← Board and governanceFree checklist · Board and governance

Is your AI Management System ready for an ISO 42001 audit?

36 requirements across the seven AIMS clauses and the Annex A controls, broken into the 103 evidence questions an auditor asks underneath them, built from the ISO/IEC 42001:2023 standard itself. Tick every evidence question you can answer yes to and get a live readiness score, no email required to see it.

Listen to this briefing

Passing Your ISO 42001 AI Audit

0:00

Why an AIMS now

ISO/IEC 42001 does not certify a model. It certifies the management system an organization runs around every AI system it develops, provides, or uses: the policy that sets direction, the risk process that catches problems before they reach customers, and the evidence trail that proves it was all done on purpose rather than by accident.

That distinction matters because the properties that make AI risky are different from classical IT risk. The standard itself flags three: AI can make automated decisions in ways that are not transparent or explainable; AI systems are built from data and statistical inference rather than human-coded logic, which changes how they are designed, justified, and deployed; and AI systems that keep learning change their own behaviour after they go live. A management system built for conventional software will not catch any of that. An AIMS is designed to.

For enterprise leaders, the AIMS answers a harder question than whether the AI works: can the organisation prove, to a regulator, a customer or a board, that it is using AI responsibly? The AIMS is the artefact an auditor tests, and most organisations discover too late that they have never built it. The checklist below is organized exactly the way an ISO 42001 auditor will work through your evidence: clause by clause, starting with leadership and ending with the controls in Annex A.

How the readiness score counts

103 evidence questions under 36 requirements, in audit order

Clause 4Context of the Organization
11 questions · 4 requirements
Clause 5Leadership
9 questions · 3 requirements
Blocker if unchecked
Clause 6Planning and Risk
18 questions · 6 requirements
Blocker if unchecked
Clause 7Support
13 questions · 5 requirements
Clause 8Operation
10 questions · 4 requirements
Clause 9Performance Evaluation
9 questions · 3 requirements
Clause 10Improvement
5 questions · 2 requirements
Annex AStatement of Applicability Readiness
28 questions · 9 requirements

Each question ticked adds one point out of 103. A requirement counts as met only when every question under it is ticked.

0–29%Pre-Foundation
30–59%Building the System
60–84%Substantially Conformant
85–100%Audit-Ready

Question and requirement counts are read from the checklist itself. Score bands are the tool's own. The page treats any unchecked item in Clauses 5 or 6 as a blocker, and suggests one full internal audit cycle once you cross roughly 85%.

Section 1 of 8: Context of the Organization · 0 of 103 ticked

Clause 4

Context of the Organization

0 / 11
Decision rule

This clause sets scope. If you can't yet name which AI systems and business units the AIMS covers, nothing below is auditable.

4.1

Have you documented the internal and external issues that affect your AI management system, including whether climate change is relevant to your context?

0 / 3

Evidence an auditor will ask for

4.2

Have you identified the interested parties relevant to your AI systems (regulators, customers, employees, AI subjects) and their requirements?

0 / 3

Evidence an auditor will ask for

4.3

Is the scope of your AI management system written down: which business units, AI systems, and roles it covers, and which it does not?

0 / 3

Evidence an auditor will ask for

4.4

Does the AIMS exist as a working system rather than a binder, with structure, roles, and processes running day to day and not only at audit time?

0 / 2

Evidence an auditor will ask for

Your readiness score

Not started

0/ 103

Evidence questions answered yes. Requirements fully met, meaning every evidence question underneath them is answered: 0 of 36.

Start checking off items above to see where your AIMS stands.

This tool produces a self-assessment against the ISO/IEC 42001:2023 standard for your own planning purposes. It does not constitute a certification, an accredited audit or legal advice. The recommended steps below are the starting point for a facilitated gap assessment and the judgement of an accredited certification body, which they do not replace. Your answers stay in your browser and are neither sent to Terence Kok nor reviewed by anyone.

Opens a full report with every requirement and evidence question, your answers, recommended next steps, and your calculated score. Print or save it as a PDF from there.

Next: rate how far each requirement has got in the ISO/IEC 42001 Clause Readiness Calculator, then put this result in front of your committee with the Combined AI Governance Board Pack.

How this works

What the AIMS requires and where enterprises get stuck

Row of navy binders with orange spine labels representing the seven AIMS clauses

The seven clauses an auditor tests

Purpose

ISO 42001 shares its structure with ISO 27001, 9001, and other management system standards: Context (4), Leadership (5), Planning (6), Support (7), Operation (8), Performance Evaluation (9), and Improvement (10). An auditor moves through them in order, checking that each one produces documented evidence.

