An ISO/IEC 42001 gap analysis compares an organisation’s AI management system with what the standard expects and shows what is missing before a certification audit. This tool uses 32 checks written in our own words, organised by clauses 4 to 10 and by the Annex A themes, and returns readiness by clause, prioritised gaps, a 30, 60 and 90 day roadmap and the evidence to gather.
How to use
- Enter the organisation, its role with AI (develops, uses or both) and the audit goal.
- At each step, tick what is implemented and what is partly implemented. Anything left unticked counts as not started.
- For the Annex A themes, mark as not applicable only what you can justify in the statement of applicability.
- Read the readiness, the band, the gaps and the roadmap, and export as PDF, DOCX, Markdown or CSV for the project plan.
What each field asks for
| Field | What to enter |
|---|---|
| Organisation (optional) | E.g. Norvia Insurance |
| Organisation’s role with AI | Changes the roadmap order: organisations using third-party AI bring suppliers and use forward. |
| Goal | Used to warn you when the timeline looks short for your current readiness. |
| Clauses 4 and 5: implemented | Tick what already works and has evidence. Anything left unticked in these lists counts as not started. |
| Clauses 4 and 5: partly implemented | In place but incomplete, not approved or not recorded. |
| Clause 6: implemented | Tick what already works and has evidence. Anything left unticked in these lists counts as not started. |
| Clause 6: partly implemented | In place but incomplete, not approved or not recorded. |
| Clause 7: implemented | Tick what already works and has evidence. Anything left unticked in these lists counts as not started. |
| Clause 7: partly implemented | In place but incomplete, not approved or not recorded. |
| Clauses 8 to 10: implemented | Tick what already works and has evidence. Anything left unticked in these lists counts as not started. |
| Clauses 8 to 10: partly implemented | In place but incomplete, not approved or not recorded. |
| Annex A (policies to impact): implemented | Tick what already works and has evidence. Anything left unticked in these lists counts as not started. |
| Annex A (policies to impact): partly implemented | In place but incomplete, not approved or not recorded. |
| Annex A (policies to impact): not applicable | Only Annex A themes can be excluded, with a justification in the statement of applicability. |
| Annex A (lifecycle and data): implemented | Tick what already works and has evidence. Anything left unticked in these lists counts as not started. |
| Annex A (lifecycle and data): partly implemented | In place but incomplete, not approved or not recorded. |
| Annex A (lifecycle and data): not applicable | Only Annex A themes can be excluded, with a justification in the statement of applicability. |
| Annex A (use and third parties): implemented | Tick what already works and has evidence. Anything left unticked in these lists counts as not started. |
| Annex A (use and third parties): partly implemented | In place but incomplete, not approved or not recorded. |
| Annex A (use and third parties): not applicable | Only Annex A themes can be excluded, with a justification in the statement of applicability. |
Example
Norvia Insurance, a fictional company, uses third-party AI systems and wants its audit within 12 months. Scope, policy, roles and leadership sponsorship are in place, but risk and impact assessment and the treatment plan are partial, and there has been no internal audit or management review yet. Overall readiness came to 52% (clauses 52%, Annex A 50%), band Developing, with 23 gaps: 4 for the first 30 days, 10 for 60 days and 9 for 90 days. The weakest clauses are 10 Improvement (0%), 9 Performance evaluation (17%) and 6 Planning (50%).
When to use
- Before deciding to pursue ISO/IEC 42001 certification, to estimate the effort.
- At the start of an AI management system implementation, to build the project plan.
- A few months before the certification audit, to check that the evidence exists.
- After an internal audit, to track how the gaps are being closed.
Frequently asked questions
What is an ISO 42001 gap analysis?
It compares what the organisation already does to govern AI with what ISO/IEC 42001 expects from an AI management system. The result is a prioritised list of what is missing, to guide implementation before the audit.
Why do clauses 4 to 10 have no not applicable option?
Because they are the management system requirements and apply to every organisation seeking certification. Only Annex A controls can be excluded, and each exclusion needs a justification in the statement of applicability.
How is readiness calculated?
Each implemented item scores 1 point, partial scores 0.5 and not started scores 0; not applicable items are left out. Readiness is the total points divided by the applicable items, per clause, per theme and overall.
What does near audit-ready mean?
At least 80% overall and on the clauses, no clause item not started and seven essential items implemented: scope, policy, risk assessment, impact assessment process, risk treatment, internal audit and management review. Below 40% the band is early stage.
Does the result certify the organisation against ISO/IEC 42001?
No. Certification of a management system is granted only by an accredited certification body after an audit. The tool is educational, reflects the view of whoever answered and is neither an audit nor legal advice.
Which DPCert certification covers this topic?
The AI management system under ISO/IEC 42001 is covered by RAIL Responsible AI Leader. For whoever runs the internal audit, AUDAI Responsible AI Auditor covers auditing against the standard. DPCert certifies people, not management systems.