---
title: "DPIA vs Risk Assessment Under GDPR"
description: "Understand when GDPR requires a DPIA instead of a standard risk assessment, even if CNIL criteria aren't met."
canonical: "https://axipro.co/dpia-vs-risk-assessment/"
language: "en-US"
modified: "2026-07-20T07:20:29+00:00"
generator: "WordPress 7.1.1"
---

[Home](https://axipro.co)

/ [GDPR](https://axipro.co/category/gdpr/)

/ DPIA vs Risk Assessment Under GDPR

# DPIA vs Risk Assessment Under GDPR

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

- Pedro Dias
- July 20, 2026

Copy Link

The [CNIL](https://en.wikipedia.org/wiki/Commission_nationale_de_l%27informatique_et_des_libert%C3%A9s)‘s screening rule sounds simple: hit two of the nine high-risk criteria, and you owe a full Data Protection Impact Assessment (DPIA). The trouble starts when you hit one or none, because the GDPR never says that skipping the DPIA means skipping assessment altogether.

Plenty of processing falls outside the CNIL’s screening rules: operations below the two-criteria threshold, activities on the CNIL’s exemption list, processing already covered by an earlier DPIA, and controllers who answer to a different supervisory authority altogether. In every one of those cases, the [Article 35 GDPR DPIA obligation](https://axipro.co/gdpr-compliance/) may fall away while the risk assessment obligations under Articles 24 and 32 stay exactly where they were. This article maps the scenarios where CNIL criteria don’t apply and what a **defensible assessment strategy** looks like when they don’t.

![DPIA vs Risk Assessment Under GDPR](https://axipro.co/wp-content/uploads/2026/07/DPIA-vs-Risk-Assessment-Under-GDPR-1024x535.png)

## **DPIA vs General Risk Assessment: Core Distinctions Under GDPR**

These two assessments get conflated constantly, and the mix-up has real consequences. They rest on different legal bases, serve different purposes, and trigger under different conditions.

[Article 35 GDPR](https://gdpr-info.eu/art-35-gdpr/) requires a DPIA where processing is *“likely to result in a high risk”* to people’s rights and freedoms, and it requires the assessment **before processing begins**. The DPIA looks outward. It evaluates the necessity and proportionality of the processing and the risks it creates for data subjects: discrimination, identity theft, financial loss, reputational damage, loss of control over personal data. The measuring stick throughout is harm to people.

[Article 32 GDPR](https://gdpr-info.eu/art-32-gdpr/) requires controllers and processors to put in place [technical and organizational measures](https://axipro.co/iso-27001-certification/) (TOMs) appropriate to the risk of the processing. You can’t know what’s appropriate without assessing that risk first, so Article 32 carries an implicit risk assessment duty for every processing operation you run, high risk or not. Its focus is security: the confidentiality, integrity, availability, and resilience of the systems handling personal data.

Article 24 completes the picture by making the controller responsible for implementing measures proportionate to risk and able to demonstrate compliance. That’s the **accountability principle** at work.

So risk assessment is universal, and the DPIA is the escalated version you reserve for processing that crosses the high-risk line. The real question is which assessment to run and how deep to go.

You don't need a six-figure budget to be GDPR compliant. You need a clear plan and someone to do the work.

Affordable GDPR Compliance Services

[Book a Free GDPR Consultation](https://meetings.hubspot.com/axipro-team/meet?utm_source=website)

## **The CNIL Criteria: A Quick Recap**

### The Article 35(3) Baseline and the 9 Criteria

Article 35(3) names three situations where a DPIA is **always mandatory**: systematic and extensive automated evaluation of individuals, including profiling, with legal or similarly significant effects; large-scale processing of special categories of data (Article 9) or criminal conviction data (Article 10); and large-scale systematic monitoring of a publicly accessible area.