Why it matters
  • Clause 6 (risk assessment, treatment, and the Statement of Applicability) is where most first-time audits stall, because it requires evidence that Annex A controls were deliberately included or excluded, not silently ignored
  • Clause 9 (internal audit and management review) is the second most common gap: organizations run the AIMS but never formally review it
  • Leadership (Clause 5) is a prerequisite. Without a signed AI Policy and assigned roles, every downstream clause lacks the authority to function
How to use
  1. Work the checklist in clause order. Later clauses assume earlier ones are already in place
  2. Treat any unchecked item in Clauses 5 or 6 as a blocker: fix these before spending effort elsewhere
  3. Re-run the checklist after each management review to track drift, not just once before certification
Compliance checklist document with orange highlighter marks beside a pair of reading glasses

Annex A is not optional homework

Purpose

Annex A lists reference controls: AI policy, resourcing, impact assessment, life cycle management, data quality, transparency, responsible use, and third-party accountability. You do not have to implement every control, but you must document a justified reason for every one you exclude in your Statement of Applicability.

Why it matters
  • An incomplete or missing Statement of Applicability is one of the fastest ways to fail a Stage 1 audit, regardless of how mature the rest of the AIMS is
  • Data provenance and quality (A.7) is frequently assumed and rarely documented, and auditors ask for the document
  • AI system impact assessment (A.5, and Clause 6.1.4) is the control most enterprises have never formally performed, even when they believe they have considered the risks informally
  • ISO/IEC 42005:2025, a companion standard published after 42001, now gives auditors a documented methodology for exactly this control. If your impact assessments predate 2025, expect an auditor to ask whether the process itself has been reviewed against it, not just whether an assessment exists
How to use
  1. For every Annex A item you leave unchecked, write down whether you are excluding it and why, or whether it is simply not built yet
  2. Prioritise A.5, A.6, and A.7. These three carry the most audit evidence weight per item
  3. Use the checklist output as the first draft of your Statement of Applicability
Hand stamping a gold certification seal onto a document

From checklist to certification

Purpose

This checklist tells you where your AIMS stands today. It does not replace an internal audit, a gap assessment against your specific risk context, or the judgement of a certification body. Treat a high score as the signal to schedule a formal audit; certification comes only from the certification body.

Why it matters
  • Enterprises that go straight from "mostly checked" to booking Stage 1 without an internal audit cycle routinely surface nonconformities they could have caught themselves
  • A single internal audit cycle (Clause 9.2) before the external audit is the highest-leverage step between "ready on paper" and "ready in practice"
  • Leadership sign-off on the AI Policy and the Statement of Applicability should happen before, not during, the audit process
How to use
  1. Once you cross roughly 85%, run one full internal audit cycle before contacting a certification body
  2. Share the unchecked items with the specific role owner. Clause 5.3 exists because accountability has to be distributed
  3. If you want a facilitated gap assessment against your specific AI systems and jurisdiction, that is a conversation worth having before Stage 1, not during it
BSI Mark of Trust: ISO 42001 Lead Auditor, Professional

About this checklist

This checklist was built by Terence Kok, a Certified ISO/IEC 42001 Lead Auditor Professional (BSI). Lead Auditor training does not teach the standard's text; it teaches the ISO 19011 audit methodology certification bodies use: how to plan a Stage 1 documentation review and a Stage 2 certification audit, how auditors sample evidence rather than reading every page, and how findings get classified as a major nonconformity, a minor nonconformity, or an observation. That is the perspective this checklist is built from: not "does our AIMS look complete on paper," but "would this survive an auditor asking for the evidence behind it." It is also why the checklist is sequenced clause by clause in the order an auditor works through a management system, rather than the order topics happen to appear in the standard.

See the full certification list →
Related governance tools

This checklist tests whether your management system can survive an ISO 42001 audit. It is not the same question as whether your board can answer for an AI incident (see the Board AI Oversight Checklist), or whether your live systems are passing specific bias, privacy, and security thresholds day to day (see the AI Trust, Risk & Governance Dashboard). For the clause 6 risk assessment of each AI agent in scope, with the Annex A controls each tier requires, use the Agent Risk Assessment Matrix. All four cover adjacent ground from a different altitude, and most organisations need more than one. Once the evidence questions are answered, rate how far each requirement has got and draft your Statement of Applicability with the ISO/IEC 42001 Clause Readiness Calculator, which shows the gaps an auditor would likely grade major or minor and whether you are ready for Stage 1.

Go deeper

Want a facilitated gap assessment against your own AI systems?

This checklist tells you where the gaps are. Closing them against your specific risk context, AI systems, and jurisdiction is a structured engagement I run directly.

Learn about working with me
Terence Kok
Before You Go

I wrote this checklist the way an auditor works through an AIMS, clause by clause, because I've sat on both sides of that review as a Lead Auditor. Most organisations that fail do so because Clause 6 and the Statement of Applicability were written once and never revisited. Checking a box here won't get you certified, but it will show you exactly where the evidence trail thins out before someone else finds it first.

Terence Kok

Last updated 30 Sept 2026

More in Board and governance

Next in this group · CalculatorISO/IEC 42001 Clause Readiness CalculatorWhich clauses would an auditor grade as a nonconformity, and are we ready to book Stage 1?Rate your clauses →
← All 9 in Board and governance