Free tool · requirements, audit and gap analysis
ISO 42001 checklist
A gap-analysis checklist for ISO/IEC 42001:2023: the requirements in clauses 4 to 10 and every Annex A control, each with the evidence an auditor will expect to see. Mark each item, add notes, and export the result. Your progress stays in your browser.
- Items
- 69
- Sections
- 16
- Sources
- 6
- Reviewed
- Oct 30, 2026
Next review by Jan 28, 2027 · report an error
How to use it
- 01
Agree the scope
Decide which AI systems, products and locations the AIMS covers and your role for each (clause 4). The certification guide explains how scope affects the audit.
- 02
Assess each clause
Go through clauses 4 to 10 and set each item to not started, in progress or done. Note the owner and where the evidence lives.
- 03
Assess Annex A
For each control, mark whether it is in place. Mark controls you exclude as N/A and record the justification in the notes: your Statement of Applicability needs it.
- 04
Export your gap list
Download Excel, CSV or Markdown to turn open items into a remediation plan, or print it for a workshop.
What the checklist covers
ISO/IEC 42001:2023 is the certifiable standard for an AI management system (AIMS). Its requirements sit in clauses 4 to 10, and Annex A lists reference controls. This checklist has 31 requirement items for clauses 4 to 10 and all 38 Annex A controls across 9 areas (A.2 to A.10), each with evidence examples.
Use it for a gap analysis before certification, to prepare for a Stage 1 or Stage 2 audit, or to run an internal audit. For what each clause means and how the controls fit together, read our ISO 42001 guide; for the audit process, see ISO 42001 certification, step by step.
Paraphrased, not copied
The standard is copyrighted and sold by ISO and national standards bodies. We use only the public clause and control numbers and titles, and every requirement and evidence line is our own wording. Buy the standard before you rely on exact requirements.
EU AI Act deadlines to plan around
ISO 42001 has no legal deadlines, but many teams build an AIMS to get ready for the EU AI Act. Certification is not a conformity assessment under the Act and gives no presumption of conformity, so track the Act separately with our EU AI Act compliance checklist (78 items).
| Date | What applies | Reference |
|---|---|---|
| Feb 2, 2025In force | Prohibited practices and AI literacy apply | Arts. 4–5 [sd-timeline][fli-113] |
| Aug 2, 2026In force | Article 50 transparency duties apply; enforcement begins for GPAI models, prohibitions, transparency and AI literacy | Art. 50, Art. 113 [sd-timeline] |
| Dec 2, 2027Upcoming | High-risk obligations apply to Annex III systems | Art. 113, Art. 6(2) [sd-timeline][fli-113] |
| Aug 2, 2028Upcoming | High-risk obligations apply to Annex I (regulated-product) systems | Art. 113, Art. 6(1) [sd-timeline][fli-113] |
The checklist
0% done
0 of 69 applicable items done · 0 in progress · 0 N/A
Clause 4 Context of the organization
0 of 6 doneWhat shapes your AI management system (AIMS): issues, interested parties, your AI roles and the scope.
- Clause 4.1
Identify the internal and external issues that affect what your AI management system needs to achieve.
Evidence: A context register or analysis (for example PESTLE or SWOT) covering regulation, technology, market and internal factors, reviewed at management review.
- Clause 4.1
Decide whether climate change is a relevant issue for your AI management system. This is part of the 2023 first edition, not a later amendment.
Evidence: A recorded decision in the context analysis, with the reasoning (for example energy use of training and inference, or climate-related requirements from interested parties).
- Clause 4.1
Determine the intended purpose of the AI systems you develop, provide or use, and your role for each, using the AI roles defined in ISO/IEC 22989 (such as AI provider, producer, customer or partner).
Evidence: An AI system inventory listing intended purpose and your role per system.
- Clause 4.2
Identify interested parties relevant to the AIMS and which of their requirements, including legal and contractual ones, the AIMS will address.
Evidence: An interested-parties register with each party’s requirements and how the AIMS meets them, including applicable AI laws.
- Clause 4.3
Define and document the boundaries and scope of the AIMS.
Evidence: A written scope statement naming the products, AI systems, locations and roles covered, with reasons for any exclusions.
