ISO 42001 gap analysis: how to find out where you stand now

An ISO 42001 gap analysis checks your current AI practice against the requirements of ISO/IEC 42001. For each clause, you record what already exists, what is missing and which evidence is available. That gives you a realistic basis for an implementation plan. Start with your AI inventory and the EU AI Act as the legal framework, and only then work on the step-by-step plan.

Why start with a gap analysis?

Without a gap analysis, you start with a list of things that “still need to be done”. That leads to a policy nobody follows, a register that is out of date after two weeks and an audit that stalls on the first day. A gap analysis shows which requirements you already largely meet, so you do not do the same work twice. It also shows which requirements are missing entirely, so you can plan the heavy parts early.

The gap analysis is also the document you will need later for the scope of your AI management system. You must justify anything you leave out of scope. A good gap analysis makes that choice visible.

For the legal side, refer to the EU AI Act in your gap analysis. The standard and the law overlap, but they are not the same. See ISO 42001 vs EU AI Act for the difference.

The method in five steps

Define the boundaries. Decide which parts of the organisation and which AI systems fall within scope. Use the AI inventory as your starting point. You cannot assess anything without a list of systems.
Test per clause. Go through clauses 4 to 10 and the relevant Annex A controls. For each item, ask: is it there, does it work, and can I demonstrate it?
Collect evidence. A policy without evidence does not count. Look for the minutes, the register, the audit report or the logging that shows it works.
Score. Use one fixed scale, for example: meets, partly, missing. Write a short explanation with each score.
Make a plan. Turn each gap into an action, an owner and a date. Sort by impact and by dependency.

A gap analysis is not an audit. You do not assess whether you are ready for certification. You assess where the difference lies between what exists and what the standard requires. Preferably, have someone do it who did not build the system themselves.

The fill-in form per clause

The table below is a working method you can use directly. Fill it in per clause and keep track of the source of evidence.

Clause	Question to ask	Evidence to look for	Score
4 Context	Have we mapped the external and internal factors and the interested parties?	Context document, list of interested parties	meets / partly / missing
5 Leadership	Has top management adopted an AI policy and assigned the roles?	Signed policy, role descriptions
6 Planning	Have AI risks been identified, assessed and treated?	Risk register, impact assessments
7 Support	Have competence, awareness and document control been arranged?	Training records, document list
8 Operation	Are AI development and use carried out according to the process?	Process description, release files
9 Performance evaluation	Do we measure performance and carry out internal audits?	Monitoring reports, audit programme
10 Improvement	Do we act on deviations and learn from them?	Nonconformity register, corrective actions
Annex A	Which controls apply and which do not?	Statement of Applicability (SoA)

The evidence column is the most important one. If you cannot name anything for a clause, the score in practice is “missing”, even if someone says it “does happen”.

Example: a software company with 40 employees

Suppose the fictional company Example Software uses an AI assistant in its own production. It also supplies a scoring model to customers. The gap analysis produces the following findings:

Component	Score	Explanation	Action
AI policy	partly	There is a policy, but it dates from before the scoring model and does not mention it	Revise the policy and have top management adopt it
AI register	missing	Systems are scattered across wikis and tickets	Build a register with an owner per system
Risk assessment	partly	Risks for the scoring model have been assessed. Risks for the assistant have not	Extend the risk assessment
Impact assessment	missing	Never carried out for the scoring model	Plan an impact assessment
Suppliers	meets	Contracts with the model supplier contain data processing agreements	Record an annual reassessment
Internal audit	missing	No audit programme yet	Draft a programme for the first year

The result is not a score of 70 per cent. It is a list of six actions with owners. That is useful. A percentage says little if nobody knows what needs to happen.

What auditors most often see as a gap

These gaps occur most often in practice. Check them first.

No complete AI register. Systems that run in practice but are not in the register are the most common finding.
An impact assessment that exists but does not cover the whole lifecycle. See AI impact assessment.
Policy without an owner. If nobody knows who maintains the policy, it is out of date after a year.
Suppliers that are not assessed. Use the supplier management approach to close this gap.
A Statement of Applicability that does not match reality. Controls marked as applicable that cannot be shown to work stand out.
No feedback from monitoring to risks. Changes in model performance should lead to an updated risk assessment.

You can read more about common mistakes on common mistakes.

From gap analysis to implementation plan

Use the outcome as input for your implementation plan. Put the gaps in order of dependency. An AI register and a risk assessment are preconditions for almost everything else, so they come first. An internal audit comes only once the rest is in place.

For a small organisation, the gap analysis is often a day or two of work. For a larger organisation with several AI systems, it takes longer. In that case, it can make sense to hand this phase to a consultant. Read guidance on ISO 42001 for what you can expect from a consultant. The costs of the whole process are on costs and timeline.

Checklist for your own gap analysis

Scope and system list have been set
Each clause 4 to 10 has been assessed with a score
Each score has an evidence source or the note “no evidence”
Relevant Annex A controls have been assessed
Each gap has an owner and a date
The outcome has been discussed with top management
The analysis is dated and is repeated before the certification audit

Common doubts

Can I do the gap analysis myself? Yes, if you choose someone who did not set up the system. The chance of an honest score is then greater. Do record the scores with evidence, otherwise it becomes a list of opinions.

How often should I repeat it? Do it at the start. Then repeat it before each certification audit and after each major change to your AI systems. A gap analysis from two years ago says little about your current situation.

What if almost everything is “partly”? That is normal for a first analysis. Look at which gaps block most other requirements, for example the register or the risk assessment. Tackle those first, and the rest often follows.

Do I have to score every Annex A control? No. Score the controls you expect to apply, and record for each excluded control why you exclude it. Justifying that is the real work. Scoring itself is the smallest step.