References on Rygen Technologies AI Management System Handbook

Statement of Applicability

Mon, 01 Jan 0001 00:00:00 +0000

1. Purpose

This Statement of Applicability (SOA) defines which ISO 42001:2023 Annex A controls are applicable to Rygen’s AI Management System (AIMS). It provides:

A complete listing of all Annex A controls
The applicability determination for each control (Included/Excluded)
Implementation status for included controls
Justification for any excluded controls
Evidence references demonstrating control implementation

This document fulfils the requirements of ISO 42001:2023 clause 6.1.3f and serves as the formal controlled record for audit purposes.

Approved Tools

Wed, 27 Aug 2025 00:00:00 +0000

Purpose

This procedure is intended to provide guidance on the process for requesting approval to use AI tools within Rygen.

Scope

This procedure applies to all the employees at Rygen who use or have access to Rygen’s information assets.

This procedure applies to:

Standalone AI tools and platforms
MCP (Model Context Protocol) connectors used within approved AI tools (e.g., Claude Desktop, ChatGPT)
AI tool extensions and plugins that process company data

This procedure does not apply to standard integrations used by approved AI tools (e.g., GitHub, Google Drive, Slack integrations within AI platforms) that are pre-configured by the vendor. These integrations fall under Rygen’s general Security Policy and Acceptable Use Policy.

Approved AI Tools List

Fri, 21 Feb 2025 00:00:00 +0000

Purpose

This document lists the AI tools that are approved for use within Rygen, along with constraints for using them safely with company data.

Scope

These tools can be used safely by any member of the Rygen team, provided they follow the safe usage constraints specified for each tool.

Approved Tools

The following AI tools have been approved for use within their safe usage constraints.

Tool	Approved By	Approved Date	Safe Usage Constraints
ChatGPT (Plus, Pro, or Teams)	Chris Broom	2025-02-21	• Only Plus, Pro, or Teams versions can be used • Free version can be used when following usage policies • Improving the model must be turned off in Data Controls • Do not submit any conversations for review
Claude (Pro, Max, Teams)	Chris Broom	2025-02-21	• Only Pro or Teams versions can be used • Do not submit any conversations for review
Github Copilot	Chris Broom	2025-02-21	• Must use Rygen’s organizational account
Cursor	Chris Broom	2025-02-21	• Privacy mode must be enabled
Cline	Chris Broom	2025-02-21	• Must use Rygen-provided API key
Circleback.ai	Chris Broom	2025-02-21	• Be careful of conversations and documents shared
Google Gemini	Field Bradley	2025-04-01	• Only Pro version or built in GCP version can be used, or follow usage policies for free version
Leapsome	Field Bradley	2025-04-01	• Usage following the Leapsome terms and conditions
Aider	Field Bradley	2025-05-12	• Opt out of usage data sharing • Only use approved LLMs
n8n	Field Bradley	2025-08-15	• Utilize only with approved LLMs
Greptile	Field Bradley	2025-11-13	• Usage following the Greptile terms and conditions

Approved MCP Connectors

The following MCP (Model Context Protocol) connectors have been approved for use with Claude Desktop and other compatible AI tools.

Competency Matrix

Wed, 27 Aug 2025 00:00:00 +0000

Purpose

This matrix defines the competencies required for roles critical to the AI Management System (AIMS) and identifies how competence is evidenced and maintained.

Competency Requirements

Principal AI Engineer

Required Competencies: • ISO 42001 knowledge • AI/ML expertise • AI risk management • AI ethics and governance • Leadership and communication

Minimum Evidence: • Advanced degree or equivalent experience • 5+ years AI/ML experience • ISO 42001 training certificate • Current role performance

Mon, 01 Jan 0001 00:00:00 +0000

AI Tool Request Form

Requestor Information

Name:
Department:
Role:
Manager:
Date:

Tool Information

Tool Name:
Vendor:
Website:
Pricing Model:
Number of Required Licenses:

Business Justification

Primary Purpose:
Expected Benefits:
Alternative Solutions Considered:
Impact if Not Approved:

Technical Details

Does the tool offer opt-out from data training? (Yes/No):
Data security features:
Required integrations:
Type of data to be processed:
Browser/system requirements:

Usage Details

Who will use this tool?
What type of data will be processed?
How frequently will it be used?
Required access level: