← Board and governanceFree calculator · Board and governance

Which ISO/IEC 42001 clauses would fail an audit today?

Rate the 27 requirements in clauses 4 to 10 on a five-level maturity scale, decide each of the 38 Annex A controls for a draft Statement of Applicability, and see a score by clause, the gaps an auditor would likely grade major or minor, and whether you are ready for Stage 1 or Stage 2. Nothing leaves your browser.

Listen to this briefing

The ISO/IEC 42001 Clause Readiness Calculator

0:00

How the rating works

The AIMS readiness checklist asks whether each piece of evidence exists. This calculator asks how far each requirement has got, because an auditor grades the distance between a written procedure and the records that prove it runs. Rate every requirement against the scale below. If you are unsure between two levels, take the lower one: that is the one an auditor will find.

The scale

Five levels, and the two an auditor gates on

  1. 0Not startedNothing exists yet, or only in someone’s head.
  2. 1PlannedIntent is written down (a plan, a draft, a slide), but nothing is approved or operating.
  3. 2DocumentedAn approved procedure or record exists, but there are no operating records yet to show it runs.
  4. 3OperatingDated records from the last twelve months show it running as documented.
  5. 4Evidenced and reviewedOperating, sampled by internal audit and considered at management review.

Stage 1 floor: the core documents must reach level 2. Stage 2 floor: internal audit and management review must reach level 3.

Stage 1 needs the core documents at level 2 or above (4.3, 5.2, 6.1.2, 6.1.3, 6.1.4, 6.2) and a complete Statement of Applicability. Stage 2 needs a full cycle of internal audit (9.2) and management review (9.3) at level 3 or above, no likely major nonconformity, and every applicable control implemented. Grades here are indicative: a certification body grades on what it finds in sampled records.

Next: not ISO/IEC 27001 certified? Leave the box unticked and start at Step 1. Rate every requirement, then decide each Annex A control in Step 2.

0 of 27 requirements rated · 0 of 38 controls decided

Step 1 · Clauses 4 to 10
Clause 4 Context of the Organization

This clause sets scope. If you can't yet name which AI systems and business units the AIMS covers, nothing below is auditable.

4.1 Understanding the organization and its context

Have you documented the internal and external issues that affect your AI management system, including whether climate change is relevant to your context?

Evidence an auditor will ask for
  • Are the internal issues written down: your current AI maturity, in-house skills, existing governance structures, and the risk appetite set by the board?
  • Are the external issues written down: applicable AI regulation in every jurisdiction you operate in, sector guidance, customer contractual requirements, and market pressure?
  • Has the climate change question been answered explicitly in writing, stating whether it is a relevant issue for the AIMS and why, rather than being left unaddressed?

4.2 Needs and expectations of interested parties

Have you identified the interested parties relevant to your AI systems (regulators, customers, employees, AI subjects) and their requirements?

Evidence an auditor will ask for
  • Does the list name each party specifically (which regulator, which customer segment, which internal function, which group of AI subjects) rather than using generic categories?
  • Is each requirement recorded alongside its source, and classified as a legal obligation, a contractual commitment, or an expectation?
  • Is the list reviewed when a new AI system enters scope or you begin operating in a new jurisdiction?

4.3 Scope of the AI management system

Is the scope of your AI management system written down: which business units, AI systems, and roles it covers, and which it does not?

Stage 1 document. Needs level 2 or above before you book Stage 1.

Evidence an auditor will ask for
  • Does the scope statement name the specific AI systems, business units, locations, and processes covered?
  • Is every exclusion stated explicitly with a documented justification an auditor can test?
  • Is the scope held as approved, versioned documented information rather than living in a slide deck or an email?

4.4 AI management system

Does the AIMS exist as a working system rather than a binder, with structure, roles, and processes running day to day and not only at audit time?

