ISO 42001 checklist: the evidence an auditor wants to see for every requirement

An ISO 42001 checklist only works if you note the evidence for each requirement. An auditor does not ask whether you “have a policy”. They ask where the policy is, who approved it and when it was last reviewed. This checklist links the requirements of ISO/IEC 42001 and the Annex A controls to the documents and records you show during the certification audit.

How do you use this checklist?

Work through the checklist after your gap analysis and before the certification audit. For each line, give one of three answers: in place and demonstrable, in place but not demonstrable, or missing. Only the first category counts as evidence.

Use a shared folder or a register with a link for each piece of evidence. That way the auditor can find it without you spending twenty minutes searching.

A checklist is a tool, not evidence. The evidence sits in the documents and records themselves. Never tick something off based on a conversation or a promise.

Clauses 4 to 10

This table follows the chapters of the standard. The “evidence” column contains the documents an auditor would normally ask for.

Clause	Check question	Evidence you show	Tick
4.1 Context	Have you recorded the internal and external factors that affect the AI system?	Context document with date and owner	[ ]
4.2 Interested parties	Do you know who has an interest in your AI systems and what they expect?	List of interested parties with their expectations	[ ]
4.3 Scope	Is the scope of the AIMS recorded and justified?	Scope document with exclusions and reasons	[ ]
4.4 The AIMS	Is the system set up, maintained and improved?	Process overview, reference to the system	[ ]
5.1 Leadership	Does top management show commitment to the AIMS?	Minutes, decisions, budget decision	[ ]
5.2 AI policy	Is there a policy that has been approved and communicated?	Signed policy with date and distribution	[ ]
5.3 Roles	Are responsibilities assigned?	Role descriptions or RACI matrix	[ ]
6.1 Risks and opportunities	Have AI risks and opportunities been identified and assessed?	Risk register with assessment and treatment	[ ]
6.1.4 Impact assessment (plan)	Is there a process to assess the effects of AI systems on people and society?	Impact assessment process description	[ ]
6.2 Objectives	Are there measurable objectives with a plan to achieve them?	List of objectives with measurement method and owner	[ ]
6.3 Changes	Do you plan changes to the AIMS deliberately?	Change report, decision	[ ]
7.1 Resources	Is enough capacity and infrastructure available?	Overview of resources and budget	[ ]
7.2 Competence	Do you know who needs to be able to do what, and can you show it?	Competence matrix, training records	[ ]
7.3 Awareness	Do employees know what the policy asks of them?	Awareness programme, evidence of participation	[ ]
7.4 Communication	Is it recorded what you communicate about the AIMS, when and with whom?	Communication plan	[ ]
7.5 Documented information	Is there a managed document system with versions?	Document list with version and owner	[ ]
8.1 Operational planning	Is the process for building and deploying AI described?	Process description, release files	[ ]
8.2 AI risk assessment	Has a risk assessment been carried out for each system?	Assessment per system, date	[ ]
8.3 Risk treatment	Have the chosen treatments been carried out and recorded?	Treatment plan with status	[ ]
8.4 Impact assessment	Has the impact on people and society been assessed?	Impact assessment per system	[ ]
9.1 Monitoring and measurement	Do you measure whether the system works as intended?	Monitoring reports, performance data	[ ]
9.2 Internal audit (9.2.1 and 9.2.2)	Is there an audit programme and have audits been carried out?	Audit programme, audit reports	[ ]
9.3 Management review	Does top management review the AIMS periodically?	Management review report	[ ]
10.1 Continual improvement	Does the system demonstrably improve?	Improvement plan, closed actions	[ ]
10.2 Nonconformities and corrective actions	Are nonconformities recorded, analysed and resolved?	Nonconformity register with cause and status	[ ]

The numbering follows the chapter structure of ISO/IEC 42001:2023 (checked against a public table of contents, not the paid standard). Check the exact wording in the standard itself before you use it in an official document.

Annex A: choose and justify per domain

Annex A contains the controls. You do not have to implement all of them, but for each control you must be able to say whether it applies and why. You record that choice in the statement of applicability (Verklaring van Toepasselijkheid, SoA).

Domain	Check question	Evidence
AI policies	Is the AI policy approved and aligned with the strategy?	Policy with approval
Internal organisation	Are roles and responsibilities for AI named?	Role descriptions
Resources for AI systems	Are data, tooling and staff known and managed?	Overview of resources
Assessing AI systems	Are the effects of systems assessed before they go live?	Assessment reports
Lifecycle of AI systems	Is there a process from design to decommissioning?	Process description, change log
Data for AI systems	Are the origin and quality of training data recorded?	Data list with origin
Information for interested parties	Do users and those affected know what the system does?	User information
Use of AI systems	Is use recorded and are boundaries monitored?	Usage rules
Third-party relationships	Are suppliers and partners assessed?	Supplier assessments

For the content of each domain, read Annex A controls. More about suppliers is on supplier management.

What an auditor most often cannot verify

These are the points where the checklist most often goes wrong, because the evidence is missing or out of date.

A policy dated two years ago, with no evidence that it has been reviewed. See common mistakes.
A risk register that does not match the AI register. Systems that appear in one list but not the other stand out.
Management reviews that are not recorded. A conversation without minutes does not count.
Competences without records. A training you gave but did not record does not exist for the auditor.
Nonconformities closed without a root cause analysis. The evidence of correction must also show why things went wrong.

Checklist for the week before the audit

All documents in the checklist have a date and an owner
The AI register and the risk register match each other
The latest internal audit and its report are complete
Nonconformities are in the register with their status
The statement of applicability matches what actually works
An employee can explain where the evidence is kept

For the timeline of the audit itself, read preparing for the ISO 42001 audit.

Common doubts

Do I have to implement all Annex A controls? No. For each control you must be able to say whether it applies and why not. A justified exclusion is better than a control that exists on paper but does not work.

In Excel or in a tool? Either works. What matters is the chain of evidence: each line has a reference, a date and an owner. A spreadsheet that keeps track of this is enough for a small organisation.

How often do I update the checklist? At least before each audit and after every major change to an AI system. Put a fixed date in your calendar, otherwise the evidence goes out of date unnoticed.

May I skip a requirement if we do not need it? Only if the requirement is demonstrably not applicable to your scope. Record that in the scope document. Skipping a requirement because it is difficult does not work.