ISO 42001 Gap Assessment

What is the ISO 42001 Gap Assessment?

The ISO 42001 Gap Assessment is a free, self-serve tool from IRM Consulting & Advisory that measures your organization against ISO/IEC 42001, the international standard for Artificial Intelligence Management Systems (AIMS) published by ISO and IEC. You choose your scope: Basic (Level 1) covers the mandatory management system requirements of Clauses 4 to 10, and Standard (Level 2) adds all 38 reference control objectives and controls from Annex A. You assess each requirement and control, score gaps by likelihood and impact, and download a professional report with an executive summary, detailed findings, and a prioritized remediation roadmap.

ISO 42001 Gap Analysis explained

An ISO 42001 gap analysis, also called a gap assessment, is a structured comparison of your organization's current AI governance practices against the requirements of ISO/IEC 42001:2023, identifying which clause requirements and Annex A controls you already meet, where you fall short, and what to fix first. It is the standard starting point for any AI Management System (AIMS) implementation or certification project.

A good gap assessment, sometimes called an ISO 42001 readiness assessment or self-assessment, answers three questions. Firstly, Coverage: which of the mandatory Clause 4 to 10 requirements and the 38 Annex A controls apply to you, given your role as an AI provider, developer, or user? Secondly, Conformance: for each applicable requirement, do you have the process, the documentation, and the evidence an auditor would ask for?

Thirdly, Priority: of the gaps you find, which ones expose real risk to your customers, your data, and your compliance obligations, and in what order should you close them? The free assessment tool above works exactly this way: every gap is scored by likelihood and impact on a 5x5 risk matrix, so the output is a prioritized remediation roadmap rather than a flat checklist.

When to run a Gap assessment before ISO 42001 Certification

Run your first gap assessment before you spend anything on implementation or certification. The typical ISO 42001 journey for a small or medium organization has five stages: gap assessment, remediation, internal audit (required by Clause 9.2), management review (Clause 9.3), and then the two-stage certification audit with an accredited certification body. The gap assessment sets the scope, budget, and timeline for everything that follows; organizations that skip it routinely discover missing risk assessments or undocumented AI system life cycles mid-audit, when fixes are most expensive.

Repeat the assessment after major remediation work, when you deploy or materially change an AI system, when your role with respect to AI changes (for example, you start fine-tuning models instead of only consuming APIs), and on an annual cycle thereafter. Because the tool on this page saves progress in your browser and is free, re-running it costs nothing but an afternoon.

What the 38 Annex A Controls cover

Annex A of ISO/IEC 42001 provides 38 reference controls organized into nine control objectives, A.2 through A.10. They are not all mandatory: you select the controls your AI risk treatment requires and justify inclusions and exclusions in your Statement of Applicability. Together they span the full life of an AI system, from policy and accountability through data management, impact assessment, transparency, responsible use, and third-party relationships.

How the Basic and Standard scopes map to a Statement of Applicability

The Statement of Applicability (SoA) is the document Clause 6.1.3 requires: a list of the controls you consider necessary, with justification for every inclusion and exclusion. Auditors treat it as the index to your whole AIMS, and it is usually the first document a certification body asks for.

The two assessment scopes in the tool map directly onto SoA preparation. The Basic (Level 1) scope covers the Clause 4 to 10 management system requirements, which are mandatory for every organization and are never excluded in an SoA; assessing them first tells you whether the management system itself (context, leadership, risk processes, support, operation, evaluation, and improvement) stands up.

The Standard (Level 2) scope adds all 38 Annex A controls, which is precisely the set you must dispose of in the SoA. Your assessment results give each control a status: compliant controls become "implemented" entries, partially compliant and non-compliant controls become "planned" entries tied to your remediation roadmap dates, and controls you mark not applicable become documented exclusions with your reasoning. Run the Standard scope and you have effectively drafted the evidence base for your first SoA.

Gap Assessment vs Internal Audit vs Certification Audit

A gap assessment is a diagnostic you run for yourself before building your AIMS; an internal audit is the recurring conformance check Clause 9.2 requires once the AIMS exists; a certification audit is the independent, two-stage examination by an accredited body that results in an ISO/IEC 42001 certificate. They answer different questions at different times, and none replaces the others.

ISO 42001 Clause-by-Clause Reference

The table below summarizes every mandatory requirement in Clauses 4 to 10 of ISO/IEC 42001:2023 and the evidence auditors typically expect to see for each. The summaries are condensed guidance prepared by IRM Consulting & Advisory, not verbatim standard text; the assessment tool above walks you through all 27 of these requirements at either scope.

Closing the gaps is where most organizations want help. IRM's AI Governance services build right-sized AI management systems for SMBs and startups, and our Virtual CISO services take teams from gap assessment through certification readiness for ISO 42001, ISO 27001, CMMC and SOC 2.