ISO/IEC 42001 readiness · ISO/IEC 42001:2023
How ready is your AI management system for ISO/IEC 42001 certification?
65 requirements covering the management-system clauses 4-10 of ISO/IEC 42001:2023 (context, leadership, planning with AI risk and impact assessment, support, operation, performance evaluation, improvement) and all 38 Annex A controls (AI policy, roles, resources, impact assessment, AI system life cycle, data, information for interested parties, responsible use, third parties and customers). For each requirement you see the clause or control, what an auditor checks, the evidence expected and how it is typically tested at Stage 1 and Stage 2. You get readiness percentages by area, by source and by control, prioritised gaps, a certification path and a PDF report usable as a gap analysis or internal audit input.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: compliance % by area, by source and by control group; P1/P2 gaps.
- PDF report: results, prioritised action plan with guidance, control map, roadmap.
65 requirements · 14 assessment areas · clauses and controls of ISO 42001 · 60-120 minutes
ISO/IEC 42001:2023The first certifiable management system standard for AI, published 18/12/2023: harmonised structure clauses 4-10, Annex A with 38 controls selected through a Statement of Applicability, Annex B implementation guidance, Annex C objectives and risk sources, Annex D on integration with other management systems (e.g. an ISO/IEC 27001 ISMS).
Companion standards and audit frameworkISO/IEC 23894:2023 (AI risk management) and ISO/IEC 42005:2025 (AI system impact assessment) give the methods behind clauses 6 and 8; ISO/IEC 42006:2025 and ISO/IEC 17021-1 define how accredited certification bodies audit an AIMS (Stage 1, Stage 2, 3-year cycle); ISO 19011 guides the internal audit. Legal inputs such as the EU AI Act enter through clause 4.2.
Prepare your teamCertification succeeds when the AIMS lead, system owners and internal auditors speak the language of the standard. GoToCertify offers exam preparation for ISO/IEC 42001 Foundation, Lead Implementer and Lead Auditor, with practice questions and explanations aligned with the clauses and Annex A controls assessed here.
Assessment areas
- CTX – Context and scope of the AIMS
Clause 4 asks the organisation to understand why it is adopting an AI management system: its role(s) in the AI value chain (AI provider, producer or developer, AI user or deployer, data provider, platform or tool vendor, evaluator), the internal and external issues that shape its AI activities, the interested parties and their requirements (laws such as the EU AI Act, contracts, ethical expectations), and from these a defensible scope. Auditors spend most of Stage 1 here: a vague scope or a missing legal register undermines everything that follows. - LDR – Leadership and AI policy
Clause 5 and Annex A.2 require visible commitment from top management: an approved AI policy that states principles and commitments, is aligned with the other policies of the organisation (security, privacy, quality, HR, procurement), is communicated and is reviewed at planned intervals. Auditors interview top management directly and look for decisions, resources and policy ownership, not only a signed PDF. - PLN – Planning: risk, impact and objectives
Clause 6 is the engine of the AIMS: risk criteria and a repeatable AI risk assessment, risk treatment with a Statement of Applicability (SoA) covering all Annex A controls, a process for AI system impact assessments, measurable AI objectives and controlled changes. Clause 8 then requires these assessments to actually be performed, at planned intervals and when significant changes occur. ISO/IEC 23894 (AI risk management) and ISO/IEC 42005 (impact assessment) are the natural guidance documents. - SUP – Support: resources, competence, awareness, communication, documents
Clause 7 covers the enablers: adequate resources, demonstrated competence for AI roles, awareness of the AI policy across the workforce, a communication plan and controlled documented information. Auditors sample training records, interview staff about the policy and check that documents and records are versioned, approved and retrievable. - ROL – AI roles and reporting of concerns