Evidence an auditor will ask for
  • Can you show the processes of the AIMS and how they interact: which process feeds risk assessment, which feeds impact assessment, which feeds management review?
  • Do dated records from the past twelve months show the system running continuously, rather than a burst of activity in the weeks before an assessment?
Clause 5 Leadership

This is the prerequisite clause. Without a signed AI Policy and assigned roles, every clause after this one lacks the authority to function.

5.1 Leadership and commitment

Can top management point to specific actions demonstrating commitment to the AIMS, rather than delegating it silently to IT or Legal?

Evidence an auditor will ask for
  • Is there dated evidence of top management involvement: minutes approving the AI policy, a resourcing decision, or an AIMS item on a board or exco agenda?
  • Have AIMS requirements been built into existing business processes such as procurement, project approval, and change management, rather than run as a parallel compliance track?
  • Does top management direct and support named individuals to contribute to the AIMS, and does that show up in their objectives?

5.2 AI policy

Does a documented AI Policy exist, approved by top management and communicated across the organization?

Stage 1 document. Needs level 2 or above before you book Stage 1.

Evidence an auditor will ask for
  • Does the policy state your purpose for using AI, commit to meeting applicable requirements, and commit to continual improvement of the AIMS?
  • Is it approved by a named authority, dated, versioned, and scheduled for review at a defined interval?
  • Can you evidence that it was communicated, through training records, an intranet publication date, or an acknowledgement log?

5.3 Roles, responsibilities and authorities

Are AI-related roles, responsibilities, and authorities assigned, documented, and communicated to the people who hold them?

Evidence an auditor will ask for
  • Is there a documented allocation naming who owns the AIMS, who owns each AI system, and who holds the authority to accept a residual risk?
  • Do the named individuals know they hold the role, and can they describe their responsibilities without reading from the document?
  • Is the route for reporting AIMS performance to top management defined, with a named reporter and a defined frequency?
Clause 6 Planning and Risk

This is where most first-time audits stall and it carries the most evidence weight of the seven clauses. Complete it fully before moving on.

6.1.1 Actions to address risks and opportunities

Have you defined risk criteria: what counts as an acceptable versus unacceptable AI risk for your organization?

Evidence an auditor will ask for
  • Are the acceptance criteria written with thresholds specific enough that two people applying them to the same risk reach the same answer?
  • Do the criteria cover harm to individuals, to groups, and to society, alongside financial and operational harm to the organisation?
  • Is there a named authority empowered to accept a residual risk, and a record of what has been accepted and when?

6.1.2 AI risk assessment

Does a repeatable AI risk assessment process exist that produces consistent, comparable results each time it runs?

Stage 1 document. Needs level 2 or above before you book Stage 1.

Evidence an auditor will ask for
  • Does the documented process define how AI risks are identified, analysed, and evaluated, including who performs each step?
  • Have assessments been performed for every AI system in scope, with the results retained as documented information?
  • Is every identified risk assigned to a named owner and placed in a prioritised order for treatment?

6.1.3 AI risk treatment and Statement of Applicability

Does an AI risk treatment plan exist, checked against Annex A, with a completed Statement of Applicability on file?

Stage 1 document. Needs level 2 or above before you book Stage 1.

Evidence an auditor will ask for
  • Does the treatment plan cover every risk above the acceptance threshold, naming the control, the owner, and the target date?
  • Has each Annex A control been compared against the plan, with the comparison documented rather than asserted?
  • Does the Statement of Applicability list every Annex A control, whether it is applied, the justification for including or excluding it, and its current implementation status?
  • Have the risk owners approved the treatment plan and formally accepted the residual risk in writing?

6.1.4 AI system impact assessment

Does an AI system impact assessment process exist to evaluate effects on individuals, groups, and society?

Stage 1 document. Needs level 2 or above before you book Stage 1.

Evidence an auditor will ask for
  • Does the documented process define what triggers an assessment, who performs it, and what it must cover?
  • Does it require effects on individuals and groups of individuals, and on societies, to be assessed rather than only effects on the organisation?
  • Does it define how results feed the risk assessment and the decision to proceed, and how long results are retained?

