The ISO 30401 crosswalk.

Clause 4.4.2(a)

Capture: acquiring new knowledge

Clause 4.4.2(a) requires an organization to show that it acquires new knowledge systematically: creation, discovery, lessons learned, and acquisition from outside. An auditor reading it looks for a mechanism, not for effort.

Capture is that mechanism. It ingests from the systems where knowledge is actually made: documents, shared drives, the chat threads where decisions land, resolved tickets, CRM records, and experts themselves. It runs continuously, rather than waiting for someone to remember to submit something.

The evidence: every entry carries a source lineage showing which system it came from and when. Acquisition stops being a claim and becomes a record an auditor can sample.

Clauses 4.4.3(b) and (c)

Structure and Enrich: representation and combination

Clause 4.4.3 covers how knowledge is conveyed and transformed. Subclause (b), representation, covers codifying it so it is documented, reachable, and usable in a consistent form. Subclause (c), combination, covers classifying, tagging and synthesizing, so related knowledge is found together instead of scattered.

Two steps carry this. Structure normalizes whatever arrives, a policy PDF, a ticket resolution, a decision buried in a thread, into one entry format. Enrich adds the tags and relationships that connect an entry to the products, policies and situations it applies to.

The evidence: one schema and a working taxonomy. Ask where the entries about a given obligation live and the answer is a query rather than a dig.

Clause 4.4.2(d)

Clean: outdated or invalid knowledge

Clause 4.4.2(d) requires the organization to handle outdated or invalid knowledge: deletion, curation, archiving, and updating. Of every clause in the standard this is the one organizations struggle hardest to evidence, because the work it describes was never anybody's job.

Clean is a near-verbatim match. Its four sub-steps, update, deduplicate, remove contradictions, archive, are the clause's requirements restated as continuous work the AI does. The standard asks for a practice. Most organizations can show a content review that happened once.

The evidence: a change history on every entry, showing what changed, which duplicates merged, which contradictions were resolved, and what was archived.

Clause 10.2

Improve: continual improvement

Clause 10.2 requires continual improvement of the suitability, adequacy, and effectiveness of the knowledge management system: a recurring activity, not a one-time implementation.

Improve, step five, refines the clarity and usability of entries based on how they actually perform in use. Because consumption signals flow back into the loop, improvement is driven by evidence of what readers and AI systems struggled with, not by a calendar reminder.

The evidence: version histories showing successive refinement tied to usage, which is exactly the record a clause built on the word continual is asking for.

Clauses 5.3, 7.5.2 to 7.5.3

Approve: roles, review, and control

Clause 5.3 requires top management to assign roles, responsibilities and authorities for the knowledge management system: someone must be answerable, by name. Clauses 7.5.2 and 7.5.3 govern documented information: review and approval on creation and update, then protection, distribution control, version control and retention.

Approve is the human gate in an otherwise AI-run loop, and it satisfies both at once. An entry goes live only when a named approver with assigned authority signs off, and the sign-off is timestamped, versioned and recorded.

The evidence is that record: who approved this, in what role, on what date, at what version, from what source. The chip shown here is illustrative.

Clause 4.4.2(b)

Integrate and Deploy: applying current knowledge

Clause 4.4.2(b) requires that current knowledge is applied: transferred, shared and usable inside the flow of work, rather than sitting in a repository nobody opens.

Integrate and Deploy push an approved entry to every channel at once, over MCP, the open standard AI assistants use to reach outside data, and a plain API: assistants and agents, proposal tools, internal search and chat, and portals.

The evidence: deployment state per entry per channel, so a reviewer can confirm not only that knowledge was approved but where it was in force, and when.

Clause 4.4.3(d)

Reuse: internalization and learning

Clause 4.4.3(d) covers internalization and learning: knowledge being searched for, taken in, and put into practice. It is the clause that asks whether the system is actually used.

Reuse is where both kinds of reader draw on the governed entries: people searching and asking, and AI systems retrieving over MCP. A machine internalizes nothing. It answers from whatever it retrieves. So for AI the standard's intent is met only if what it reads from is the governed set.

The evidence: reuse records showing that knowledge is consumed, by whom and by what, and that what gets consumed shapes the next revision.

Regulation (EU) 2024/1689

The EU AI Act

The EU AI Act is Regulation (EU) 2024/1689, published on EUR-Lex (https://eur-lex.europa.eu/eli/reg/2024/1689/oj). Its obligations for high-risk AI systems began applying to new systems on August 2, 2026.

For systems in scope it sets requirements including data and data governance (Article 10), record-keeping (Article 12), transparency and provision of information to deployers (Article 13), and human oversight (Article 14).

In practice

Where those requirements reach you

Where a system answers from your own knowledge, those requirements reach the knowledge itself. What did it answer from? Who approved that, when, and in what version? Was a person accountable?

Our answer is the provenance record on every live entry. Whether a given system is high-risk is a legal call you make with your own counsel.

Voluntary framework

NIST AI RMF

The NIST AI Risk Management Framework is voluntary, published by the U.S. National Institute of Standards and Technology (https://www.nist.gov/itl/ai-risk-management-framework). It is built around four functions: govern, map, measure and manage, and it is increasingly written into procurement questionnaires and vendor AI audits.

When a review built on it asks how you govern the knowledge your AI draws on, the loop's records are the documentary answer: provenance, approval, change history and deployment state. In both reviews the pattern is the same. Here is where an unapproved answer costs you, and here is the trail: approver, timestamp, source and version on every entry the AI reads.