Annex A.3 (with Clause 5.3) expects every AI-related responsibility to be assigned - risk management, impact assessment, data governance, development, security, privacy, safety, human oversight, supplier and customer relationships - and a trusted channel through which personnel can raise concerns about the organisation's AI practices without fear of retaliation. - RES – Resources for AI systems
Annex A.4 requires the organisation to identify and document, per AI system, the resources it depends on: data, tooling (algorithms, models, frameworks, evaluation tools), system and computing resources (including where they run and their environmental footprint) and human resources with the right competences. This inventory is the backbone for risk assessment, supplier management and technical documentation. - IMP – AI system impact assessment in practice
Annex A.5.3-A.5.5 turn the Clause 6.1.4 process into records: documented impact assessments for each relevant AI system, covering effects on individuals and groups (fairness, safety, privacy, autonomy, vulnerable persons) and on society (environment, economy, health, culture, democratic processes). ISO/IEC 42005:2025 gives a method and a template; the EU AI Act fundamental rights impact assessment is a related legal input for some deployers. - LCY – AI system life cycle
Annex A.6 covers responsible development and operation: objectives for responsible development, a defined life cycle with gates, requirements and specification, design documentation, verification and validation (including bias, robustness and safety testing), controlled deployment, operation and monitoring (drift, incidents, repairs, retirement), technical documentation and event logging. Stage 2 auditors follow one or two AI systems end to end through these records. - DAT – Data for AI systems
Annex A.7 requires governed data across the AI life cycle: a data management process for development and enhancement, lawful and documented acquisition, defined quality criteria, provenance records and documented preparation (cleaning, labelling, transformation). Where personal data is involved, these controls meet privacy and security requirements that typically come from Clause 4.2 (GDPR and other legal inputs). - INF – Information for interested parties and incidents
Annex A.8 requires the organisation to tell users and other interested parties what they need to know about the AI systems (purpose, limitations, oversight, how to use them), to offer a channel for external reporting of adverse impacts, to communicate AI incidents and to provide information required by authorities or contracts. Transparency obligations from laws and customer agreements feed into this area. - USE – Responsible use of AI systems
Annex A.9 addresses the organisation as a user of AI systems, whether developed in-house or by others: objectives for responsible use, processes that enforce them (approval, human oversight, acceptable-use rules, staff guidance) and use that stays within the intended purpose and documented limitations of each system. - TPR – Third-party and customer relationships
Annex A.10 covers the AI value chain: responsibilities are allocated explicitly between the organisation, its suppliers (foundation model and API providers, data providers, labelling services, integrators), its partners and its customers; supplier relationships are governed so that the organisation's AI principles are upheld; customers receive what they need to use the AI systems responsibly. - PRF – Performance evaluation
Clause 9 requires evidence that the AIMS works: monitoring and measurement of defined indicators, an internal audit programme covering all clauses and applicable Annex A controls, and a management review with the inputs listed by the standard and recorded decisions. A complete internal audit and management review cycle is a precondition for Stage 2. - IMV – Nonconformity and continual improvement
Clause 10 requires the organisation to react to nonconformities, analyse causes, take corrective action proportionate to the effects and verify effectiveness, and to continually improve the AIMS. Auditors check the corrective action register against audit findings, AI incidents and complaints, and expect lessons learned to flow back into risk assessment, life cycle processes and training.
