The ISO 42001 readiness checklist for AI companies

1. Scope and the AI you actually use

You cannot govern what you have not listed. Auditors start here.

• You can list every Artificial Intelligence (AI) system you build, operate or materially rely on, including third-party models and the AI features inside your SaaS tools.
• For each system you know its purpose, its users and whether it can affect people's rights, safety, money or access to services.
• You have written down which systems your AI Management System (AIMS) covers, and why the others are excluded.
• For each system you know whether you are the provider, the deployer or both. The EU AI Act turns on the same distinction.
• Interested parties (customers, regulators, affected individuals, staff) and what they expect of your AI are recorded.

2. Leadership and the AI policy

Responsible AI is a leadership commitment before it is a technical practice.

• An AI policy exists, is approved and dated by leadership, aligns with your security and privacy policies and is available to everyone.
• A named person owns AI governance, with enough authority to delay or stop a launch.
• Responsibilities for AI risk, data, development and monitoring are assigned to people, not to departments.
• Objectives for responsible AI exist, are measurable, have owners and get reviewed.
• Leadership can explain why the company wants ISO/IEC 42001 beyond having a badge before competitors do.

3. AI risk assessment

The familiar risk engine, pointed at less familiar failure modes.

• A documented AI risk assessment covers each in-scope system and is reviewed on a schedule and whenever systems change.
• The risks considered include bias and discrimination, privacy, security, robustness, hallucination, misuse and overreliance on outputs.
• Risk criteria weigh harm to individuals and society, not only harm to the business.
• Each risk has an owner, a score and a treatment decision, and accepted risks are signed off by someone entitled to accept them.
• Changes to models, prompts, training data or providers trigger reassessment, and you can show it happening.

4. AI system impact assessment

The requirement that most distinguishes ISO 42001 from ISO 27001: assessing consequences for the people the system touches.

• An impact assessment exists for each in-scope system, considering effects on individuals and on groups.
• It covers reasonably foreseeable misuse, not only the intended use.
• Vulnerable users and groups are explicitly considered.
• Its outcomes visibly feed the risk assessment and design decisions.
• It is revisited when the system, its data or its context changes.

5. The AI system lifecycle

Auditors follow one system from idea to retirement. Pick your main one and walk this path.

• Requirements, including responsible-AI requirements, are documented before development starts.
• Design and development records capture data sources, model choices and evaluation criteria.
• Systems are tested before release for performance and safety, and for bias and fairness where relevant, with results kept.
• Changes to models, prompts and thresholds go through a controlled, recorded process.
• Production systems are monitored for drift, errors and misuse, and problems flow into your incident process.
• Retirement is planned: what happens to the data, and how users are told.

6. Data and third-party AI

Most startups deploy other people's models. The governance travels with the supply chain.

• The provenance of any training or fine-tuning data is known and lawful.
• Quality criteria exist for data feeding your AI, and someone checks them.
• Third-party AI providers are listed and risk-assessed, and their terms have been read, including whether your data trains their models.
• Contracts and data processing agreements reflect the AI use where personal data is involved.
• You know where prompts and outputs are stored, for how long and in which jurisdiction.

7. Transparency, oversight and people

The controls that keep humans meaningfully in charge.

• People know when they are interacting with AI or with AI-generated content, wherever that matters.
• Consequential decisions have meaningful human oversight, and the humans can genuinely override the system.
• Staff who build or use AI are trained on its capabilities, limits and acceptable use, and an acceptable-use policy exists.
• People affected by your AI have a route to question or complain about an outcome, and it works.
• What your marketing says about your AI matches what the system actually does.

8. Monitoring, internal audit and management review

The clauses that prove the AIMS runs, rather than merely exists.

• You measure something meaningful about AI governance performance, and the measures drive behaviour you want.
• An internal audit of the AIMS has been performed by someone independent of the work, with a report.
• Findings have corrections, root causes and corrective actions, with evidence of closure.
• Management review covers the required inputs, including changes in AI risk, and produces decisions.
• AI incidents and near misses are captured and learned from.

9. Certification audit preparation

ISO 42001 is young: accredited certification bodies are still few, which cuts both ways.

• You have quotes from certification bodies offering accredited ISO 42001 audits, booked early because capacity is scarce.
• The AIMS has run long enough to produce real records, not documents written last week.
• The people who own AI controls can each speak to their part without a script.
• If you hold ISO 27001, the shared management system clauses are integrated rather than duplicated.
• An independent readiness or internal audit has been done, so Stage 2 holds no surprises.

What to do with the gaps

Anything unticked is normal: certified AI governance is new for almost everyone. If you want a prioritised, fixed-price plan for closing the gaps, book a free introductory call or try the cost calculator to get a tailored estimate. The ISO 42001 consultancy page explains how we work.