ISO/IEC 42001 Gap Assessment
Find out how far your AI governance is from ISO/IEC 42001, system by system, before you commit to a full implementation.
An ISO/IEC 42001 gap assessment compares what you already do with what the standard requires. You get a list of gaps, a plan to close them, and a realistic date for audit readiness. Most of our clients start here, because the result decides the scope, the cost and the timeline of everything that follows.
What we assess
| Area | What we look at | ISO/IEC 42001 reference |
|---|---|---|
| AI system inventory | Every AI system you build, buy or extend, with its owner, data and risk tier | Clause 4.3, A.4 |
| Context and scope | Your role for each system: developer, provider or user, and the boundary of the AIMS | Clauses 4.1 to 4.4 |
| Leadership and policy | The AI policy, roles, and who signs off risk | Clause 5, A.2, A.3 |
| Risk and impact | How you assess AI risks and the impact of AI systems on people | Clauses 6.1.2 to 6.1.4, A.5 |
| AI life cycle | Requirements, design, testing, release, monitoring and logs for each system | A.6 |
| Data | Data sources, quality, provenance and preparation | A.7 |
| Users and suppliers | Information for users, responsible use, and oversight of AI vendors | A.8, A.9, A.10 |
| Performance and improvement | Monitoring, internal audit, management review and corrective action | Clauses 9 and 10 |
We also check AI security against ISO/IEC 27090 and, where it applies to you, the CERT-In AI Security Auditing Guidelines.
What you get
- A gap report. Each clause and Annex A control rated as met, partly met or not met, with the evidence we saw.
- A draft Statement of Applicability. Which Annex A controls apply to you, and why.
- A plan with owners and dates. The work needed to reach audit readiness, in the order it should happen.
- A fee and timeline for implementation. Based on your real gaps, not on a guess.
- A list of what you can reuse. Most organisations with ISO/IEC 27001 already meet a large part of the standard.
How it runs
- Scoping call. A 30 minute call to agree the AI systems in scope.
- Document review. We read your policies, procedures and records before we meet your teams.
- Interviews and walkthroughs. We speak to system owners, developers, risk, security and procurement.
- Report and readout. We present the gaps and the plan to the sponsor and the system owners.
A gap assessment usually takes two to four weeks, depending on the number of AI systems in scope.
Why start with a gap assessment
ISO/IEC 42001 is assessed per AI system. Two organisations of the same size can need very different effort, because one has records of how its systems were built and run and the other does not. A gap assessment shows which case you are in. For KPMG in India, the existing ISMS, security reviews and privacy impact assessments covered much of the standard, and the implementation took about seven weeks. Read the KPMG case study.
Frequently asked questions
Is the gap assessment part of the implementation fee?
You can buy it on its own. If you go on to implementation with us, we credit the work already done, so you do not pay twice for the same analysis.
Can we do the gap assessment ourselves?
Yes. Our free ISO/IEC 42001 gap check takes about 15 minutes and includes an optional AI security check against ISO/IEC 27090. If CERT-In applies to you, also try the CERT-In self assessment. An external assessment adds an auditor’s view of the evidence, which is where most first audits find problems.
Do you also certify us?
No. Certification comes from an accredited certification body. We prepare you for that audit and stay independent of the body you choose.
Book a gap assessment
Request a call back, write to Sandhya Khamesra or call +91 120 432 3179. See also our ISO/IEC 42001 consulting and ISO 42001 consulting in Delhi NCR.
Talk to an ISO/IEC 42001 consultant
Leave your details and we will call you back to discuss your scope. No obligation.