ISO 42001 readiness assessment

A documented understanding of the internal and external issues that affect your use of AI: your sector, the regulation reaching you, your risk appetite, and the role you play as a developer, provider or deployer.

Common gap: The context is written generically and could describe any organisation, which tells an assessor it was produced for the file rather than from analysis.

An identified set of interested parties and what each requires: customers, regulators, employees, and the people affected by decisions your AI systems influence.

Common gap: The list covers customers and regulators and omits the people the AI system acts upon, which is the group the standard most cares about.

A written scope stating which AI systems, functions, locations and roles are covered, with justification for anything excluded.

Common gap: Scope is defined by legal entity rather than by AI system, so it is impossible to tell whether a given system is inside it.

The processes making up the management system are established and their interactions understood, rather than existing as a folder of documents.

Common gap: Documents exist for each requirement with nothing connecting them, so the system cannot be traced from context through to improvement.

Evidence that top management is accountable: resources allocated, objectives set, decisions taken about AI use, and attention given when something went wrong.

Common gap: A signed policy is offered as the whole evidence, with no record of management deciding anything about AI.

An approved policy stating your principles for developing and using AI, appropriate to the organisation, communicated, and specific enough to rule something out.

Common gap: The policy is a statement of values with no prohibitions, thresholds or escalation points, so no decision can be tested against it.

Named accountability for AI governance, with the authority attached to it, and the people named able to describe what they own.

Common gap: Responsibility sits with a committee rather than a person, so no individual can be asked what they decided.

A repeatable method for assessing AI risk, applied to your actual systems, producing rated risks with owners rather than a generic register.

Common gap: The risk assessment lists risks common to all AI rather than risks arising from the systems this organisation actually runs.

A treatment plan tracing each assessed risk to the controls addressing it, with residual risk accepted at the right level.

Common gap: Controls were selected first and the risk assessment written afterwards to justify them, which is visible immediately in the numbering.

A process for assessing the impact of AI systems on individuals and society, applied and documented for the systems in scope.

Common gap: The impact assessment is a data protection impact assessment relabelled, so it examines privacy and not fairness, contestability or the consequences of being wrong.

Measurable objectives for AI governance, with the plan to reach them: who, by when, with what resource, and how success is measured.

Common gap: Objectives are aspirational statements with no measure attached, so no monitoring can determine whether they were met.

Changes to the management system are planned rather than made ad hoc, with consideration of consequences and resource.

Common gap: The system was designed once at implementation and no process exists for changing it deliberately.

The competence needed for AI governance is defined, the gap against it assessed, and training or recruitment evidenced.

Common gap: Competence is assumed because the team is technical, with no assessment of whether anyone understands AI-specific risk.

People know the AI policy, what it requires of them, and the consequences of not following it, including staff using AI tools rather than building them.

Common gap: Awareness activity targets the AI team, while the people most likely to put client data into an AI tool have received nothing.

Defined internal and external communication on AI matters: what is communicated, when, to whom, and by whom.

Common gap: Marketing claims about AI capability were never reviewed against what the governance evidence supports.

Documents are controlled: versioned, approved, available where needed, and retired when superseded.

Common gap: Several versions of the same policy circulate and staff act on whichever they were sent.

The processes the management system requires are actually running, with records showing they run rather than exist.

Common gap: Processes are documented and were performed once at implementation, with no evidence of the second cycle.

Impact assessments are performed when new AI systems are introduced or materially changed, not only during implementation.

Common gap: Systems introduced since certification never went through the process, because nothing triggers it.

Defined measures for whether the AI management system is working, with results analysed and acted upon.

Common gap: Measures track activity, such as training completion, rather than effectiveness, such as whether AI risk decisions improved.

A planned audit programme covering the whole management system, performed by someone independent of the work audited, with findings raised and closed.

Common gap: The internal audit is performed by the person who built the management system, which is not independence however competent they are.

Top management reviews the system at planned intervals, covering the required inputs, and the minutes record decisions rather than attendance.

Common gap: The review took place but the minutes record no decision, so there is nothing to demonstrate the system was actually directed.

Nonconformities are recorded, their causes examined, corrective action taken, and effectiveness checked afterwards.

Common gap: Corrective actions fix the instance without examining the cause, so the same finding returns at the next audit.

A policy set covering AI specifically, reviewed on a schedule, and supported by the topic-level policies your use of AI requires.

Common gap: AI is addressed by a paragraph inserted into an existing IT policy rather than by anything written for the purpose.

Clear allocation of AI responsibilities across the organisation, including a route for reporting concerns about an AI system.

Common gap: There is no mechanism for an employee to raise a concern about an AI system's behaviour.

The resources your AI systems depend on are documented: data, tooling, compute, human oversight and the systems themselves.

Common gap: No AI system inventory exists, so the organisation cannot state how many AI systems it operates.

A documented approach to assessing impact on individuals and society, applied consistently, with the results feeding risk treatment.

Common gap: Impact is considered informally in design discussions but never recorded, so nothing can be produced when asked.

Defined requirements across the life cycle: objectives, design, verification, deployment, operation and retirement, with records at each stage.

Common gap: The life cycle covers development and deployment and stops, with no process for decommissioning a model.

Documented provenance, quality and preparation of data used in AI systems, with the basis for using it recorded.

Common gap: Training and fine-tuning data provenance was never documented, so the organisation cannot demonstrate it had the right to use it.

Documented information provided to users and affected parties about the AI system: what it does, its limitations, and how to contest an outcome.

Common gap: Users are not told they are interacting with an AI system, or told with no route to challenge what it produced.

Defined intended use, documented limits, and controls preventing use outside them, including human oversight where it matters.

Common gap: Intended use is documented and nothing detects or prevents use beyond it.

Responsibilities allocated across the AI supply chain, with supplier assessment covering AI-specific matters and contracts reflecting them.

Common gap: AI suppliers are assessed with a generic IT security questionnaire that asks nothing about models, training data or output liability.