The Statement of Applicability, generated from what you did
Each ISO programme has its own SoA tab: every Annex A row, pre-filled from your approved records and credited EU AI Act work. An exclusion needs a justification sentence.
The Statement of Applicability is the document both ISO management-system standards require under their clause 6.1.3: every Annex A control, whether it applies, how it is implemented, and — for a control you exclude — why. It is the one place in Veritome where the word control is used, because it is the standard's own word here.
One statement per management system
The Statement of Applicability tab sits on the ISO/IEC 42001 programme page (38 Annex A rows) and on the ISO/IEC 27001 programme page (93 rows). Each is its own statement; neither borrows the other's. NIST AI RMF has none — it has a Profile.
A view, not a form
Each row reads its state from the records that address it:
| Row status | Means |
|---|---|
| Done | An approved step implements it (or credited EU AI Act work does — the row says ↺ credited from your EU AI Act work), or one of your own measures carries verified evidence. |
| In progress | Something is linked but its evidence is not yet verified. |
| To do | Nothing addresses it yet. |
| Excluded | You decided it does not apply — shown with your justification, or Justification missing until you write one. |
Beside the status, Applicability says Applicable, Not applicable, Your own measure or Not decided, and Implemented by names the step or measure behind the row. Rows nothing addresses yet are folded beneath the rest — not yet addressed · justify or schedule each — so the statement leads with what you have done.
Deciding the rows
Rows are decided in the programme's SoA step: Decide rows in the SoA step opens it. The step opens pre-filled from the statement — labelled Pre-filled from your programme — on its empty fields only; the first edit is yours. What the tooling cannot write is the justification sentence for anything you exclude. The standard requires that sentence and the auditor will read it, so approval refuses an exclusion that names an Annex A control with fewer than six words of reason, or a key that is not in Annex A at all.
Your own measures
A measure your organisation runs that no step produced — a retraining gate, a data-processing agreement — is added with Add your own measure: a title, what it is, an owner and the Annex A rows it implements. It gets its own key (CTL-014, say) and credits those rows once its evidence is verified; Attach proof on its row uploads that evidence. A measure without verified evidence credits nothing.
Exporting
Download SoA (PDF) on the tab issues the sealed statement, and it is also a row in Documents — one per standard — minted as evidence with its hash. The Clauses tab exports the clause-by-clause matrix as CSV for an auditor who wants the whole map.
Still stuck? Open a support request in your workspace, and a person will answer there and by email.