179,180,181,138,182,28,27,183,25,184],"competitive landscape","routing","product","commits","Word","text","acquisition","coverage","advice",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":195,"publishedAt":43},"01M6C275RZWNRB3CCB14QQM7ES","notebooklm","Browser automation skill for controlling Google's NotebookLM. Use when the user wants anything done in NotebookLM (e.g., 'open NotebookLM', 'check my [name] notebook', 'ask my notebook about X', 'add [source] to NotebookLM', 'generate a Video Overview from my notebook', 'use NotebookLM Studio'). Handles reading and querying notebooks, adding sources (URLs, text, files, YouTube links, synthesized content), generating Studio outputs (Audio\u002FVideo Overviews, Mind Maps, Reports incl. Briefing Doc\u002FStudy Guide\u002FFAQ, Flashcards, Quiz, slide decks, infographics — discover the exact set from the live Studio panel; the UI evolves fast), and creating new notebooks. Requires browser automation environment — fails gracefully when unavailable.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Fnotebooklm\u002Fskills\u002Fnotebooklm\u002FSKILL.md",[191,194],{"categoryNo":192,"categoryName":193,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":121,"categoryName":122,"taxonomyType":118,"taxonomyTypeDesc":119},[187,196,197,155,198,199,200,201,202,203,204,205,162,181,137,206,207,208,209,25],"google","browser automation","automation","generate","browser","fast","SET","doc","Video","Audio","check","ask","environment","overview",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":220,"publishedAt":43},"01M6C2717B0QDJ3Y4PJP77BMW5","litreview","Academic literature orientation skill that searches papers via free keyless APIs (PubMed E-utilities + OpenAlex) by default — with the Consensus MCP as an optional enhancement lane when connected — builds a strategic search plan using PICO (default) or SPIDER \u002F Decomposition \u002F hybrid as fallbacks, and synthesizes findings into a formatted Word (.docx) research guide. Grill-me intake (research question specificity + framework hint + tentative depth) before the recon search; a second forcing checkpoint after Phase 2 confirms framework + sub-areas + depth before searches consume budget. Configurable depth (5\u002F10\u002F20 queries) controls coverage vs. speed. Output is a 'launching pad' — an orientation guide that lets a researcher dive in confidently, not a finished review. Use when the user starts literature-oriented research (e.g., 'litreview on [topic]', 'literature review on [topic]', 'I'm starting a literature review on X', 'I'm writing a paper on X', 'help me research X', 'I'm doing research on X', 'can you help me research X'). Do NOT use for single one-off paper searches wanting a quick list — that's a plain PubMed\u002FOpenAlex (or Consensus) query.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Flitreview\u002Fskills\u002Flitreview\u002FSKILL.md",[216,217,218,219],{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},{"categoryNo":151,"categoryName":152,"taxonomyType":118,"taxonomyTypeDesc":119},{"categoryNo":121,"categoryName":122,"taxonomyType":118,"taxonomyTypeDesc":119},{"categoryNo":124,"categoryName":125,"taxonomyType":20,"taxonomyTypeDesc":21},[212,127,221,222,223,128,130,131,224,225,226,133,31,180,227,138,140,228,183,25],"MCP","writing","review","lane","keyless","literature review","researcher","question",{"skillNo":230,"name":231,"nameZh":6,"description":232,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":233,"categories":234,"keywords":239,"publishedAt":43},"01M6C26X5G3WDVWQ40Y16ZS19F","grants","NIH grant research skill for clinical researchers. Grill-me intake (research idea + career stage + preliminary data + environment + submission posture + known institute targets) locks down the funding strategy before any search runs. Runs a 5-facet Consensus positioning analysis (with draft Significance\u002FInnovation language), maps the research to the right NIH institutes and study sections via RePORTER, finds NOSIs and funded overlap, and produces an editable Word document (.docx) with budget\u002Fscope-aware mechanism recommendations, submission timelines, and a mandatory program officer recommendation. Use when the user asks about research funding or makes any grant-related request (e.g., 'grants for [topic]', 'find grants for my research idea', 'what grants match my research', 'help me find NIH funding', 'grant opportunities for my research'). NIH-only scope — non-NIH funders (PCORI, DOD CDMRP, VA, foundations) are out of scope and flagged at intake.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Fgrants\u002Fskills\u002Fgrants\u002FSKILL.md",[235,236,237,238],{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},{"categoryNo":151,"categoryName":152,"taxonomyType":118,"taxonomyTypeDesc":119},{"categoryNo":121,"categoryName":122,"taxonomyType":118,"taxonomyTypeDesc":119},{"categoryNo":124,"categoryName":125,"taxonomyType":20,"taxonomyTypeDesc":21},[231,127,155,128,240,130,131,40,241,242,132,160,180,138,139,140,27,208,25,243],"help","data","Budget","innovation"]