6.2 AI objectives and planning to achieve them

Are measurable AI objectives set at relevant functions and levels, each with an owner, a deadline, and a way to verify completion?

Stage 1 document. Needs level 2 or above before you book Stage 1.

Evidence an auditor will ask for
  • Are the objectives consistent with the AI policy, measurable where practicable, and actively monitored?
  • Does each objective record what will be done, what resources are required, who is responsible, when it completes, and how the result is evaluated?
  • Are objectives held as documented information and updated when they are met, missed, or overtaken by events?

6.3 Planning of changes

Do changes to the AIMS go through a planned, controlled process rather than happening ad hoc?

Evidence an auditor will ask for
  • Does the process require the purpose of a change and its potential consequences to be considered before the change is made?
  • Do records of recent changes show the assessment, the approval, and any resulting update to roles, resources, or documentation?
Clause 7 Support

This clause is evidence of capacity. Auditors ask for training records and resourcing decisions instead of stated commitments.

7.1 Resources

Have the resources needed to establish, run, and improve the AIMS (budget, headcount, tooling) been identified and provided?

Evidence an auditor will ask for
  • Are the required resources recorded specifically: budget, headcount, tooling, compute, and external expertise?
  • Is there evidence they were provided, such as an approved budget line, a filled role, or a signed contract, rather than only requested?

7.2 Competence

Are competence requirements for AI-related roles defined, and can you produce evidence (training records, hiring criteria) that people meet them?

Evidence an auditor will ask for
  • Are competence requirements defined per role, covering the technical, legal, and ethical knowledge that role needs?
  • Do you hold competence evidence for the people currently in those roles: qualifications, training records, or documented experience?
  • Where a gap was identified, is the action taken recorded, along with an evaluation of whether the action closed the gap?

7.3 Awareness

Are staff doing work under your control aware of the AI Policy, their contribution to it, and the consequences of nonconformity?

Evidence an auditor will ask for
  • Can staff state the direction the AI policy sets and describe how their own work contributes to it?
  • Have they been told the consequences of not conforming with the AIMS, with that communication evidenced?
  • Does awareness extend to contractors and third-party staff working on in-scope AI systems, not only to employees?

7.4 Communication

Have you decided what to communicate about the AIMS, to whom, when, and how, both internally and externally?

Evidence an auditor will ask for
  • Is there a communication plan recording what is communicated, when, to whom, through which channel, and by whom?
  • Does it cover external communication, including how an AI incident is communicated and who is authorised to speak?

7.5 Documented information

Is documented information (policies, records, evidence) version-controlled, protected, and retained on a defined schedule?

Evidence an auditor will ask for
  • Is AIMS documentation identified, formatted consistently, versioned, and reviewed and approved before it is issued?
  • Is it controlled for availability, distribution, access, and protection against loss of confidentiality or integrity?
  • Are retention and disposal periods defined, and is documentation of external origin such as vendor model cards and supplier attestations controlled the same way?
Clause 8 Operation

This clause tests whether Clause 6's plans ran. If risk and impact assessments only ever happened at launch, this clause fails.

8.1 Operational planning and control

Do operating criteria and controls exist across the AI system lifecycle: design, development, deployment, and monitoring?

Evidence an auditor will ask for
  • Are operating criteria documented for each lifecycle stage, and are they applied in delivery rather than kept as a reference document?
  • Are the results of those processes retained in enough detail to show the work was carried out as planned?
  • Are outsourced and vendor-supplied AI processes identified, with the mechanism you use to control them named?
  • Are unintended changes reviewed when they occur, and is action taken on any adverse effect?

8.2 AI risk assessment (operation)

Are AI risk assessments performed at planned intervals and whenever a significant change occurs, not just once at launch?

Evidence an auditor will ask for
  • Do dated records show assessments performed at the planned interval, proving the interval was met rather than intended?
  • Is there a written definition of what counts as a significant change, and evidence it triggered a reassessment at least once?

8.3 AI risk treatment (operation)

Is the AI risk treatment plan being implemented and its effectiveness verified, not just written and filed?