Beyond those, the [WP29 guidelines on DPIAs (WP248 rev.01)](https://ec.europa.eu/newsroom/article29/items/611236), endorsed by the [European Data Protection Board (EDPB)](https://www.edpb.europa.eu/), list nine criteria that indicate likely high-risk processing: evaluation or scoring, including profiling; automated decision-making with legal or similarly significant effect; systematic monitoring; sensitive data or data of a highly personal nature; processing on a large scale; matching or combining datasets; data concerning vulnerable data subjects (employees, patients, children); innovative use or application of new technological or organizational solutions; and processing that prevents data subjects from exercising a right or using a service or contract.

### The “Two Criteria” Threshold Rule

The CNIL’s position is that processing meeting at least two of the nine criteria requires a DPIA as a general rule. WP248 leaves room on both sides of that line: a controller can conclude that processing meeting two criteria still isn’t high risk, and in some cases a single criterion is enough to trigger the obligation. Either way, the reasoning has to be documented. Where there’s genuine doubt, the CNIL’s advice is simple: do the DPIA.

### CNIL’s List of Processing Operations Requiring a DPIA

The CNIL also maintains a mandatory list under Article 35(4), adopted through Deliberation No. 2018-327 of October 11, 2018. It names 14 types of processing that require a DPIA outright, including systematic employee monitoring, whistleblowing schemes, profiling that can exclude people from a contract, and large-scale processing of health data. If your processing appears on this list, you can skip the criteria math because the DPIA is **mandatory regardless.**

**Insider Note:** The CNIL’s sectoral *“referentials”* do more work than most DPOs realize. If your processing fully complies with an applicable referential, the CNIL accepts the position that residual risk isn’t high, which takes Article 36 prior consultation off the table. Checking for a referential before scoping a DPIA can remove the most painful step of the entire process.

## **When CNIL Criteria Don’t Apply: Key Scenarios**

### Processing Falling Below the Two-Criteria Threshold

Most B2B processing lives here. A standard CRM, a newsletter list, routine supplier management: these might touch one criterion (large scale, perhaps) without hitting a second. No DPIA is required, but the screening itself is a compliance artifact. Record which criteria you tested, what you concluded, and why. If the CNIL inspects, the absence of a DPIA is defensible only when the [screening decision](https://axipro.co/services/gap-analysis/) is on paper.

### Operations on CNIL’s Exemption List

Article 35(5) lets supervisory authorities publish “whitelists” of processing that doesn’t require a DPIA. The CNIL adopted one in 2019 after an EDPB opinion, covering categories such as routine HR management in organizations with fewer than 250 employees (without profiling, biometrics, or sensitive data), badge-based physical access control without biometrics, and time management systems that don’t process biometric data. France is one of only a few member states with a formal whitelist, which matters for cross-border groups: the same HR system can be exempt in France and assessable case by case in Luxembourg.

### Processing Authorized by Specific Legal Provisions

Article 35(10) carves out processing based on a legal obligation or public interest task under Article 6(1)(c) or (e), where the legal basis regulates the specific operation and a general impact assessment was already carried out when that law was adopted. It’s a **narrow exemption**. It doesn’t cover processing that merely relates to a legal obligation; the law itself has to govern the operation in question.

### Pre-Existing DPIAs Covering Similar Processing

Article 35(1) allows a single assessment to cover a set of similar processing operations presenting similar high risks. The CNIL confirms that where the nature, scope, context, and purposes of a new operation closely match processing already assessed, whether by you or by a third party such as a public authority or a group of controllers, the earlier DPIA’s results can be reused. **Document the similarity analysis** rather than just asserting it.

### Processing Governed by Other Supervisory Authorities

CNIL lists bind processing under the CNIL’s jurisdiction. A controller whose main establishment sits in Ireland or Germany deals with its own lead supervisory authority under the one-stop-shop mechanism, and each authority publishes its own Article 35(4) list. The nine WP248 criteria still apply everywhere, since the EDPB treats them as the consistency backbone behind every national list, but the national additions and exemptions differ. The [ICO’s DPIA guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/), for instance, adds UK-specific triggers such as innovative technology combined with any WP248 criterion.

## **What to Do When a DPIA Isn’t Triggered: The Risk Assessment Path**

Even without a DPIA, three obligations remain.