- Clause 4.4
Establish, implement, maintain and continually improve the AIMS, including the processes it needs and how they interact.
Evidence: An AIMS manual or process map showing how the processes fit together.
Clause 5 Leadership
0 of 3 doneTop-management commitment, the AI policy and who is responsible for what.
- Clause 5.1
Show that top management leads and commits to the AIMS, for example by aligning it with business strategy and providing resources.
Evidence: Board or executive minutes approving the AIMS, its budget and objectives.
- Clause 5.2
Set an AI policy that fits your organization’s purpose and commits to meeting applicable requirements and to continual improvement.
Evidence: An approved, version-controlled AI policy, communicated to staff and available to interested parties as appropriate.
- Clause 5.3
Assign and communicate responsibilities and authorities for the AIMS, including reporting on its performance to top management.
Evidence: A RACI or role descriptions for AI governance roles, and appointment records.
Clause 6 Planning
0 of 8 doneAI risk assessment and treatment, the Statement of Applicability, AI system impact assessment and AI objectives.
- Clause 6.1.1
Plan actions to address risks and opportunities for the AIMS, and set criteria for which AI risks are acceptable.
Evidence: A documented risk methodology with acceptance criteria and a list of risks and opportunities with planned actions.
- Clause 6.1.2
Define an AI risk assessment process that fits your AI policy and objectives and gives consistent, valid and comparable results.
Evidence: The AI risk assessment procedure and retained assessment results.
- Clause 6.1.3
Define an AI risk treatment process: choose treatment options, determine the controls needed, and compare them with Annex A so nothing necessary is missed.
Evidence: A risk treatment record linking each risk to its chosen controls, with the Annex A comparison.
- Clause 6.1.3
Produce a Statement of Applicability listing the necessary controls and justifying the inclusion or exclusion of each Annex A control.
Evidence: A Statement of Applicability covering all 38 Annex A controls, with justifications and implementation status.
- Clause 6.1.3
Prepare an AI risk treatment plan and have designated management approve it and accept the residual risks.
Evidence: An approved treatment plan with owners and dates, and signed residual-risk acceptance.
- Clause 6.1.4
Define a process to assess the potential consequences of AI systems for individuals, groups and societies, document the results and feed them into the risk assessment.
Evidence: An impact assessment procedure and completed assessments per in-scope system. ISO/IEC 42005:2025 gives guidance; our FRIA generator helps for EU deployers.
- Clause 6.2
Set measurable AI objectives at relevant functions and levels, and plan how to achieve them.
Evidence: An objectives register with metrics, owners, resources, deadlines and how results are evaluated.
- Clause 6.3
Make changes to the AIMS in a planned way.
Evidence: A change procedure for the AIMS and a log of changes made.
Clause 7 Support
0 of 5 doneResources, competence, awareness, communication and documented information.
- Clause 7.1
Provide the resources the AIMS needs.
Evidence: Budget, headcount and tooling allocated to AI governance, approved by management.
- Clause 7.2
Determine the competence people need for AIMS work and make sure they have it.
Evidence: A competence matrix, training records and evidence of qualifications for AI governance roles.
- Clause 7.3
Make sure people know the AI policy, how they contribute to the AIMS and what happens if they do not follow it.
Evidence: Awareness training records and staff communications about the AI policy.
- Clause 7.4
Decide what to communicate about the AIMS, when, with whom and how.
Evidence: A communication plan covering internal and external audiences.
- Clause 7.5
Create, update and control the documented information the AIMS needs.
Evidence: Document control procedure, version history, access controls and retention rules for AIMS records.
Clause 8 Operation
0 of 4 doneRunning the AIMS: carrying out risk assessments, risk treatment and impact assessments in practice.
- Clause 8.1
Plan, implement and control the processes needed to meet AIMS requirements, including externally provided processes.
Evidence: Operating procedures, process controls and records showing they run as planned.
- Clause 8.2
Carry out AI risk assessments at planned intervals and when significant changes are proposed or occur.
Evidence: Dated risk assessment results, including ones triggered by changes.
- Clause 8.3
Implement the AI risk treatment plan and check that it works; take new risks through the treatment process.
Evidence: Evidence the planned controls are in place and records of effectiveness checks.
