Glossary
Updated
The SoA is the roadmap for an auditor. It lists all 38 controls (A.2 to A.10), specifies their current implementation status, and provides a risk-based justification for any control deemed unnecessary. For organizations with diverse AI portfolios, it allows for tiered governance, where strict controls are applied to high-risk systems while lighter ones apply to low-risk tools.
Example
A healthcare provider's SoA includes strict human oversight controls for its diagnostic AI but excludes data lineage requirements for a basic internal meeting-transcription bot.