- **First, conduct the Article 32 risk assessment.** Map the data flows, identify realistic threats (unauthorized access, loss, alteration, unavailability), rate likelihood and severity, and select TOMs proportionate to what you find: [encryption, pseudonymization, access controls](https://axipro.co/secure-data-disposal-iso-27001-soc-2-gdpr/), backup and recovery, and regular testing of those measures. Established methodologies work fine here; [ISO/IEC 29134](https://www.iso.org/standard/62289.html) provides privacy impact assessment guidance, and the [NIST Privacy Framework](https://www.nist.gov/privacy-framework) offers a structure many teams pair with their existing security program.
- **Second, document why no DPIA was performed**. Organizations skip this step more than any other, and it tends to be the first thing an inspector asks for. A one-page screening record referencing the criteria, the exemption relied on, and the date of the decision is usually enough.
- **Third, keep the accountability machinery running.** The processing goes in your Records of Processing Activities (ROPA), privacy by design and by default under Article 25 still applies, and data subject rights are untouched by any DPIA exemption.

### Pro Tip: Build DPIA Screening into your ROPA Workflow

Build DPIA screening into your ROPA workflow instead of treating it as a separate exercise. Add three fields to each ROPA entry: criteria met, DPIA yes/no, and rationale. You get a permanent, dated audit trail with almost no extra effort, and periodic reassessment becomes a filter query instead of a project.

## **Comparing the Two Approaches Side-by-Side**

Methodology differs too. DPIAs typically follow the CNIL’s PIA methodology or ISO/IEC 29134 and demand structured stakeholder involvement: the DPO’s advice must be sought, processors have to assist under Article 28, and data subjects’ views should be gathered where appropriate. Article 32 assessments plug into whatever risk framework your security team already uses ([ISO 27005](https://www.iso.org/standard/80585.html), NIST, EBIOS) and can stay internal.

## **Practical Decision Framework: DPIA or Risk Assessment?**

**Step 1: Screen against the lists first.** Check Article 35(3), then the applicable supervisory authority’s mandatory list. A hit at this stage ends the analysis; the DPIA is required.

**Step 2: Check the exemption routes.** The whitelist, the Article 35(10) legal-provision exemption, and reusable prior DPIAs. If one applies, record which one and why.

**Step 3: Count the criteria.** Score the processing against the nine WP248 criteria. Two or more points to a DPIA. Meeting just one deserves a documented judgment call, keeping WP248’s caveat in mind that a single criterion can be enough for genuinely risky processing.

**Step 4: Choose the assessment and calendar the review.** DPIA if triggered, Article 32 assessment if not. In both cases, set a [reassessment trigger](https://axipro.co/iso-27001-internal-audit/): material change to the processing, new data categories, new technology, or three years, whichever comes first.

![DPIA vs Risk Assessment](https://axipro.co/wp-content/uploads/2026/07/DPIA-vs-Risk-Assessment-683x1024.jpg)

## **Common Pitfalls When CNIL Criteria Don’t Apply**

### Assuming No Assessment Is Needed at All

The most common failure. Articles 24 and 32 apply to a two-person newsletter list the same way they apply to a biometric access system, differing only in depth. Concluding that you don’t need a DPIA settles the scoping question and nothing else.

### Confusing DPIA Exemption with Compliance Exemption

The CNIL states this explicitly in its whitelist materials, and the EDPB repeats it in every whitelist opinion: exempt processing must still satisfy the Article 5 principles, lawful basis requirements, and data subject rights. If you’re weighing the broader difference between a formal standard and a legal obligation, our breakdown of [DPIA exemption versus compliance exemption](https://axipro.co/iso-27001-gdpr-certification-vs-compliance/) is worth a read.

**Important:** An Article 35(5) whitelist entry exempts you from one document. It doesn’t touch lawfulness, minimization, transparency, security, or breach notification. Treating the whitelist as a *safe harbor* is how routine HR processing ends up in an enforcement decision.

