What Is an ISO 42001 Gap Analysis?
An ISO 42001 gap analysis measures the distance between your current AI governance and the requirements of ISO/IEC 42001:2023, which is a management system standard, not an AI security standard.
So the review goes past security controls into accountability, risk, impact on people, data, suppliers and how the system gets audited.
The question isn’t “do we have a policy?” It’s whether your AIMS is properly designed, actually implemented, operating consistently and able to produce evidence.
A gap analysis usually runs in six steps: confirm scope and inventory, review documents, interview owners, sample records, rate each area, agree priorities.
Gap Analysis vs Readiness Assessment vs Internal Audit vs Certification Audit
The internal audit (ISO/IEC 42001, clause 9.2) and the certification audit (ISO/IEC 17021-1, ISO/IEC 42006) are defined by standards. The other two are industry terms that firms use differently. Here’s how we use them.
When Should You Conduct an ISO 42001 Gap Analysis?
Earlier than feels necessary. The useful moments:
- •You’re starting ISO 42001 and need a baseline.
- •AI is already live and governance grew up informally.
- •You’re about to book a certification body.
- •You hold ISO 27001 or run another management system.
- •Your AI use has changed: new use case, model, data or role.
- •Third-party or generative AI tools arrived faster than policy.
What Should an ISO 42001 Gap Analysis Check?
Clauses 4 to 10, plus the Annex A controls your risk treatment calls for. Annex A lists 38 reference controls in nine areas; your Statement of Applicability (SoA) justifies each inclusion and exclusion.
Clause numbers mark ISO requirements. “VISTA” marks our own method. The rest is good practice.
| AIMS Area | Documented | Implemented | Operating | Evidence to Look For |
|---|---|---|---|---|
| AI inventory | Inventory procedure | Systems listed with owners | Updated as tools change | Change history; review dates |
| AI risk assessment | Method and criteria | Done for in-scope systems | Repeated at intervals and on change | Register versions; residual-risk approvals |
| AI system impact assessment | Process and triggers | Completed per system | Re-run after significant change | Signed assessments linked to risks |
| Supplier AI | Supplier requirements | Due diligence before onboarding | Periodic supplier reviews | Questionnaires; contract clauses; minutes |
| Monitoring | Metrics and thresholds | Live in production | Alerts investigated and escalated | Logs; incident tickets; trends |
| Internal audit | Audit programme | Audit performed | Findings tracked to closure | Audit report; corrective-action records |
A level 1 gap is a writing job. Levels 3 and 4 take calendar time: operating evidence exists only once the process has run.
The AI Governance Traceability Test
The AI Governance Traceability Test is a VISTA practical assessment technique, not an ISO/IEC 42001 requirement. Pick one AI system and follow the thread:
Take a customer-support assistant built on a third-party large language model.
- •System, owner:inventoried; Head of Support owns it.
- •Intended use:drafts replies for agents; never sends them.
- •Risk:fabricated answers; customer data reaching the supplier.
- •Impact:customers act on wrong refund advice.
- •Control:agent approval before sending; contractual limits on data use.
- •Evidence:approval logs; signed supplier terms.
- •Monitoring:monthly accuracy sampling of drafts.
- •Review/decision:quarterly review; decision to stay draft-only recorded.
If the thread breaks, you’ve found a gap, even when every document exists. Policies, spreadsheets and risk registers that don’t connect tell different stories, and auditors follow trails like this.