- Clause 8.4
Carry out AI system impact assessments at planned intervals and when significant changes are proposed.
Evidence: Dated impact assessments per system, including ones triggered by planned changes.
Clause 9 Performance evaluation
0 of 3 doneMonitoring and measurement, internal audit and management review.
- Clause 9.1
Decide what to monitor and measure about the AIMS, how and when, and evaluate the results.
Evidence: A metrics set for the AIMS (for example objectives progress, control effectiveness, incidents) with periodic reports.
- Clause 9.2
Run internal audits of the AIMS at planned intervals under an audit programme.
Evidence: An internal audit programme, audit plans, objective and impartial auditors, and at least one completed audit report before certification.
- Clause 9.3
Have top management review the AIMS at planned intervals.
Evidence: Management review minutes covering the required inputs, with decisions and actions.
Clause 10 Improvement
0 of 2 doneContinual improvement, nonconformities and corrective action.
- Clause 10.1
Continually improve the suitability, adequacy and effectiveness of the AIMS.
Evidence: An improvement log fed by audits, reviews, incidents and feedback.
- Clause 10.2
React to nonconformities, fix them, find root causes and take corrective action.
Evidence: A nonconformity and corrective action log with root cause and verification of effectiveness.
A.2 Policies related to AI
0 of 3 doneAnnex A controls for the AI policy and how it fits with your other policies.
- A.2.2
AI policy: document a policy for the development or use of AI systems.
Evidence: The AI policy itself, approved and dated.
- A.2.3
Alignment with other organizational policies: work out where other policies (security, privacy, quality) affect or apply to AI.
Evidence: A policy mapping showing links between the AI policy and related policies, with updates made.
- A.2.4
Review of the AI policy: review the policy at planned intervals or when needed.
Evidence: Review records with dates, reviewers and changes made.
A.3 Internal organization
0 of 2 doneAnnex A controls for AI roles and a way to raise concerns.
- A.3.2
AI roles and responsibilities: define and allocate roles for AI according to your needs.
Evidence: Role descriptions and an AI governance org chart.
- A.3.3
Reporting of concerns: give staff and others a way to report concerns about the AI systems you develop or use.
Evidence: A reporting channel (for example a hotline or form), its procedure, and a log of concerns handled.
A.4 Resources for AI systems
0 of 5 doneAnnex A controls for documenting the data, tools, computing and people each AI system relies on.
- A.4.2
Resource documentation: identify and document the resources each AI system needs across its life cycle.
Evidence: A resource record per system in the AI inventory.
- A.4.3
Data resources: document the data resources used by each AI system.
Evidence: Dataset inventory per system with source, purpose and owner.
- A.4.4
Tooling resources: document the tools used for AI systems, such as frameworks, libraries and model platforms.
Evidence: Tooling list per system, with versions.
- A.4.5
System and computing resources: document the computing and infrastructure resources used.
Evidence: Infrastructure records (cloud services, regions, hardware) per system.
- A.4.6
Human resources: document the people and competences involved with each AI system.
Evidence: Team and competence records for development, operation and oversight.
A.5 Assessing impacts of AI systems
0 of 4 doneAnnex A controls for impact assessment on individuals, groups and society.
- A.5.2
AI system impact assessment process: set up a process to assess potential consequences of AI systems for individuals, groups and societies.
Evidence: The impact assessment procedure with triggers and scoring.
- A.5.3
Documentation of AI system impact assessments: record and keep the results of impact assessments.
Evidence: Completed assessments stored with retention rules.
- A.5.4
Assessing AI system impact on individuals or groups of individuals: assess and document impacts on people throughout the life cycle.
Evidence: Assessments covering fairness, privacy, safety and rights of affected people.
- A.5.5
Assessing societal impacts of AI systems: assess and document impacts on society.
Evidence: Assessments covering wider effects such as environmental, economic or democratic impacts where relevant.
A.6 AI system life cycle
0 of 9 doneAnnex A controls from development objectives through deployment, monitoring and event logs.
- A.6.1.2
Objectives for responsible development of AI system: set and document objectives that guide responsible development.
Evidence: Documented development objectives (for example fairness, transparency, safety) linked to design decisions.