### Overlooking Sector-Specific Guidance

EDPB guidelines, CNIL referentials, and codes of conduct under Article 40 can all shift the analysis. Article 35(8) requires compliance with an approved code of conduct to be taken into account when assessing impact. Ignoring the sectoral layer produces screening decisions that look fine on paper but fall apart once the sector context comes in.

You don't need a six-figure budget to be GDPR compliant. You need a clear plan and someone to do the work.

Affordable GDPR Compliance Services

[Book a Free GDPR Consultation](https://meetings.hubspot.com/axipro-team/meet?utm_source=website)

## **Cross-Jurisdictional Considerations**

[Controllers established outside France](https://axipro.co/pdpl-bahrain-uae-saudi-arabia/) aren’t bound by CNIL lists for processing under another authority’s jurisdiction. What travels is WP248: the EDPB required every national list to state that it complements and further specifies those guidelines, so the nine criteria function as the **common denominator** across the EU.

EDPB Guidelines 4/2019 on data protection by design and by default add the other half of the frame. Whatever assessment you run, Article 25 requires safeguards to be designed in from the start, not bolted on after the risk analysis.

For multi-jurisdictional processing, two practical rules hold. Identify your lead supervisory authority under the one-stop-shop mechanism, and where a single processing operation spans several member states’ lists, **apply the most demanding trigger** among them. A DPIA that meets the strictest list will hold up everywhere else, and that logic doesn’t work in reverse.

### Worth Knowing: EDPB published a Draft EU-wide DPIA

In April 2026, the EDPB published a draft EU-wide DPIA template and opened a public consultation running to June 2026. It doesn't change when a DPIA is required, but it signals convergence on how DPIAs get documented, and national authorities may adopt it as a standard. It's worth tracking if you maintain DPIA templates across several jurisdictions.

## **Conclusion: Building a Defensible Assessment Strategy**

The CNIL criteria answer one question: does this processing need a DPIA? When they don’t apply, the question changes shape instead of going away. Article 32 still demands a security risk assessment, Article 24 still demands proof of proportionate measures, and the screening decision itself becomes the document that protects you. A defensible strategy is **boring by design**: screen every new processing operation, record the outcome either way, run the assessment the outcome calls for, and revisit on change or every three years. Controllers get in trouble far more often for having **no paper trail** than for choosing the lighter assessment.

## **Frequently Asked Questions**

Is a risk assessment mandatory even if no DPIA is required?

Yes. Article 32 obliges every controller and processor to assess risk and implement appropriate technical and organizational measures for all processing of personal data. A DPIA exemption takes one document off your list. The underlying duty stays.

Can I use CNIL's PIA software for a standard risk assessment?

You can. The [CNIL’s free PIA tool](https://www.cnil.fr/en/open-source-pia-software-helps-carry-out-data-protection-impact-assesment) is built around the DPIA methodology, so it’s heavier than an Article 32 assessment needs, but its risk mapping module works well for structuring a security-focused analysis. Many teams use it for both and skip the necessity and proportionality sections for non-DPIA processing.

What happens if I incorrectly conclude that CNIL criteria don't apply?

Failing to carry out a required DPIA is sanctionable on its own, with fines of up to 10 million euros or 2% of global annual turnover under Article 83(4). Supervisory authorities have also treated missing DPIAs as aggravating factors in broader enforcement. A documented, good-faith screening decision materially improves your position even when a regulator disagrees with the conclusion.

How long does an ISO 14001 audit take?

Duration depends on the size of the organization, the complexity of its processes, the number of sites, and the industry risk profile — with audit time calculated under [ISO/IEC 17021-1](https://www.iso.org/standard/43088.html) guidance. A small organization might face a Stage 2 audit of one to two days and shorter surveillance visits, while a large multi-site operation requires considerably more.

What is the difference between an internal and external ISO 14001 audit?

An [internal audit](https://axipro.co/services/internal-audit/) is conducted by or for the organization itself to check and improve its own EMS. An external audit is conducted by an outside party — either a certification body awarding or maintaining the certificate, or a second party such as a customer assessing a supplier.

