ISO 27001:2022 Annex A 5.31 Legal, statutory, regulatory and contractual requirements for AI Companies

ISO 27001 Annex A 5.31 is a security control that requires organizations to identify and document all legal, statutory, regulatory, and contractual obligations. The primary implementation requirement is the maintenance of a centralized legal register, providing the business benefit of mitigating regulatory penalties and enhancing enterprise client trust.

For leaders in the Artificial Intelligence sector, navigating the complex world of information security is paramount. While the ISO 27001 standard provides a comprehensive framework, one particular control, ISO 27001 Annex A 5.31 Identification of legal, statutory, regulatory and contractual requirements, is where compliance meets commercial reality. Every unchecked legal, regulatory, or contractual obligation is an invitation for disruption, not just a penalty.

This guide provides a practical blueprint for turning this complex requirement from a hidden risk into a powerful business advantage, building the foundation upon which customer trust and regulatory resilience are built.

The “No-BS” Translation: Decoding the Requirement

Let’s strip away the consultant-speak. Annex A 5.31 asks one question: “Do you know the laws you are breaking?” If you operate globally, you have 50+ laws to track.

The Auditor’s View (ISO 27001)	The AI Company View (Reality)
“Legal, statutory, regulatory and contractual requirements… shall be identified, documented and kept up to date.”	Make a list. 1. Laws: GDPR, CCPA, EU AI Act. 2. Contracts: The SLA you signed promising 99.9% uptime. 3. Regulations: PCI-DSS if you take payments. If it’s not on the list, you aren’t compliant.

The Business Case: Why This Actually Matters for AI Companies

Why should a founder care about a “Legal Register”? Because ignorance is not a defence, and it is expensive.

The Sales Angle

Enterprise clients will ask: “How do you ensure compliance with the EU AI Act?” If your answer is “We are looking into it,” you lose the deal. If your answer is “We track all relevant AI regulations in our ISO 27001 Legal Register and conduct quarterly compliance reviews,” you win trust. A 5.31 proves you are a grown-up company.

The Risk Angle

The “Copyright” Lawsuit: You train your model on “public” data. Later, a court rules that scraping is copyright infringement. If you didn’t have “Intellectual Property Rights” listed as a requirement in A 5.31, you have no defence. You didn’t even check.

DORA, NIS2 and AI Regulation: The Legal Register

Regulators demand that you know your obligations.

• DORA (Article 5): Financial entities must have an internal governance framework. This includes mapping all legal obligations related to ICT risk.
• NIS2 Directive: Requires “compliance with legal requirements.” You must know which sectors you serve (e.g., energy, health) and what specific laws apply to them.
• EU AI Act: This is the big one. It imposes strict obligations on “High-Risk AI Systems.” You must document these obligations (e.g., conformity assessments, transparency) in your Legal Register to prove you are tracking them.

ISO 27001 Toolkit vs SaaS Platforms: The Register Trap

SaaS platforms give you a generic list of laws, but they don’t apply them to your business. Here is why the ISO 27001 Toolkit is superior.

Feature	ISO 27001 Toolkit (Hightable.io)	Online SaaS Platform
The Content	Pre-populated List. We give you a spreadsheet with common laws (GDPR, HIPAA, etc.) ready to go.	Generic Database. Platforms connect to a legal database but dump 1,000 irrelevant laws on you. “Do you comply with the Bulgarian Mining Act?”
Ownership	Your Register. You keep the Excel file. You can share it with your lawyer.	Platform Lock-in. Your legal compliance status is locked in their dashboard. If you leave, you lose your history of compliance checks.
Simplicity	Relevance Column. Simple “Yes/No” check.	Overkill. Forces you to link every single control to a specific clause of a specific law, wasting hundreds of hours.
Cost	One-off fee. Pay once. Be compliant.	Subscription. You pay monthly for a list of laws that you could find on Google.

