ISO 42001 gap assessment
Find out how far you are from ISO 42001 certification, what it will take to close the gaps, and what to tell the customer who asked. We review your AI systems, policies and evidence the way a certification auditor would.
Who it is for
- An enterprise customer or prospect has asked whether you are ISO 42001 certified
- You build or embed AI in your product and need a credible governance story
- You already hold ISO 27001 or SOC 2 and want to know the incremental effort
- You need a realistic budget and timeline before committing to certification
What you get
- Clause-by-clause assessment of ISO 42001 requirements (clauses 4–10)
- Control-by-control review of all 38 Annex A controls, with a draft Statement of Applicability
- Initial AI system inventory and recommended AIMS scope
- Prioritized remediation roadmap with effort estimates and owners
- Certification timeline and budget, including certification body fees
- A short customer-facing summary you can share with the buyer who asked
- Readout session with your leadership team
How it works
- Kickoff and document requestA 60-minute call to confirm scope, then a structured request list for existing policies, risk registers and model documentation.
- InterviewsFour to six short interviews with engineering, product, security and leadership to understand how AI is built and used.
- AssessmentWe test what exists against every requirement and control, rating each as met, partial or missing, with evidence notes.
- ReadoutYou get the report, the roadmap and a walkthrough. Most findings can be acted on the next day.
Not included
- Writing your policies and procedures (that is the readiness engagement)
- Certification itself. Only an accredited certification body can certify you, and it must be independent of whoever prepared you
Questions
How long does the gap assessment take?
About two weeks from kickoff to readout, assuming we can schedule interviews in the first week.
How much of our time does it need?
Typically six to ten hours across your team: a kickoff, a handful of interviews and the readout.
Does the fee count toward readiness?
Yes. If you start a readiness engagement within 60 days, the gap assessment fee is credited against it.
We already have ISO 27001. Is this still useful?
Yes, and it is usually faster. We map what you can reuse from your ISMS and focus on the AI-specific requirements such as impact assessment, data provenance and life cycle controls.
Read first
Get a fixed quote in one call
Thirty minutes to understand your AI systems and your customer’s deadline. You’ll leave with a scope and a price.
Book a scoping call