Can I use a free ISO 14001 audit checklist template?

Yes, a free template is a reasonable starting point, but treat it as a skeleton. Any generic template must be adapted to your significant environmental aspects, your [compliance obligations](https://axipro.co/services/compliance-as-a-service/), and your operations — and as of 2026 it must be updated for the new and revised clauses. An unedited template will leave gaps that produce findings.

What happens if nonconformities are found during the audit?

You analyze the cause, define corrections and corrective actions, and implement them. [Certification bodies](https://axipro.co/services/certification/) typically require this within a set window after the audit and then verify it. **Major nonconformities must be closed before a certificate is granted or maintained.** Minor nonconformities are usually verified at the next surveillance visit.

Axipro Author

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

### Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

- July 20, 2026
- [GDPR](https://axipro.co/category/gdpr/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [All Blog](https://axipro.co/category/blog/), [Customer Stories](https://axipro.co/category/stories/), [Denmark](https://axipro.co/category/denmark/), [ISO-27001](https://axipro.co/category/iso-27001/)

- September 19, 2026

#### [How Haime got through its first ISO 27001 internal and external audits in under four weeks with Axipro](https://axipro.co/haime-iso-27001-internal-external-audit/)

Haime, a Danish AI governance software company, completed independent ISO 27001 internal and external audits with Axipro in under four weeks in 2026.

[Read more](https://axipro.co/haime-iso-27001-internal-external-audit/)

- [ISO-9001](https://axipro.co/category/iso-9001/)