The AI Magnifying Glass: Unique Risks and Obligations

For AI companies, the web of obligations under Annex A 5.31 is significantly more intricate.

Securing Your Training Data

If your training data contains PII, it falls under GDPR. Annex A 5.31 requires you to identify these laws. Furthermore, your agreements with data suppliers often contain contractual clauses that dictate how that data can be stored. Failing to track these obligations creates hidden tripwires.

Protecting Algorithmic Integrity

Service Level Agreements (SLAs) that promise specific levels of accuracy or uptime are a core part of your contractual landscape. These agreements must be identified. A disruption to your algorithmic processes is a breach of contract.

Managing the AI Supply Chain

Every relationship with a third-party model provider or cloud host is governed by a contract. Annex A 5.31 mandates that you identify and manage the information security requirements embedded in these contracts.

Your Blueprint for Compliance: Practical Steps to Success

To effectively manage obligations, create a dynamic system.

Create a Centralised Legal Register

This is the core artefact. Create a master list of all legal, statutory, regulatory, and contractual requirements.

• Requirement: The specific law or contract clause.
• Source: “GDPR Art 32” or “Client Contract X Clause 9.”
• Control: What you do to comply (e.g., “Encryption at rest”).

Assign Clear Ownership

Every requirement must have an owner. “Head of Legal” owns GDPR. “CTO” owns SLAs. If nobody owns it, you are non-compliant.

Integrate Requirements into Your ISMS

Link the requirement to the control. If the law requires encryption, link it to your Encryption Policy (A 8.24). This creates a provable chain.

The Evidence Locker: What the Auditor Needs to See

When the audit comes, prepare these artifacts:

• Legal Register (Excel): The master list, updated within the last 12 months.
• Contract Review Log: Evidence that you check client contracts for security clauses before signing.
• Data Protection Registration: Your ICO registration certificate (or local equivalent).
• IP Rights Policy: A document stating how you respect intellectual property (e.g., open source licenses).

Common Pitfalls & Auditor Traps

Here are the top 3 ways AI companies fail this control:

• The “Outdated” Law: Your register lists the “Data Protection Act 1998” instead of the “Data Protection Act 2018.” This proves you haven’t looked at it in years. Instant fail.
• The “Missing” Contract: You signed a huge deal with a bank that requires “Data Residency in UK,” but you didn’t add it to the register. You are hosting data in the US. Breach of contract.
• The “Open Source” Violation: You use GPLv3 code in your proprietary product. You violated the license terms because you didn’t track “Contractual/License” obligations in your register.

Handling Exceptions: The “Break Glass” Protocol

What if you cannot comply with a law (e.g., conflicting laws in US vs EU)?

The Legal Risk Acceptance Workflow:

• Identification: Conflict identified between Law A and Law B.
• Advice: Obtain external legal opinion.
• Decision: Board formally accepts the risk of non-compliance with one jurisdiction to satisfy the other.
• Documentation: Record this decision in the Risk Register (not just the Legal Register).

The Process Layer: “The Standard Operating Procedure (SOP)”

How to operationalise A 5.31 using your existing stack (Linear, Excel).

• Step 1: Setup (Manual). Download the Hightable.io Legal Register Template. Fill it with your known laws.
• Step 2: Monitoring (Automated). Subscribe to a legal update feed (or just set a Google Alert for “AI Regulation”).
• Step 3: Update (Manual). When a new law (e.g., EU AI Act) passes, add it to the register. Create a Linear ticket: “Assess impact of EU AI Act.”
• Step 4: Review (Manual). Quarterly meeting between CISO and Legal to review the register. Update “Last Review Date.”

For an AI company, mastering compliance with ISO 27001 Annex A 5.31 is about building a fundamental layer of trust. The High Table ISO 27001 Toolkit provides the expert guidance and practical tools you need to turn a complex compliance obligation into a clear business advantage.

ISO 27001 Annex A 5.31 for AI Companies FAQ

About the author