ISO/IEC 42001 Gap Check

ISO/IEC 42001 Gap Check, with ISO/IEC 27090 AI security

Answer about 30 questions on the clauses and Annex A controls of ISO/IEC 42001. Add 9 questions on the AI attacks in ISO/IEC 27090 if you want the security view. You get readiness by area and your top gaps in about 15 minutes. Everything runs in your browser and nothing is sent to us.

About you

These answers shape the results. They are kept only in this browser.

Organisation or system name (optional) Your role for AI

Do you hold ISO/IEC 27001? How many AI systems are in scope?

Management system: clauses 4 to 10

Answer Yes only where you have evidence an auditor could see. Use Partly where work has started.

Annex A controls

One question per group of controls. Mark Not applicable only where you would exclude the control in your Statement of Applicability.

AI security: the nine attacks in ISO/IEC 27090

Include the AI security check. ISO/IEC 27090:2026 names nine ways an AI system can be attacked. ISO/IEC 42001 expects you to control them through Annex A. Skip this step if you only want the ISO/IEC 42001 view. See the ISO/IEC 27090 map.

Your results

Want an auditor's view of the evidence? This check is a self assessment. Our ISO/IEC 42001 gap assessment reviews your documents and records system by system, and gives you a plan, a draft Statement of Applicability and a firm timeline. KPMG in India went from start to SGS certification readiness in about seven weeks with us.
Book a gap assessment Or write to Sandhya Khamesra

Clause and control numbers refer to ISO/IEC 42001:2023 and ISO/IEC 27090:2026. This check is a reading aid prepared by Pricoris LLP, not an audit opinion or certification advice. It runs entirely in your browser, uses no cookies or tracking, and stores your answers only in this browser so you can return to them. See also the CERT-In AI security self assessment, ISO 42001 documents required and ISO 42001 certification bodies in India.