- September 18, 2026

#### [ISO 9001:2026 Changes: What’s New and How to Transition](https://axipro.co/iso-9001-2026-changes/)

ISO published ISO 9001:2026 on September 16, 2026, and the 2015 edition is now formally withdrawn. If you hold a certificate, the good news is that the structure and the process approach are the same, and the list of new requirements is short. Top management now has to promote a quality culture and ethical behavior. Risks and opportunities get handled separately, change management carries more weight, and the 2024 climate change amendment sits inside the core text. That’s most of it. Below, we go through each change clause by clause, cover what stayed where it was, set out the transition timeline, and list the work a certified company has to do before the deadline. Key Takeaways ISO 9001:2026 is the sixth edition of the standard and replaces ISO 9001:2015. Most of the new text is guidance, and only a small part of it adds requirements. The changes that carry audit weight are in Clause 5.1 (quality culture and ethical behavior), Clause 6.1 (risks and opportunities addressed separately), and Clause 6.3 (planning of changes). ISO 9001:2015 certificates stay valid during the transition period, which is expected to run for three years, until around September 2029. Your certification body confirms the exact date. Certification bodies need their own accreditation to the new edition before they can issue 2026 certificates, so nobody has to panic this quarter. A healthy 2015 system needs a gap analysis, some document updates, and better leadership evidence. You won’t have to rebuild it. ISO 9001:2026 Is Now Published: Where the Revision Stands On September 16, 2026, ISO announced the publication of ISO 9001:2026. ISO describes the edition as a set of targeted updates that make the standard clearer and easier to use, built on the framework more than one million organizations already work with. The official ISO 9001:2026 standard page is live. ISO’s page for ISO 9001:2015 now marks that edition as withdrawn and tells certified organizations to speak to their certification body about transition arrangements. It took longer to get here than planned. ISO’s quality committee first voted to leave the 2015 edition alone, then changed its mind in August 2023 after wider consultation. The Draft International Standard followed in August 2025, the final draft went to ballot in spring 2026, and publication hit the September target. Two companion documents came out earlier in the year. ISO 9000:2026, the fundamentals and vocabulary standard, was published in May 2026, and ISO 19011:2026, the auditing guideline, was updated around the same time. If your internal audit procedure cites either one by year, add it to the update list. Why ISO 9001:2015 Was Revised Eleven years is a long time for a management standard. Since 2015, supply chains have become more fragile, remote, and hybrid work has changed how processes run, and customers ask harder questions about ethics and data integrity than they used to. ISO reviews its standards on a regular cycle, and in 2023 the consensus was that a revision would be worth the effort. According to ISO/TC 176/SC 2, the subcommittee responsible for ISO 9001, 81 experts from 46 countries and liaison bodies took part. The result is still conservative, and that was a choice. A standard with a million-plus users can’t afford a rewrite every decade, so the committee went for clarification. ISO 9001:2026 vs ISO 9001:2015: Summary of Changes Area ISO 9001:2015 ISO 9001:2026 Structure Annex SL high-level structure, Clauses 4 to 10 Same clause layout, updated to the latest Harmonized Structure Clause 3, terms Points entirely to ISO 9000 Includes a limited set of core terms; ISO 9000:2026 remains the normative reference Climate change Added by Amendment 1 in 2024 Built into Clauses 4.1 and 4.2 Leadership (5.1) Commitment to the QMS and customer focus Adds promotion of quality culture and ethical behavior Risks and opportunities (6.1) Addressed together Addressed separately, with distinct actions for each Planning of changes (6.3) Brief requirement Reinforced to protect intended results Annex A Short clarification of structure and terms Expanded guidance on the intent of requirements, informative only Annex B Listed other ISO/TC 176 standards Removed; references moved to Annex A and the committee website Key Changes in ISO 9001:2026, Clause by Clause Clause 3: Core Terms Now Sit Inside the Standard The 2015 edition sent readers to ISO 9000 for every definition. The 2026 edition brings a limited number of core management system terms into Clause 3 itself, and ISO 9000:2026 remains the normative reference for the full vocabulary. There’s nothing to set up here. Just check that your quality manual and procedures don’t cite definitions by their old source or year. Clause 4: The Climate Change Amendment Is Now Core Text In February 2024, ISO amended every major management system standard. Organizations had to determine whether climate change is a relevant issue (4.1) and whether interested parties have related requirements (4.2). That amendment took effect immediately, with no transition period, and ISO 9001:2026 folds the same text into the body of the standard. If you handled the amendment properly in 2024, you have nothing new to do. If you wrote “not applicable” on a sticky note, go back to it, because auditors will now read this as a standing requirement. Not relevant is a perfectly acceptable conclusion for many businesses, as long as there’s a reason written down behind it. Clause 5.1: Quality Culture and Ethical Behavior Become Leadership Duties This is the change everyone is talking about, and it’s the hardest one to evidence. Top management now has to show leadership by promoting a quality culture and ethical behavior. The same themes turn up in the requirements for awareness (7.3) and the environment for the operation of processes (7.1.4). You don’t need a culture program for this, and you don’t strictly need a new code of conduct, although one helps. What the auditor wants is for top management to show what they do day to day. Management review minutes where quality problems get discussed without blame are good evidence. So is a working route

[Read more](https://axipro.co/iso-9001-2026-changes/)

- [ISO 42001](https://axipro.co/category/iso-42001/), [SOC-2](https://axipro.co/category/soc-2-2/)

- September 17, 2026

#### [AI Agent Audit Log Requirements: ISO 42001 & SOC 2](https://axipro.co/ai-agent-audit-log-requirements-iso-42001-soc-2/)

