Skip to main content
Orion Five Engineering

10 Jalan Kilang #04-05, Singapore 159410
+65 6100 5505

Book a scoping call

Resources · Tool

ISO 42001 Readiness Check

Answer seventeen questions covering clauses 4 to 10 of ISO/IEC 42001:2023 and its Annex A controls. The check lists your gaps in order of audit risk, starting with those where a certification body would raise a major nonconformity. It also shows the evidence each clause requires. This is a self-assessment, not a certification opinion.

A machined steel embossing seal press closed on the corner of a sheet of thick cotton paper, raising a blind-embossed circular impression with nothing written in it.
Takes
8 minutes
You get
A clause-by-clause gap list, ranked by audit exposure
Cost
Free, no sign-up

This tool runs entirely in your browser. Nothing you enter is sent to us, stored or logged. Closing the tab deletes it. Answer based on what an auditor would find today, not on what you plan to have in place. The result is only useful if your answers match the evidence an auditor would test.

ISO/IEC 42001 clause structureFour boxes in a row labelled Plan, Do, Check and Act, following the management system cycle. Plan holds clause 4 context, clause 5 leadership and clause 6 planning. Do holds clause 7 support and clause 8 operation. Check holds clause 9 performance evaluation. Act holds clause 10 improvement. An arrow returns from Act back to Plan to show the cycle repeating. Clause 6.1.4, the AI system impact assessment, is called out separately as the requirement with no ISO 27001 equivalent.Plan4 Context5 Leadership · 6 PlanningDo7 Support8 OperationCheck9 Performance eval.Act10 Improvementthen repeat: the standard is a continuous cycle with no end date6.1.4: AI system impact assessmentno ISO 27001 equivalent, and where most gaps are found
Clauses 4 to 10 in the order an auditor reviews them. At clause 8, the auditor checks whether the plans from clause 6 are in use. At clause 9, the auditor checks whether anyone has been monitoring performance.

Clause 4 · Context of the organisation · 1 of 2

UNIT 01

Do you know which of your activities count as AI, who has an interest in them, and which systems the management system covers?

Is there a written scope saying which AI systems the management system covers?

The scope should also state clearly what is outside it. An undefined scope is the most common first finding in an audit.

Gap list

UNIT 10
ANSWER ALL 17 QUESTIONS TO SEE THE GAP LIST

Limits of this check

UNIT 11

This is a self-assessment. It is not a certification or a Stage 1 audit, and it cannot replace either. A certification body bases its opinion on evidence: records, interviews and what it observes on site. This tool cannot see any of that. It can show you which clauses you would find hard to provide evidence for. You should have that list before you pay for an external audit.

The weighting reflects audit risk, not the effort to fix each gap. Clauses 5, 6.1.2–6.1.3, 6.1.4, 8 and 9 carry the highest weight. Auditors raise major nonconformities most often in these areas: leadership and policy, the risk and impact assessment process, evidence that the process operates, and evidence that someone checks it.

We often see one pattern. Organisations that already hold ISO 27001 tend to score well on clauses 4, 5, 7 and 10, because the shared structure is familiar. Their gaps are usually at clause 6.1.4, the AI system impact assessment. This clause has no equivalent in 27001. It asks about the consequences for people affected by the AI system, while 27001 asks about risks to the organisation. This requirement is the main reason 42001 is a separate standard and not an extension of an existing one.

Orion Five holds an ISO/IEC 42001 Lead Auditor credential, and we designed this tool on that basis. For the same reason, we state clearly what the tool cannot do.

Technical references

UNIT 12

These are the sources for the reasoning on this page. We mark standards that you must pay to read. Where a free document covers the same subject better, we list it first.

Links open in a new tab, so you do not lose anything you have entered on this page. We checked every link when we built the page. If a link no longer works, please tell us and we will remove it.

Each of these tools is a short version of a conversation with one of our engineers. If your result raised a question you want to discuss, book a scoping call and bring your result with you.

Talk to a certified ISO 42001 lead auditor

More resources