PezPC holds no ISO/IEC 42001 certificate and has never been assessed against it. Read literally, the standard is aimed at organisations that build or provide AI systems, and PezNet is not one: it ships no AI feature. Read completely, it also covers organisations that use AI systems, and PezPC does, to help write the software this page describes.
This walks all 38 Annex A controls and states where we actually stand on each, including the ones that plainly do not apply yet, rather than omitting them. Two different questions are being answered at once, because the standard asks both: what governs our own use of AI coding assistants in building PezNet, which is the real and current gap, and what would be required if PezNet ever shipped an AI feature of its own, which is not applicable today and is said so rather than glossed over.
This expands one row of the standards table in the
main privacy policy. The standard itself is published by its
own authority:
ISO catalogue.
All 38 Annex A controls, graded by us and not certified
No certificate and no external assessment. The pattern here differs from the other standards on this list: it isn't security maturity that's missing, it's that the standard's two questions, how do we use AI and how would we build one, have almost entirely different answers. As an AI customer, governance is close to absent: no AI policy, no defined responsible-use process, no supplier check on the assistant vendor. As an AI provider, the question doesn't arise yet, because PezNet embeds no AI system, so every control that assumes one exists is marked not applicable rather than forced into a grade it cannot earn.
1 partial10 not in place27 not applicable
Policies related to AI (A.2)
A.2.2
AI policy
Not in place
No policy exists governing our development or use of AI systems. AI coding assistants are used routinely to help write PezNet, with no written statement of what that use is for, what it may be shown, or what it may not.
A.2.3
Alignment with other organizational policies
Not in place
Follows A.2.2: there is no AI policy to align, and no broader internal policy set either, the same gap recorded against ISO 27001 A.5.1.
ISO 27001, A.5.1
A.2.4
Review of the AI policy
Not in place
With no policy in place, there is nothing on a review cycle.
Internal organization (A.3)
A.3.2
AI roles and responsibilities
Not in place
No one is named as responsible for AI governance, the same shape as the missing role assignment recorded against ISO 27001 A.5.2.
ISO 27001, A.5.2
A.3.3
Reporting of concerns
Not in place
No defined channel exists for raising a concern about AI use specifically, such as an assistant suggesting something insecure or mislicensed. Our general issue tracker exists for everything else; nothing points there for this.
Resources for AI systems (A.4)
A.4.2
Resource documentation
Not applicable
This control asks for the resources behind an operated AI system to be identified and documented. PezNet has no AI system, so there is nothing to document. If that changes, this is the control to implement first: A.4.3 through A.4.6 all depend on the same resource inventory it asks for.
A.4.3
Data resources
Not applicable
No AI system is trained or operated on our data, so there are no data resources in scope of this control.
A.4.4
Tooling resources
Not applicable
This control is about the tooling behind an operated AI system, training frameworks, MLOps pipelines and similar, not the coding assistant used to help write PezNet, which is a development tool rather than a system we operate.
A.4.5
System and computing resources
Not applicable
No AI system runs on infrastructure we operate.
A.4.6
Human resources
Not applicable
This asks for the competences of people across an AI system's life cycle: development, deployment, operation, maintenance. No such system exists, so there is no life cycle to staff.
Assessing impacts of AI systems (A.5)
A.5.2
AI system impact assessment process
Not applicable
This control assesses the consequences an AI system we provide could have on individuals or societies. PezNet has no such system, so there is no impact to assess. This is the control we would implement first if that ever changed, before shipping rather than after.
A.5.3
Documentation of AI system impact assessments
Not applicable
No assessment process exists (A.5.2), so there is nothing to document.
A.5.4
Assessing AI system impact on individuals or groups of individuals
Not applicable
No AI system exists that could have such an impact.
A.5.5
Assessing societal impacts of AI systems
Not applicable
Same reasoning as A.5.4: nothing exists to assess.
AI system life cycle (A.6)
A.6.1.2
Objectives for responsible development of AI system
Not applicable
We do not develop AI systems as a product, only conventional software, so there is no AI development life cycle for this control to attach objectives to.
A.6.1.3
Processes for responsible AI system design and development
Not applicable
Same reasoning as A.6.1.2. No AI system design or development is under way.
A.6.2.2
AI system requirements and specification
Not applicable
No AI system is being specified.
A.6.2.3
Documentation of AI system design and development
Not applicable
Nothing to document.
A.6.2.4
AI system verification and validation
Not applicable
No AI system exists to verify or validate.
A.6.2.5
AI system deployment
Not applicable
Nothing is deployed.
A.6.2.6
AI system operation and monitoring
Not applicable
Nothing is operating.
A.6.2.7
AI system technical documentation
Not applicable
No system exists to document.
A.6.2.8
AI system recording of event logs
Not applicable
No AI system is logging anything, because none exists. If one is ever built, it belongs in PezNet's existing append-only audit trail rather than a separate logging path.
Data for AI systems (A.7)
A.7.2
Data for development and enhancement of AI system
Not applicable
No AI system is being developed, so there is no data pipeline feeding one.
A.7.3
Acquisition of data
Not applicable
Nothing is being acquired for this purpose.
A.7.4
Quality of data for AI systems
Not applicable
No data quality requirements exist because no AI system consumes any data.
A.7.5
Data provenance
Not applicable
Nothing to trace, since no AI system uses data.
A.7.6
Data preparation
Not applicable
No preparation pipeline exists.
Information for interested parties of AI systems (A.8)
A.8.2
System documentation and information for users
Not applicable
PezNet has no AI system, so there is no such system for users to be given information about.
A.8.3
External reporting
Not applicable
There is no AI system for anyone to report an adverse impact from. Our general feedback mechanism already exists for everything else.
A.8.4
Communication of incidents
Not applicable
No AI system means no AI incidents to communicate.
A.8.5
Information for interested parties
Not applicable
Nothing to disclose, because there is no AI system. If that changes, its disclosure belongs on this page alongside every other data flow we already declare.
Use of AI systems (A.9)
A.9.2
Processes for responsible use of AI systems
Not in place
AI coding assistants are used to help build PezNet with no defined process governing that use: what may be shown to them, what output needs review, or how a mistake gets caught. This is the control that most closely matches our real AI exposure today.
A.9.3
Objectives for responsible use of AI system
Not in place
No objectives are written for why or how AI assistance should be used.
A.9.4
Intended use of the AI system
Partial
In practice, AI-assisted output is not merged unreviewed, a real if informal safeguard. Nothing states it as policy, and nothing defines what counts as intended use versus misuse of an assistant.
Third-party and customer relationships (A.10)
A.10.2
Allocating responsibilities
Not in place
There is no statement of where our responsibility ends and an AI tool vendor's begins when AI-assisted code turns out to be wrong. The developer who merged it is responsible in practice, but that is assumed rather than written down.
A.10.3
Suppliers
Not in place
No process checks that an AI tool vendor's own practices align with our approach to responsible AI use, the same shape as the supplier gaps already recorded against ISO 27001 A.5.19 and A.5.20.
ISO 27001, supplier relationships
A.10.4
Customers
Not in place
We have never stated, on this page or elsewhere, that AI coding assistants are used to help build PezNet. Nothing hides it, but nothing says it either, and this page is exactly where that disclosure belongs.