ISO/IEC 42001

An AI management system governs how models are chosen, used and reviewed, not only how data is protected. Accountability, transparency and oversight are the subjects an auditor will test. This starter provides runtime material for a few of those subjects, and it grants no certificate.

The subject here is the behavior of a model and the accountability around it. A governance owner has to show that a decision had a named author and a recorded reason. Two stages of this chain produce exactly that.

The request path is deliberately light. Injection screening runs, identity is verified, and national identifier and biometric references are masked. No broad content block list ships here, because the emphasis sits on what comes back.

Answers must carry sources at a confidence floor of 0.85. That measurement supports a transparency claim, and it flags an ungrounded answer rather than hiding it. A flagged answer still returns until you choose to block, so decide that early.

Combined quality must reach 0.85, with relevance and accuracy at 0.80 and equal weight between them. Length counts too, because the gate expects at least 120 characters and two sentences.

Accountability becomes visible at the review stage, which forwards every response to a person and returns no text. That is a strong control and a heavy one, so size the reviewer group before you enable it. Impact assessment, data quality management and supplier controls remain your documented processes. An audit produces a certificate, and this starter does not.