Evidence an auditor will ask for
  • Can you show, control by control, that the treatment plan was implemented rather than only approved?
  • Has effectiveness been verified, with a record of what was tested, when, and what the test showed?

8.4 AI system impact assessment (operation)

Are AI system impact assessments performed at planned intervals and after significant changes, with results retained?

Evidence an auditor will ask for
  • Has an impact assessment been performed for each in-scope AI system at the planned interval and after each significant change?
  • Are the results documented, retained, and made available to the people who need them for a deploy or continue decision?
Clause 9 Performance Evaluation

The second most common gap after Clause 6. An AIMS that has never been internally audited or formally reviewed cannot demonstrate it works.

9.1 Monitoring, measurement, analysis and evaluation

Do you know what needs to be monitored and measured, and do you have valid methods and a schedule for doing it?

Evidence an auditor will ask for
  • Is it documented what is monitored and measured, by which method, on what schedule, and who analyses and evaluates the results?
  • Are the methods valid, meaning they produce comparable and reproducible results when repeated over time?
  • Are results retained and used, with at least one example of a decision that changed because of what the measurement showed?

9.2 Internal audit

Is an internal audit programme running, using auditors who are objective and independent of what they are auditing?

Stage 2 cycle. Needs level 3 or above before you book Stage 2.

Evidence an auditor will ask for
  • Does a documented audit programme define frequency, methods, responsibilities, planning requirements, and reporting?
  • Have audits been conducted, with criteria and scope defined for each and results reported to relevant management?
  • Are the selected auditors objective and impartial, with nobody auditing their own work?

9.3 Management review

Does management review happen at planned intervals, cover the required inputs (nonconformities, audit results, performance trends), and produce documented decisions?

Stage 2 cycle. Needs level 3 or above before you book Stage 2.

Evidence an auditor will ask for
  • Has a review been held within the last planned interval, with top management attendance recorded?
  • Does the record cover the required inputs: status of prior actions, changes in issues and interested parties, nonconformity and performance trends, audit results, and improvement opportunities?
  • Do the outputs include decisions on improvement and on any needed change to the AIMS, each with an owner and a date?
Clause 10 Improvement

Short clause, easy to skip, hard to fake. Auditors want evidence that a nonconformity was found, corrected, and the fix verified.

10.1 Continual improvement

Does a continual improvement process exist for the management system itself, distinct from ongoing model tuning?

Evidence an auditor will ask for
  • Can you point to specific improvements made to the suitability, adequacy, or effectiveness of the management system in the last cycle?
  • Are improvement inputs tracked from their sources: audit findings, incidents, management review outputs, and staff suggestions?

10.2 Nonconformity and corrective action

Does a nonconformity and corrective action process exist, covering root cause, correction, and verification that the fix worked?

Evidence an auditor will ask for
  • Is there a register recording each nonconformity, the immediate reaction, the consequences dealt with, and the root cause analysis performed?
  • Does each record address whether a similar nonconformity exists elsewhere or could occur elsewhere?
  • Is there evidence that the corrective action was effective, and that the AIMS was updated where the cause required it?
Step 2 · Annex A, draft Statement of Applicability

Clause 6.1.3 asks for a justification for every control, included or excluded. An exclusion with no reason is the first thing a Stage 1 auditor will raise.

