Vendor ISO-42001 Procurement Evidence Scrutiny Kit

It grades the ISO/IEC 42001 conformity evidence a vendor hands you during procurement — on six controls: whether an accredited certificate is on file, whether its scope covers the AI system you are buying, whether the certification body is itself accredited, whether the certificate is current with surveillance up to date, whether there is independent audit evidence beyond a badge, and whether the AI supply chain is covered. You mark each 0, 1, or 2 from what the vendor produced, and it returns ACCEPTED, VERIFY FIRST, or REJECTED per vendor, rolling your shortlist up to EVIDENCE DEFENSIBLE, GET PROOF FIRST, or DO NOT RELY.

Procurement evidence is a chain of proof, and a chain is only as strong as its weakest link. A vendor can have a beautiful audit report and named sub-processors, but if you cannot confirm the certificate covers your system, the strong controls do not buy that back. So the headline verdict is the single weakest control, never a flattering average. The mean is shown for context only.

Two of the six controls are gate controls: whether the certificate's accreditation is confirmed, and whether its scope coverage is confirmed. If BOTH are below full at the same time, the vendor is REJECTED no matter how strong the other four controls are — because you can confirm neither that the certificate is real nor that it covers your system, and evidence you cannot confirm on either axis is not evidence. Confirm either axis in writing and the gate releases. In the worked example, Beacon Analytics carries four full controls and a 1.67 mean and is still REJECTED for exactly this; Cirrus AI is the same vendor after confirming scope, and it rises to VERIFY FIRST.

Not on its own. ISO does not certify organizations — independent certification bodies do, and those bodies are themselves accredited by national accreditation bodies such as UKAS, ANAB, or RvA under ISO/IEC 42006. “Certified” can mean an accredited certificate that covers your exact AI system, or a self-made “aligned” slide, a certificate for an unrelated product, or a badge from a body no one accredits. This kit is built to tell those apart and to make you confirm accreditation on the issuer's public register rather than taking the claim at face value.

No. It is a vendor-risk-management aid that grades the evidence artifact you assemble from a vendor's answers — it runs no audit, issues no certification, performs no conformity assessment, and is not legal advice. It connects to nothing and contacts no one. It scores the evidence, never people. Confirm accreditation on the national accreditation body's register, and have counsel or your assurance team review anything you intend to rely on.

One .xlsx with three tabs — Start Here, Dashboard, and Evidence Scrutiny — that opens in Excel, Google Sheets, or Numbers. No install, no login, nothing to connect. It ships pre-filled with a six-vendor worked example you overwrite with your own shortlist; every verdict, the control to fix first, and the portfolio roll-up recompute live from your marks. One-time purchase, yours to keep.