ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 42001 gap analysis tells you, before an auditor does, how far your current AI practices sit from what the standard requires. It is the cheapest hour you will spend on the whole project, because every later decision about budget, timeline and certification body depends on it.
Done well, it produces a ranked list of gaps with owners and dates. Done badly, it produces a spreadsheet of green ticks that collapses at the Stage 1 audit. This guide shows the method that holds up under audit, in the order a practitioner would run it.
If you want the full programme around it, start with the ISO 42001 implementation guide and come back here for the assessment step.
Free gap assessment
How much of ISO 42001 could you evidence today?
Score every clause and Annex A control of the AI management standard, free, and see where the programme really sits.
Run the free ISO 42001 gap assessment → or View premium report sample
An ISO 42001 gap analysis compares what you do today against two sets of requirements: the management system clauses 4 to 10, and the 38 controls in Annex A that you select through your risk treatment. The clauses are mandatory for certification. The Annex A controls are mandatory only where your Statement of Applicability says they apply.
Free AI risk assessment
Which of your AI systems could harm people, or you?
List your AI systems, models and data, pick from 38 AI risk scenarios, rate them for the people affected and for you, and plan treatment with ISO 42001 Annex A controls. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free AI risk assessment → or View premium report sample
That distinction matters. A common mistake is scoring all 38 controls as if each were a requirement. The standard lets you justify exclusions, so your analysis should record applicability first and conformity second.
The result is not a pass or fail mark. It is a picture of which requirements you already meet, which you partly meet, and which do not exist yet in your organization.
Think of the output as a map for your first 90 days. An ISO 42001 gap analysis that does not change the project plan was a waste of effort.
Decide which AI systems, business units and roles the AI management system will cover. Scope drives the size of the gap list, so a vague scope produces a vague analysis.
Write the boundary in one paragraph: which AI systems you build, which you buy, which you only use, and which locations are included. Certification bodies will read this paragraph first, and it becomes the basis of your clause 4 context analysis.
If you are unsure whether you are an AI developer, provider or user, list your systems first. The AI model inventory gives you that list in one place.
Keep the ISO 42001 gap analysis scope consistent with the one you will later certify, otherwise the work has to be repeated.
Pick an owner who can see across functions. In most organizations that is the head of risk, compliance or information security, supported by someone who understands how your models are built and deployed.
Pair that owner with a technical reviewer. Compliance staff can judge documents, but only engineers can tell you whether a monitoring control really exists. Without both views, the ISO 42001 gap analysis misses either the paperwork or the practice.
Give the team access to the source standard. ISO/IEC 42001:2023 on iso.org is the authoritative reference, and quoting the clause text in your working papers prevents arguments about interpretation later.
Take each clause and break it into testable statements. Clause 5, for example, requires top management to establish an AI policy and assign responsibilities, which gives you at least two things to look for: a signed policy and named owners.
For each statement, record the evidence you already hold: a policy, a meeting record, a risk register, a training log. If you cannot point to a document or record, the honest score is a gap.
Use three ratings only: conforms, partially conforms, does not conform. Finer scales invite debate and hide the real work. A clause-by-clause requirements list keeps this step consistent.
Annex A groups its 38 controls into nine areas, A.2 to A.10, covering policy, internal organization, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party relationships.
Score each control for applicability first. Then score how well your current practice meets it. Record the reason for any exclusion, because the Statement of Applicability must justify it.
Controls follow risk, so run a first-pass AI risk assessment alongside this step. Without it, you are guessing which controls matter.
At this stage the ISO 42001 gap analysis starts to pay for itself, because you can show management exactly which three or four items hold up certification.
| Gap rating | What it means | Typical action |
|---|---|---|
| Conforms | Documented and applied with recent evidence | Maintain and sample in the internal audit |
| Partially conforms | Exists but incomplete or inconsistently applied | Close before Stage 2 |
| Does not conform | No process, record or owner | Build first and prioritize by risk |
| Not applicable | Control excluded with a documented reason | Record the justification in the SoA |
A policy that exists but nobody follows is not conformity. Add a second rating for how consistently each requirement is applied in practice: not started, defined, applied, measured.
Auditors test operation, not intent. For every requirement you rate as applied, ask for two pieces of evidence from the last quarter. If you cannot produce them, downgrade the rating.
This is also where honest interviews beat document reviews. Ask the people running AI systems what they actually do when a model changes or a data source is replaced.
Not all gaps are equal. Rank them by three factors: audit consequence, risk exposure and effort to close. A missing AI policy is quick to fix and fatal at audit. A missing monitoring pipeline is slow and expensive.
Group the results into three buckets: must close before Stage 1, must close before Stage 2, and can close after certification with a dated plan. This turns a long list into a sequence.
Use the ranking to refine your certification timeline and your certification budget. Both are guesses until the gap list exists.
Every gap needs an owner, a deliverable, a due date and a way to verify closure. Without those four fields, the item will still be open at the audit.
Link each gap to the document or process that closes it. Most early gaps are documents: the AI policy, risk assessment method, impact assessment procedure, objectives and internal audit programme. Our ISO 42001 checklist lists them in order.
Review the plan monthly. A gap analysis is a snapshot, so repeat a lighter version before the internal audit to confirm what has actually changed.
The first mistake is scoring intent instead of evidence. A planned policy is a gap until it is approved and communicated. The second is treating Annex A as a shopping list rather than a risk-driven selection.
The third is ignoring AI systems bought from suppliers. Annex A.10 expects you to manage third-party and customer relationships, so a vendor-hosted model belongs in scope. See how a third-party AI impact assessment handles this.
The fourth is skipping the impact assessment requirement in clause 6.1.4 and Annex A.5. It is unique to AI standards, and auditors look for it early. Our guide to the ISO 42001 impact assessment explains what to produce.
Present the findings to top management in one page: scope, number of gaps by rating, the three biggest risks to certification, and the resources you need. Clause 5 makes leadership accountable, so their decisions on budget and ownership are part of conformity.
Then use the output to choose your route. Some organizations close the gaps themselves with templates and an internal team. Others buy support for the hardest items. A ready-made ISO 42001 Toolkit covers the mandatory documents so you can spend time on the real work: evidence and operation.
You can also run a quick self-check with our free ISO 42001 gap assessment tool before investing in a full review.
Finally, schedule the next review date before you close the meeting. Requirements, systems and suppliers change, so the gap list needs a refresh at least once before certification and again whenever you add a significant new AI system to scope.
For a small organization with a handful of AI systems, expect days rather than weeks. Larger organizations with many systems and business units take longer, mostly because of evidence gathering and interviews. Treat any figure as a typical range, not a quote.
Yes. The standard does not require an outside party. An independent reviewer helps you avoid optimistic scoring, but the method above works internally if you insist on evidence for every rating.
No. A gap analysis happens before the system is built and measures distance from the standard. The internal audit happens after implementation and tests whether the operating system conforms.
Score applicability for all 38, then conformity only for the controls you keep. Excluding a control is allowed when you can justify it in the Statement of Applicability.
October 20, 2026
October 20, 2026
October 19, 2026
October 19, 2026
October 18, 2026