Compliance of the management system confirmed by certification audit
Valid until 17. September 2028

4. Context of the organization
Compliant
The Chameleon Way IT GmbH’s activities are based on a clear understanding of the requirements for responsible AI management, the relevant legal, contractual, and other binding obligations, and the internal and external factors that influence the use of AI. The scope and structure of the AI management system comply with the requirements of ISO 42001.
|
Chapter 4.1: The Chameleon Way IT GmbH considers internal and external issues relevant to AI management. | Requirements met |
|
Chapter 4.2: Requirements and expectations of interested parties are determined | Requirements met |
|
Chapter 4.3: The Chameleon Way IT GmbH has defined the scope of the AI management system | Requirements met |
|
Chapter 4.4: The Chameleon Way IT GmbH has implemented its AI management system in accordance with the standard requirements | Requirements met |

5. Leadership
Compliant
The management of The Chameleon Way IT GmbH is actively committed to responsible AI management. It assumes responsibility for the safe and appropriate use of AI and makes key decisions to ensure compliance with relevant legal, contractual, and other binding obligations. In addition, it promotes the continuous improvement of the AI management system.
|
Chapter 5.1: Leadership and commitment requirements are met | Requirements met |
|
Chapter 5.2: The Chameleon Way IT GmbH has defined and communicated an AI policy | Requirements met |
|
Chapter 5.3: Roles and responsibilities for the use of AI are defined and actively implemented | Requirements met |

6. Planning
Compliant
AI management objectives, risks, and the handling of changes are clearly defined and documented. The Chameleon Way IT GmbH plans and manages the use of AI with a risk-based and forward-looking approach. This helps identify potential negative impacts at an early stage, reduce risks, and support the safe and responsible use of AI. Customers benefit from clear structures, controlled AI applications, and a systematic approach to managing opportunities and risks.
|
Chapter 6.1: The Chameleon Way IT GmbH manages risks and opportunities related to the use of AI | Requirements met |
|
Chapter 6.2: The Chameleon Way IT GmbH has defined objectives for AI management and measures to achieve them | Requirements met |
|
Chapter 6.3: Changes are organized in a structured manner | Requirements met |

7. Support
Compliant
The Chameleon Way IT GmbH ensures that AI management tasks are supported by competent personnel, appropriate resources, and clear communication. This ensures that employees have the necessary knowledge to use AI responsibly, identify risks at an early stage, and reliably implement the defined requirements for the use and, where applicable, development of AI applications and systems.
|
Chapter 7.1: The Chameleon Way IT GmbH systematically plans resources for AI management | Requirements met |
|
Chapter 7.2: The Chameleon Way IT GmbH ensures that the required competencies for AI management are available | Requirements met |
|
Chapter 7.3: The Chameleon Way IT GmbH raises awareness of AI management among employees | Requirements met |
|
Chapter 7.4: The Chameleon Way IT GmbH has clear communication structures regarding the use of AI | Requirements met |
|
Chapter 7.5: The Chameleon Way IT GmbH has documented the foundations of AI management in an audit-proof manner | Requirements met |

8. Operation
Compliant
The Chameleon Way IT GmbH consistently implements the requirements of AI management. AI risks are assessed and documented at regular intervals and in the event of significant changes, and are addressed through appropriate measures. The effectiveness of these measures is reviewed and adjusted when new or changed risks arise. In addition, the potential impacts of AI applications and systems are assessed regularly and when significant changes occur.
|
Chapter 8.1: The Chameleon Way IT GmbH systematically implements its AI management planning | Requirements met |
|
Chapter 8.2: The Chameleon Way IT GmbH meets the requirements for AI risk assessment | Requirements met |
|
Chapter 8.3: Requirements for AI risk treatment are met | Requirements met |
|
Chapter 8.4: Requirements for AI system impact assessment are met | Requirements met |

9. Performance measurement
Compliant
The Chameleon Way IT GmbH regularly evaluates the effectiveness of its AI management and identifies potential risks and impacts associated with the use of AI. It verifies compliance with relevant requirements through internal audits and summarizes the results in a structured management review. This ensures that AI management objectives are achieved, relevant legal and contractual requirements are met, and the responsible use of AI is continuously improved.
|
Chapter 9.1: Results are systematically reviewed and analyzed | Requirements met |
|
Chapter 9.2: Regular internal checks and audits ensure consistent quality | Requirements met |
|
Chapter 9.3: The Chameleon Way IT GmbH conducts regular management reviews | Requirements met |

10. Improvement
Compliant
The Chameleon Way IT GmbH embraces the principle of continuous improvement in AI management by regularly reviewing and systematically enhancing the use of AI. Risks, impacts, and opportunities for improvement are systematically assessed, and appropriate measures are implemented. This supports the safe, responsible, and effective use of AI on an ongoing basis.
|
Chapter 10.1: The Chameleon Way IT GmbH ensures continual improvement and further development | Requirements met |
|
Chapter 10.2: The Chameleon Way IT GmbH meets the requirements for the treatment of nonconformities | Requirements met |

Annex A.2
Compliant
The Chameleon Way IT GmbH has established clear guidelines for the development and use of AI systems. These are aligned with business requirements, integrated with other organizational policies, and regularly reviewed to ensure their continued suitability, adequacy, and effectiveness.

Annex A.3
Compliant
The Chameleon Way IT GmbH has defined clear roles and responsibilities for the use, management, and development of AI use cases and AI systems. In addition, processes have been established for reporting and systematically addressing concerns related to AI applications and systems throughout their entire lifecycle.

Annex A.4
Compliant
The Chameleon Way IT GmbH has systematically identified and documented the resources required for the use and management of AI. These include, in particular, AI applications and tools, relevant data, technical and infrastructure resources, as well as the people involved and their competencies. Both externally provided AI systems and internally developed or operated AI solutions are taken into account.

Annex A.5
Compliant
The Chameleon Way IT GmbH has established a process for assessing and documenting the potential impacts of AI applications and systems. Particular consideration is given to potential impacts on individuals, groups of people, and society. The assessments are documented and updated as necessary throughout the lifecycle of the respective AI application or system.

Annex A.6
Compliant
The Chameleon Way IT GmbH has defined and documented clear objectives and requirements for its AI use cases. The lifecycle of AI use cases and AI applications is managed through established processes. These processes cover both the responsible use of external AI systems and, where applicable, the design, development, and further development of internally developed AI systems.

Annex A.7
Compliant
The Chameleon Way IT GmbH reviews and documents the data used in the deployment and, where applicable, the development of AI applications and systems. In particular, the collection, selection, quality, origin, and preparation of relevant data are considered throughout the entire lifecycle of the respective AI use cases and systems.

Annex A.8
Compliant
The Chameleon Way IT GmbH ensures that relevant interested parties are appropriately informed about AI applications and systems. This includes information on their use and potential impacts as well as, where applicable, mechanisms for reporting adverse impacts and incidents. In addition, The Chameleon Way IT GmbH defines what information about AI applications and systems is communicated to interested parties.

Annex A.9
Compliant
The Chameleon Way IT GmbH ensures that AI applications and systems are used responsibly and in accordance with their intended purpose. Clear objectives and requirements for their use have been defined and documented. AI applications and systems are used in accordance with applicable policies and their respective requirements.

Annex A.10
Compliant
The Chameleon Way IT GmbH has clearly defined responsibilities related to AI applications and systems with respect to customers, suppliers, partners, and other third parties. When selecting and using external providers, attention is paid to the responsible use of AI. At the same time, customer requirements and expectations are taken into account when using and, where applicable, developing AI applications and systems.