- A.6.1.3
Processes for responsible design and development of AI systems: define and document the development process.
Evidence: A development lifecycle procedure with approval gates.
- A.6.2.2
AI system requirements and specification: specify and document requirements for new systems or material changes.
Evidence: Requirement specifications per system, including non-functional and responsible-AI requirements.
- A.6.2.3
Documentation of AI system design and development: document design and development based on your objectives and requirements.
Evidence: Design documents, model selection rationale and architecture records.
- A.6.2.4
AI system verification and validation: define and document verification and validation measures and criteria.
Evidence: Test plans with acceptance criteria and results before release.
- A.6.2.5
AI system deployment: document a deployment plan and make sure requirements are met before deployment.
Evidence: Release checklists and deployment approvals.
- A.6.2.6
AI system operation and monitoring: define what is needed for ongoing operation, such as monitoring, repairs, updates and support.
Evidence: Monitoring dashboards, alert thresholds, runbooks and support records.
- A.6.2.7
AI system technical documentation: decide what technical documentation each category of interested party needs and provide it.
Evidence: Technical documentation sets for users, partners and authorities as relevant.
- A.6.2.8
AI system recording of event logs: decide in which life-cycle phases event logs are kept, including while the system is in operation.
Evidence: Logging specification and sample logs.
A.7 Data for AI systems
0 of 5 doneAnnex A controls for data acquisition, quality, provenance and preparation.
- A.7.2
Data for development and enhancement of AI system: define and apply data management processes for developing and improving AI systems.
Evidence: A data management procedure for training and fine-tuning data.
- A.7.3
Acquisition of data: decide and document how data is acquired and selected.
Evidence: Data sourcing records, licences and consent where relevant.
- A.7.4
Quality of data for AI systems: define data quality requirements and check data meets them.
Evidence: Data quality criteria and check results, including representativeness and bias checks.
- A.7.5
Data provenance: record where data came from across its life cycle.
Evidence: Lineage records or datasheets showing origin and transformations.
- A.7.6
Data preparation: define criteria and methods for preparing data.
Evidence: Documented cleaning, labeling and transformation methods.
A.8 Information for interested parties
0 of 4 doneAnnex A controls for user information, external reporting and incident communication.
- A.8.2
System documentation and information for users: give users the information they need about the AI system.
Evidence: User guides, notices and model cards. Our model card generator can help.
- A.8.3
External reporting: give interested parties a way to report adverse impacts of the system.
Evidence: A public reporting channel and a log of reports handled.
- A.8.4
Communication of incidents: plan how incidents are communicated to users and others.
Evidence: An incident communication plan with templates and contact lists.
- A.8.5
Information for interested parties: decide and document what information about AI systems you must report to interested parties, such as regulators.
Evidence: A register of reporting obligations and copies of reports sent.
A.9 Use of AI systems
0 of 3 doneAnnex A controls for responsible use and keeping use within the intended purpose.
- A.9.2
Processes for responsible use of AI systems: define and document processes for using AI systems responsibly.
Evidence: An acceptable-use procedure and approval workflow for new AI tools.
- A.9.3
Objectives for responsible use of AI system: set objectives that guide responsible use.
Evidence: Documented use objectives and how they are measured.
- A.9.4
Intended use of the AI system: make sure systems are used as intended and as their documentation describes.
Evidence: Use monitoring and periodic checks against the intended purpose.
A.10 Third-party and customer relationships
0 of 3 doneAnnex A controls for sharing responsibilities with suppliers and customers.
- A.10.2
Allocating responsibilities: split responsibilities across the AI life cycle between you, partners, suppliers, customers and other third parties.
Evidence: Contracts or responsibility matrices covering each AI system with third-party involvement.
- A.10.3
Suppliers: make sure services, products or materials from suppliers fit your approach to responsible AI.
Evidence: AI supplier due diligence records. Our AI vendor risk assessment builds the questionnaire.
- A.10.4
Customers: take customers’ expectations and needs into account in your responsible approach to AI.
Evidence: Customer requirements captured in contracts, product documentation and support processes.
Next steps after the gap analysis
Turn open items into a remediation plan with owners and dates, then budget the audit with the certification cost calculator. If you want software to hold the AI inventory, Statement of Applicability and evidence, compare platforms in our independent ranking of ISO 42001 software. To find an accredited certification body, see ISO 42001 audit firms.