Certification path and key dates
| Date | Source | Status | |
|---|---|---|---|
| 18/12/2023 | ISO/IEC 42001:2023 | Publication of ISO/IEC 42001:2023, first edition of the AI management system requirements standard (clauses 4-10, Annex A with 38 controls, Annex B implementation guidance, Annex C objectives and risk sources, Annex D use across domains and integration with other management system standards) | Published |
| 2023 | ISO/IEC 23894:2023 | ISO/IEC 23894:2023 (AI - Guidance on risk management) published 2023; the natural method reference for Cl. 6.1.2-6.1.3 and Cl. 8.2-8.3 | Published |
| 2025 | ISO/IEC 42005:2025 | ISO/IEC 42005:2025 (AI system impact assessment guidance) published 2025; supports Cl. 6.1.4 / Cl. 8.4 and controls A.5.2-A.5.5 | Published |
| 2025 | ISO/IEC 42006:2025 | ISO/IEC 42006:2025 (requirements for bodies providing audit and certification of AI management systems) published 2025; certification bodies are expected to be accredited against it, which shapes audit time, auditor competence and sampling in your Stage 1 / Stage 2 | Published |
| 2027 | IAF / accreditation bodies | Transition of AIMS certification body accreditations to ISO/IEC 42006:2025 within the transition period set by IAF and the national accreditation bodies: check the current deadline with your certification body and prefer a body accredited for ISO/IEC 42001 | Verify |
| Month 0 | Certification cycle | Gap analysis against clauses 4-10 and Annex A (this self-assessment), decision to proceed, scope draft and business case | Typical |
| Month 1-3 | Certification cycle | Design: context, interested parties and legal register, scope, AI policy, roles, risk criteria and methods, impact assessment process, AI system inventory, document control | Typical |
| Month 3-9 | Certification cycle | Implementation: risk and impact assessments performed, Statement of Applicability and treatment plan, life cycle, data and supplier controls operating, competence and awareness delivered, monitoring in place | Typical |
| Month 9-10 | Certification cycle | Full internal audit cycle and first management review; corrective actions on findings; selection of an accredited certification body and application | Typical |
| Month 10-11 | Certification cycle | Stage 1 audit (readiness review): scope, policy, risk method, SoA, objectives, impact assessment process, documented information, internal audit and management review evidence; areas of concern reported | Typical |
| Month 12 | Certification cycle | Stage 2 audit (implementation and effectiveness): sampling of AI systems through the life cycle, data, suppliers, monitoring, incidents, records; nonconformities to be closed (major) or planned (minor) before the certificate decision | Typical |
| Month 12-13 | Certification cycle | Certification decision and issue of the certificate, valid for a 3-year cycle subject to surveillance | Typical |
| Year 1 | Certification cycle | First surveillance audit: follow-up of findings, changes to the AIMS and AI portfolio, internal audit and management review of the year, sample of controls | Typical |
| Year 2 | Certification cycle | Second surveillance audit: complementary sample of controls and AI systems, effectiveness trends, continual improvement | Typical |
| Year 3 | Certification cycle | Recertification audit before certificate expiry: full review of the AIMS over the cycle, new 3-year certificate | Typical |
Frequently asked questions
Is the ISO/IEC 42001 readiness self-assessment free?
Yes. The tool is free, requires no account and stores nothing on our servers: the assessment runs entirely in your browser and you download the PDF report and an optional save file to your computer.
Which standard is the ISO/IEC 42001 readiness assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 42001:2023. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
AIMS managers, AI governance and compliance leads, CISOs and DPOs extending an existing management system, consultants and internal auditors preparing an ISO/IEC 42001 certification or surveillance audit; it is a self-assessment and does not replace a certification audit.
Can the result be used as a certification gap analysis?
Yes. Each requirement states what an auditor checks, the evidence expected and whether it is reviewed at Stage 1 (documentation) or Stage 2 (implementation). The PDF report lists prioritised gaps, a certification roadmap and the coverage of every clause and control of ISO/IEC 42001:2023, so it can be used as the gap analysis of an implementation project or before a surveillance audit.
Other assessments
- EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
- GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
- ISO/IEC 27001 readiness – Information security management system (ISMS) gap analysis against ISO/IEC 27001:2022 - clauses 4-10 and the 93 Annex A controls, in view of certification
- ISO/IEC 20000-1 / ITSM maturity – Service management system (SMS) gap analysis against ISO/IEC 20000-1:2018 and maturity of the ITSM processes, with ITIL practice cross-references, in view of certification
Self-assessment tool for information purposes only. It is not a certification audit and does not replace the Stage 1 / Stage 2 audit of an accredited certification body. GoToCertify is not affiliated with ISO or IEC; references to ISO/IEC standards are to the official texts, which are copyrighted and available from ISO and national standards bodies - requirements are paraphrased here, not reproduced. No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.