A.2A.2.2 AI policyA.2.3 Alignment with other organizational policiesA.2.4 Review of the AI policy
A.3A.3.2 AI roles and responsibilitiesA.3.3 Reporting of concerns
A.4A.4.2 Resource documentationA.4.3 Data resourcesA.4.4 Tooling resourcesA.4.5 System and computing resourcesA.4.6 Human resources
A.5A.5.2 AI system impact assessment processA.5.3 Documentation of AI system impact assessmentsA.5.4 Assessing AI system impact on individuals or groups of individualsA.5.5 Assessing societal impacts of AI systems
A.6A.6.1.2 Objectives for responsible development of AI systemA.6.1.3 Processes for responsible AI system design and developmentA.6.2.2 AI system requirements and specificationA.6.2.3 Documentation of AI system design and developmentA.6.2.4 AI system verification and validationA.6.2.5 AI system deploymentA.6.2.6 AI system operation and monitoringA.6.2.7 AI system technical documentationA.6.2.8 AI system recording of event logs
A.7A.7.2 Data for development and enhancement of AI systemA.7.3 Acquisition of dataA.7.4 Quality of data for AI systemsA.7.5 Data provenanceA.7.6 Data preparation
A.8A.8.2 System documentation and information for usersA.8.3 External reportingA.8.4 Communication of incidentsA.8.5 Information for interested parties
A.9A.9.2 Processes for responsible use of AI systemsA.9.3 Objectives for responsible use of AI systemA.9.4 Intended use of the AI system
A.10A.10.2 Allocating responsibilitiesA.10.3 SuppliersA.10.4 Customers
ImplementedPartlyNot yetExcludedUndecided
A.2 Policies related to AI

A.2.2 AI policy

A.2.3 Alignment with other organizational policies

A.2.4 Review of the AI policy

A.3 Internal organization

A.3.2 AI roles and responsibilities

A.3.3 Reporting of concerns

A.4 Resources for AI systems

A.4.2 Resource documentation

A.4.3 Data resources

A.4.4 Tooling resources

A.4.5 System and computing resources

A.4.6 Human resources

A.5 Assessing impacts of AI systems

A.5.2 AI system impact assessment process

A.5.3 Documentation of AI system impact assessments

A.5.4 Assessing AI system impact on individuals or groups of individuals

A.5.5 Assessing societal impacts of AI systems

A.6 AI system life cycle

A.6.1.2 Objectives for responsible development of AI system

A.6.1.3 Processes for responsible AI system design and development

A.6.2.2 AI system requirements and specification

A.6.2.3 Documentation of AI system design and development

A.6.2.4 AI system verification and validation

A.6.2.5 AI system deployment

A.6.2.6 AI system operation and monitoring

A.6.2.7 AI system technical documentation

A.6.2.8 AI system recording of event logs

A.7 Data for AI systems

A.7.2 Data for development and enhancement of AI system

A.7.3 Acquisition of data

A.7.4 Quality of data for AI systems

A.7.5 Data provenance

A.7.6 Data preparation

A.8 Information for interested parties of AI systems

A.8.2 System documentation and information for users

A.8.3 External reporting

A.8.4 Communication of incidents

A.8.5 Information for interested parties

A.9 Use of AI systems

A.9.2 Processes for responsible use of AI systems

A.9.3 Objectives for responsible use of AI system

A.9.4 Intended use of the AI system

A.10 Third-party and customer relationships

A.10.2 Allocating responsibilities

A.10.3 Suppliers

A.10.4 Customers

Your readiness

Rate at least one requirement to see your result. The full report writes itself out once every requirement is rated.

Related governance tools

To check the evidence under each requirement question by question, use the ISO 42001 AIMS Readiness Checklist. To see how the controls sit in an agentic retrieval pipeline, read the Governed Agentic RAG reference architecture, which maps each component to a clause or Annex A control. If the system may also fall under the EU AI Act, use the EU AI Act Risk Classifier.

Terence Kok
Before You Go

The question I am asked most before a 42001 assessment is how close we are, and a percentage of boxes ticked never answers it. What answers it is the distance between a procedure that has been approved and the records that show it running, because that distance is what an auditor grades. Rate yourself at the lower of two levels whenever you hesitate. The gaps that matter at Stage 1 are almost always the same few documents, and the one that matters at Stage 2 is whether internal audit and management review have actually run once.

Terence Kok

Last updated 29 Oct 2026

More in Board and governance

Next in this group · AssessmentEU AI Act Risk ClassifierDoes the EU AI Act apply to this AI system, and what does it require of us?Classify your system →
← All 9 in Board and governance