Frequently asked questions
+What is an ISO 42001 gap analysis?
It compares how you govern AI today with what ISO/IEC 42001 requires: the clauses 4 to 10 management-system requirements and the Annex A controls. The output is a list of gaps with owners and dates. It is usually the first step toward certification; see our certification guide.
+How many controls are in ISO 42001 Annex A?
Annex A has 38 controls in nine areas, A.2 to A.10, from AI policy to third-party and customer relationships. Annex B gives implementation guidance for each control. You select the controls you need in risk treatment and justify each inclusion or exclusion in a Statement of Applicability.
+Do we have to implement all 38 Annex A controls?
No. You compare the controls you need with Annex A so nothing necessary is missed, then record which controls apply and why in a Statement of Applicability. A company that only uses third-party AI may exclude some development controls, with a written justification. Mark excluded controls N/A here and note the reason.
+What does an ISO 42001 audit checklist look like?
Auditors look for evidence that the AIMS is designed and running: a scope statement, AI policy, roles, a risk method and current results, the Statement of Applicability, impact assessments, records that selected controls operate, a completed internal audit and a management review. Every item above lists the evidence to prepare. The ISO 42001 guide summarizes what auditors examine.
+What are the ISO 42001 requirements in clauses 4 to 10?
Clause 4 covers context, interested parties, your AI roles and scope; 5 leadership and the AI policy; 6 planning, including AI risk assessment, risk treatment and AI system impact assessment; 7 support; 8 operation; 9 monitoring, internal audit and management review; and 10 improvement. Clauses 1 to 3 cover scope, references and terms and hold no requirements.
+Why does this checklist paraphrase the standard?
ISO/IEC 42001 is copyrighted and sold by ISO and national standards bodies. We use the public clause and control numbers and titles and describe each requirement in our own words. Buy the standard before you rely on exact wording.
+Can I use this as an AI compliance checklist for the EU AI Act?
Partly. ISO/IEC 42001 is not a harmonised standard under the EU AI Act and gives no presumption of conformity, but an AIMS supports many of the Act’s duties, such as risk management, data governance and monitoring. For the Act itself, use our EU AI Act compliance checklist.
+How much does ISO 42001 certification cost?
It depends mainly on audit days, set by your size and the number of AI systems in scope, plus any consulting and internal time. Our certification cost calculator gives an estimate.
+Is my progress stored on your servers?
No. Statuses and notes are saved only in your browser’s local storage on this device. Nothing is sent to us. If your browser blocks storage, the checklist still works, but export before closing the tab.
Sources
Each item lists the sources it draws on. The date after each source is when we last opened and checked it.
- [modulos-clauses]Modulos, ISO/IEC 42001 clauses 4–10. Checked Oct 30, 2026.Clause and sub-clause numbers and titles for clauses 4 to 10, and what 6.1.2–6.1.4 and 8.2–8.4 ask for.
- [modulos-annexes]Modulos, ISO/IEC 42001 Annexes A–D. Checked Oct 30, 2026.Annex A table: 38 controls in nine areas (A.2–A.10) with titles; Annex B normative; Annexes C and D informative.
- [iso-catalog]ISO, ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system (2023-12). Checked Oct 15, 2026.Title, edition and publication date of the standard.
- [lrqa-checklist]LRQA, ISO 42001 checklist. Checked Oct 15, 2026.Annex A control area titles, as published by a certification body.
- [nist-crosswalk]Microsoft, hosted by NIST AI Resource Center, NIST AI RMF to ISO/IEC FDIS 42001 crosswalk. Checked Oct 15, 2026.Control numbering (prepared on the final draft text).
- [konfirmity-soa]Konfirmity, ISO 42001 Statement of Applicability. Checked Oct 15, 2026.Controls are selected in risk treatment and each inclusion or exclusion is justified in the Statement of Applicability.
How we keep this page current
We re-check every item against its sources at least every 90 days, and sooner when the law or standard changes. This checklist is a planning aid, not legal advice: requirements are paraphrased, so check the official text and take advice before relying on it. Vendors cannot pay to appear on this page.