Controls: rows of a Statement of Applicability, and your own measures

A control, in Veritome, is what ISO/IEC 42001 and ISO/IEC 27001 mean by the word: a row of Annex A, decided in that standard's Statement of Applicability. That is the only place the product uses it. Everything else is an obligation (what the law requires of a system or the organisation), a step (what a programme asks you to do) or a record (what the organisation writes down), with evidence attached to any of them.

Where the Controls page went

The separate Controls register is retired. An old link to it lands on the ISO/IEC 42001 programme's Statement of Applicability tab when that programme is on, on Programmes when it is not, and on Obligations while the standards are switched off — never on a dead page.

Rows you earned, and measures you add

• Approving a step credits the Annex A rows its record implements: the row reads Done and names the step under Implemented by. Rows credited by your EU AI Act work say ↺ credited from your EU AI Act work.
• A measure your organisation runs that no step produced — a data-processing agreement with the model vendor, a logging policy, a retraining gate — is added on the Statement of Applicability tab with Add your own measure: a title, what it is, an owner, and the Annex A rows it implements. It gets its own key, such as CTL-014, and Attach proof on its row uploads the evidence.

What counts

Credit is a report, never a write. A measure credits the rows it names only when it carries verified evidence — linked but unproven, the row reads In progress — and an excluded row needs a justification sentence of its own. Across frameworks, credit shows in three places only: Also counts toward on an obligation or a step, credited on a step or a row, and one figure per programme. There is no separate overlap score to chase.

What never counts

The six statutory-reuse routes the EU AI Act grants (Art. 27(4), 26(9), 8(2), 17(3), 17(4), 26(5)) are recorded on the obligation they concern and never count toward a completion figure or the Statement of Applicability — they are not a claim that two duties are equivalent. Related references shown on a programme step are supporting links, never credit.

Which frameworks count

Binding law (the EU AI Act, GDPR) is always in scope. A standard counts once it is switched on under Organisation → Frameworks; switching one on adds its programme and never touches work you already recorded.