Direct answer: An ISO 42001 gap assessment compares the organisation's current AI governance with the AIMS requirements and Annex A control objectives. It should leave you with a scoped inventory, named owners, prioritised risks, evidence gaps and a practical certification-readiness plan.
1. AI inventory and scope
- List each AI system, model, feature, supplier and deployment environment.
- Record intended purpose, users, owner, lifecycle status and affected people.
- Define the legal entity, products, locations, processes and interfaces in AIMS scope.
- Record provider, deployer and other relevant roles for each system.
2. Governance roles and accountability
Check whether leadership has approved the AIMS policy and objectives, and whether accountability is clear across product, engineering, security, privacy, legal and operations. A gap assessment should test how decisions are approved in practice, not just whether a responsibility matrix exists.
- Executive sponsor and AIMS owner named.
- System owners, reviewers and escalation routes assigned.
- Competence, training and communication responsibilities defined.
- Management review and corrective-action cadence established.
3. Risk and impact assessment
Review whether the risk method captures AI-specific harm, reliability, bias, privacy, security, misuse and supplier risks across the lifecycle. Where relevant, impact assessment should consider people, groups and communities affected by an AI system, with documented mitigation and residual-risk decisions.
- Documented criteria for likelihood, impact and acceptance authority.
- Risk register linked to systems, owners, controls and evidence.
- Impact assessment triggers and review points defined.
- Changes, incidents and monitoring results feed back into risk decisions.
4. Annex A control coverage
Map existing processes and evidence to the ISO/IEC 42001 Annex A control objectives. The result should explain which controls apply, how they operate, who owns them and what objective evidence supports their operation; it should not be a generic policy checklist.
- Control applicability and rationale recorded.
- Data, model, lifecycle, transparency and responsible-use controls assessed.
- Supplier and third-party AI controls included.
- Monitoring, incident, human oversight and improvement controls tested.
5. Documentation and evidence readiness
Auditors look for controlled information and operating records. Sample evidence from real workflows: model and data documentation, evaluation results, approvals, oversight logs, supplier reviews, incidents, changes, internal audits and management reviews. Note missing, stale, unapproved or untraceable evidence separately from a missing policy.
How to use the findings
Prioritise gaps by risk, customer need, legal dependency and effort. A focused assessment can support an AIMS implementation plan, internal audit and certification readiness without claiming that ISO 42001 certification itself proves EU AI Act legal compliance.
Need help implementing the findings? See our ISO 42001 consultancy and implementation service. Existing security foundations may be reused through ISO 27001 implementation, while our ISO 42001 and EU AI Act guide explains the legal distinction.
FAQ
It compares your AIMS scope, AI inventory, governance, risk method, Annex A control coverage, documentation and operating evidence with ISO 42001 requirements.
A complete inventory is not required, but identifying known systems, models, suppliers, owners and intended uses is an important assessment output and helps reveal scope gaps.
No. A gap analysis identifies remediation work; an independent certification body performs the certification audit after the AIMS has been implemented and operated.
Turn gaps into an AIMS plan
Start with a proportionate scope and evidence-led assessment.
Explore ISO 42001 consultancy →