Resources · Tool
ISO 42001 Readiness Check
Seventeen questions mapped to clauses 4 through 10 of ISO/IEC 42001:2023 and its Annex A controls. It returns a gap list ordered by audit exposure (where a certification body would raise a major) with the specific evidence each clause requires. It is a self-assessment, and the difference from a certification opinion matters.
Everything below runs in your browser. Nothing you enter is sent to us, stored, or logged, and closing the tab discards it. Answer as an auditor would find things, not as you intend them to be. The tool is only useful at the level you would be tested.
Clause 4 · Context of the organisation · 1 of 2
UNIT 01Do you know which of your activities count as AI, who cares about them, and where you have drawn the boundary of the management system?
Gap list
UNIT 10
What this is and is not
UNIT 11This is a self-assessment. It is not certification, not a Stage 1 audit, and not a substitute for either. A certification body forms its opinion from evidence (records, interviews, and what it observes on site) and none of that is visible here. What the tool can tell you is which clauses you would struggle to evidence, which is exactly the list worth having before you spend money on an external audit.
The weighting reflects audit exposure, whatever the effort. Clauses 5, 6.1.2–6.1.3, 6.1.4, 8 and 9 carry the highest weight because they are where major nonconformities are most often raised: leadership and policy, the risk and impact assessment machinery, evidence that the machinery is actually operating, and evidence that somebody is checking it.
One pattern is worth naming in advance. Organisations arriving at 42001 from ISO 27001 tend to score well on clauses 4, 5, 7 and 10, because the harmonised structure is familiar, and then find their gap concentrated at 6.1.4, the AI system impact assessment. That clause has no equivalent in 27001. It asks about consequences for the people affected by the system, where 27001 asks about risks to the organisation, and it is the requirement that makes 42001 a different standard from an extension of an existing one.
Orion Five holds an ISO/IEC 42001 Lead Auditor credential, which is why this tool exists in this form. It is also why the paragraph above says plainly what the tool cannot do.
Technical references
UNIT 12What the reasoning on this page is drawn from. Where a standard costs money to read it is marked, and where a free document covers the same ground better it is listed first.
- ISO/IEC 42001:2023Paid standardISOThe AI management system standard itself. Clause structure 4 to 10 plus Annex A controls, the thing our readiness check is mapped against.
- ISO 42001 explainedISOISO's own free summary. The right first read if you are deciding whether certification is relevant before buying the standard.
Links open in a new tab so anything you have entered above survives. Every one was checked at build time; if one has rotted since, tell us and it comes out rather than getting patched from memory.
Every one of these tools is a compressed version of a conversation. If yours turned up something you would rather talk through than read about, that is what the scoping call is for — bring your result with you.
Also on the shelf
- Tool
Readiness assessment
Score a proposed integration across the five dimensions that decide whether it survives contact with a plant floor, and find out which one is your binding constraint.
- Tool
Payback calculator
Work out the recoverable hours, the build cost band and the payback period on a process you are thinking of automating, including the case where the answer is don't.
- Tool
Scope estimator
Describe the equipment, the sites and the compliance load, and get the complexity band, the ranked cost drivers and an engineering duration range.