An AI agent reads a customer record, decides a refund is warranted, and calls the payments API. The trail it leaves looks nothing like a human doing the same job. The log says a user logged in, a service account made three API calls, and the transaction cleared. It doesn’t say why the agent decided on a refund, what it read first, which model version did the reasoning, or who gave the agent permission to act in the first place. That missing “why” is the whole audit problem. This article covers what ISO/IEC 42001:2023 and the SOC 2 Trust Services Criteria expect from AI agent audit logs, where the two overlap, the fields a log needs to satisfy both, how long to keep records, what you shouldn’t record, and how to package it all for an auditor. It’s written for the CTO, platform lead, or founder who owns compliance for a product that now ships with autonomous agents and needs a certification and a Type II report without running two separate logging programs. The Compliance Gap: Traditional Application Logs vs. AI Agent Audit Logs Why Standard Logs Fall Short for Autonomous Agents Application logs were built for deterministic software. Same input, same state, same output, so recording the input, the state change, and the result is enough to reconstruct what happened. A SOC 2 auditor sampling access logs can trace a database write back to a login, a role, and a change ticket without much effort. Agents break that chain in a few places. They usually run under a shared service account or a borrowed OAuth token, so the log pins the action to a machine identity with no link to the human who set the task. The action itself was picked at runtime by a model rather than fixed in code, so there’s no source line to point at. The same prompt can produce a different tool call tomorrow, so a single sampled log entry proves almost nothing about how the system behaves in general. The Shift from Deterministic State Logging to Intent and Reasoning Capture Traditional logs answer “what changed.” Agent audit logs also have to answer “what was the agent trying to do, what did it consider, and what held it back.” That means capturing the task as delegated, the context the model was handed, the reasoning or planning steps it produced, the tools it picked and the arguments it passed, and every point where a guardrail stepped in. The unit of audit moves from the event to the decision, and each decision needs enough surrounding context that a reviewer can judge whether it was reasonable. Unique Audit Challenges of Non-Deterministic AI Behavior Non-determinism is the part auditors struggle with most. In a normal control test, the auditor re-performs the control and expects the same result. Re-run the same input through an agent and you may get a different path. The practical answer is to stop trying to prove that any single output was correct and instead prove that every output was recorded, attributed, bounded by policy, and reviewable. Logs show that the management system works. They don’t show the model is infallible, and nobody expects them to. ISO 42001 accepts this framing outright. SOC 2 auditors are still catching up, and you’ll spend some time educating them. Insider Note: Auditors don’t expect you to explain the model’s weights. They expect you to show that when the agent did something unexpected, you could find it, see what it read, see what it did, and see who was accountable. Frame every logging decision around that reconstruction test. What ISO 42001 Requires for AI Agent Audit Logs ISO/IEC 42001:2023 is the certifiable standard for an AI Management System (AIMS). It follows the same Plan-Do-Check-Act structure as ISO 27001 and comes with 38 Annex A controls. The phrase “audit log” barely appears in it, but logging obligations run through the main clauses and at least three Annex A areas. Our ISO 42001 certification services map these to your existing controls where possible. Clause 8: Operational Logging and Documentation Requirements Clause 8 asks you to plan, run, and control the processes needed to meet your AI requirements, and to keep documented information showing those processes ran as planned. For an agent in production, the process is the runtime behavior, so documented evidence means logs of the agent operating, not a procedure document on its own. Clause 8.4 adds an AI system impact assessment whose results you have to retain. When an agent’s scope or toolset changes, the record of that change and the updated assessment are both Clause 8 evidence. Clause 9: Performance Evaluation and Evidence of Monitoring Clause 9.1 asks you to decide what to monitor and measure, how, and when, and to keep evidence of the results. An auditor will want the monitoring you defined for each agent (error rates, guardrail block rates, tool-call anomalies, how often humans override) and the records showing you reviewed it. Clause 9.2 internal audit and 9.3 management review both feed off those records. Without operational logs, there’s nothing to measure, and Clause 9 falls over. Annex A.6: AI System Lifecycle Logging Obligations Annex A.6 is where logging gets explicit. A.6.2.8, AI system recording of event logs, requires you to decide at which phases of the AI system lifecycle event logging is switched on, and the Annex B guidance ties this to traceability and anomaly detection. A.6.2.6, AI system operation and monitoring, requires ongoing monitoring in operation, including AI-specific threats like data poisoning and model theft. Read together, they mean logging can’t start at go-live. Design decisions, validation runs, deployment configs, and production behavior all need a record. Annex A.9: Logging Requirements for AI System Operation Annex A.9 covers responsible use: processes for responsible use (A.9.2), objectives for it (A.9.3), and intended use (A.9.4). The logging consequence is that you need to show the agent stayed inside its intended use. That takes logs of the tasks it was given, the actions it took,

[Read more](https://axipro.co/ai-agent-audit-log-requirements-iso-42001-soc-2/)

WhatsApp us