ISO 42001 readiness: what an assessment covers

Guides · 25 September 2026 · 9 minute read

ISO/IEC 42001 is the management-system standard for artificial intelligence, published in December 2023. Like ISO 27001 for information security, it does not certify a product; it certifies that an organisation runs a system for governing how it develops, buys and uses AI. An ISO 42001 readiness assessment tells you how far you are from that, in the standard’s own terms, before an auditor does. This guide explains what a good one covers and what it should hand you at the end.

What the standard asks for

ISO 42001 follows the same structure as other ISO management-system standards. Clauses 4 to 10 set the requirements: the organisation’s context and the scope of the AI management system; leadership and an AI policy; planning, which is where AI risk assessment and AI system impact assessment sit; support, meaning resources, competence and documentation; operation; performance evaluation, including internal audit; and improvement.

Annex A lists the controls (organised into themes such as policies, internal organisation, resources for AI systems, impact assessment, the AI system lifecycle, data, information for interested parties, use of AI systems, and third-party relationships), and Annex B gives implementation guidance for each. Annex C lists objectives and risk sources to consider, and Annex D covers use across domains and sectors. The text of the standard is copyrighted, so a readiness assessment works from the standard itself, not from a paraphrase found online.

Why now

The EU AI Act’s obligations for stand-alone high-risk systems (Annex III) apply from 2 December 2027, and for AI in regulated products (Annex I) from 2 August 2028, after the AI Omnibus in force since 27 July 2026 deferred them; the full timeline is on our Security page. Its risk-management, data-governance, logging and human-oversight requirements map closely onto what ISO 42001 asks a management system to do. For a supplier selling into the EU, an ISO 42001 certificate is becoming the shortest answer to a procurement questionnaire. For everyone else, it is the first framework that makes “we use AI responsibly” a claim someone can audit.

What a readiness assessment covers

Scope and inventory

The first question is which AI systems are in scope, and the first finding is usually that nobody has the full list. Models called through an API, features bought inside a SaaS product, an internal chatbot, a fine-tuned model in a data pipeline: the assessment builds the inventory and decides, with you, where the boundary of the management system lies.

Leadership, policy and roles

Is there an AI policy, does someone own it, and does it say anything a team could break? Roles for approving new AI use, for assessing impact and for handling incidents need names, not departments.

Risk and impact assessment

The standard distinguishes risk to the organisation from impact on individuals, groups and society. A readiness assessment checks whether either exists for the systems in scope, whether it is repeated when a system changes, and whether the results changed any decision.

The lifecycle

Requirements, design, data, development, verification, deployment, operation and retirement, and what is recorded at each stage. For bought-in models this becomes a third-party question: what the provider commits to, what data reaches them, and whether that is in the contract.

Data

Provenance, quality, and rights over training and prompt data; what is logged when a model is called; how long it is kept, and who can see it.

Monitoring, incidents and audit

How model behaviour is monitored in operation, how an AI incident is defined and handled, and whether the internal audit programme covers any of this yet.

What the evidence looks like

An auditor wants records, not intentions: the inventory, the policy with its approval, impact assessments with dates, supplier agreements naming the provider as a processor, logs that show model calls can be accounted for afterwards, and minutes showing management reviewed the system. A readiness assessment reports each control as present with evidence, present without evidence, or absent.

The gaps we see most

• No inventory of AI systems, so the scope is a guess.
• AI services being called from cloud accounts with no invocation logging, so use cannot be reconstructed after the fact.
• Policies that exist as documents but have no owner, no approval and no way to be breached.
• Impact assessments done once, for the pilot, and never repeated.
• Model providers used under click-through terms, with no data-processing agreement.

What you should get at the end

• A gap list mapped clause by clause and control by control, each with its evidence or the note that none exists.
• A prioritised plan, ordered by what certification requires first and by what reduces real risk.
• A tailored policy set, so the plan starts with documents rather than a blank page.
• A clear statement of who certifies. A consultancy prepares you; an accredited certification body issues the certificate. Anyone offering both is a conflict of interest.

Our Security & AI Readiness engagement is a fixed-price ISO/IEC 42001 and EU AI Act readiness assessment, with the evidence collection done through read-only access to your cloud accounts. Tell us what you need and we will reply with a written scope.