A vendor questionnaire comes back from a prospective client with a line nobody on the team recognises: describe your alignment with ISO 30401. The security lead knows ISO 27001 cold. The AI governance conversation has been about ISO 42001 for a year. This one is unfamiliar, and a quick search establishes that it concerns knowledge management (KM) without making it obvious what it would mean to satisfy it, or whether the AI platform the organisation just shortlisted has anything to do with it.
It has quite a lot to do with it. ISO 30401 knowledge management is the one standard in that family whose subject is the knowledge itself rather than the systems around it, which makes it the most directly relevant of the three to a platform whose entire job is answering questions from your documents. This post sets out what the standard requires, where those requirements land on an AI platform, and what to actually check before buying. The discipline underneath it is the subject of our guide to curated knowledge for regulated organisations.
What ISO 30401 actually requires
ISO 30401:2018, titled "Knowledge management systems — Requirements", is the ISO management system standard for knowledge management. It is built in the same requirements-based form as ISO 9001 and ISO 27001: it describes what an organisation must have in place rather than prescribing how to build it. A revision is currently in development as ISO/DIS 30401, so the 2018 text is the current edition but not the last word.
The substance, stripped of standards language, comes down to four demands. The organisation must establish the scope of the knowledge it intends to manage, which means deciding what counts as organisational knowledge rather than treating every file as equivalent. It must assign ownership and roles, so that specific knowledge has a named human accountable for it. It must manage the knowledge lifecycle, covering how knowledge is created, captured, reviewed, kept current, and retired. And it must evaluate whether the system works, through measurement rather than assertion.
When the standard was published in 2018, those requirements described human work: policies to write, a taxonomy to build, communities of practice to run. Most organisations now also have a tool answering staff questions directly from their documents, and the same four requirements apply to it just as much as to the people. That is where the standard becomes both useful and uncomfortable.
Where ISO 30401 knowledge management meets the AI layer
The standard never mentions AI, and that is exactly what makes it useful. It was written without a vendor's product shape in mind, so it functions as a neutral framework rather than a checklist reverse-engineered from someone's feature list. Take the four demands in turn.
Scope becomes the corpus question. Deciding what counts as managed organisational knowledge is, for an AI platform, the question of which documents it may answer from. A tool that answers from whatever a given user can open has not scoped anything. The scope is an accident of file permissions, which means the organisation cannot state what its managed knowledge actually is.
Ownership becomes the approval question. A named accountable owner for a body of knowledge maps onto a named approver for each document the AI is allowed to use. If eligibility is inherited from folder access rather than granted by a person, there is no owner in the sense the KM standard means, because nobody made a decision that could be attributed to them.
Lifecycle becomes the supersession question. Knowledge that is reviewed, kept current and retired maps onto what happens when a policy is replaced. The practical test is whether the superseded version stops informing answers automatically, or whether it keeps surfacing until somebody notices and intervenes.
Evaluation becomes the audit question. Measuring whether the system works requires knowing what it did. For an AI platform that means per-answer records: which documents produced a given answer, in which version, approved by whom. Without that, evaluation is a satisfaction survey.
What to check against the KM standard before you buy
The mapping above turns into four questions worth putting to a vendor in writing. They are deliberately phrased so that a yes has to be demonstrable.
| ISO 30401 requirement | The question to ask | What a weak answer sounds like |
|---|---|---|
| Scope of managed knowledge | Can you produce the list of documents the AI was permitted to answer from on a given past date? | "It respects your existing permissions." |
| Ownership and roles | Does a document become eligible through a named person's approval, and is that approval recorded? | "Anything in the connected folder is available." |
| Knowledge lifecycle | When a document is superseded, does the old version stop informing answers automatically? | "You can delete or re-sync it." |
| Evaluation and evidence | For one answer given three months ago, can you show the documents, versions, approvers and recipient? | "We log all user queries." |
The pattern in the weak answers is the same each time: a capability of the file system is offered in place of a decision by the organisation. That substitution is precisely what the standard is written to prevent, which is why an ISO knowledge management framing is more useful in a procurement conversation than a feature comparison. It moves the discussion from what the tool can do to what the organisation can evidence.
One caution on certification. ISO 30401 is written as a requirements standard, so conformity assessment is possible, but treating a certificate as the goal misses most of the value. For the majority of organisations the four questions above will do more work in an afternoon than a certification programme will do in a year. The standard's contribution here is vocabulary and structure, not a badge. Where certification genuinely matters is the adjacent standards a regulated buyer is already asking about, and our guide to AI knowledge management for regulated industries sets those in context.
How AnswerVault maps to ISO 30401
AnswerVault is a governed AI knowledge layer that connects an organisation's existing document sources, including SharePoint, Google Drive, and Confluence, and delivers source-backed answers through web chat, Microsoft Teams, Slack, CLI, and API. It was not built to satisfy this standard, and it is not certified against it. But the four requirements above describe its architecture closely, because they describe the same problem it was built for.
On scope, the set of documents the AI may answer from is explicit rather than inherited, so the date-stamped list the first question asks for is a matter of record. On ownership, a document becomes eligible because a named subject-matter expert approves it, with the approval written into the audit trail at the moment it happens. On lifecycle, when a document is superseded the new version takes over and the record of which version was canonical on which date is preserved. On evaluation, citations resolve to specific documents and versions, so reconstructing a past answer is a lookup rather than an investigation.
AnswerVault is ISO 27001 aligned and ISO 42001 underway, AI is included in every plan with no separate model or API-key requirement, and customer data is never used to train models. The procurement-grade detail, including subprocessors and attestations, is on our security and compliance page.
Where to start
If ISO 30401 has arrived via a questionnaire, the fastest useful move is to put the four questions in the table to whichever AI tool your organisation already runs, before assessing anything new. The answers usually establish quickly whether you have a managed knowledge system or a search box over a file share.
For the discipline the standard is describing, our guide to curated knowledge covers how approval and currency work in practice, and our pricing page sets out which governance capabilities sit in which tier.
AnswerVault is built by Catapult CX, an enterprise technology consultancy. The product was originally developed for a global pharmaceutical company with strict data governance requirements; the same architecture now powers the SaaS platform.