Governance · AI governance and assurance · 02
ISO/IEC 42001 readiness
ISO/IEC 42001 readiness prepares an organization for certification against the international standard for AI management systems: the scope and context, the AI policy and objectives, the risk and impact assessments, the controls in Annex A, the lifecycle processes and the records that show the system operates. It is needed when a customer or market asks for the certificate, when the organization provides or uses AI in ways that carry consequence, when a security management system under ISO/IEC 27001 already exists and leadership wants AI governed to the same standard, or when a first certification is planned. Readiness produces a gap assessment against every clause and control, the documentation written to actual practice, the evidence the auditor will sample, and the internal audit and management review completed before certification.
Scope
What the review covers.
- Scope, context and the AI systems and roles covered
- AI policy, objectives and roles under the management system
- AI risk assessment and AI system impact assessment
- Annex A controls selected and implemented
- Lifecycle processes: data, development, deployment, monitoring, decommissioning
- Records: internal audit, management review, incidents, supplier management
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Gap assessment | Clause by clause and control by control |
| Documentation set | Policy, procedures, assessments, Statement of Applicability |
| Evidence pack | Organized for the certification audit |
| Internal audit and management review | Completed and recorded |
| Audit support | Available during certification |
Prerequisites
What we need from you.
- The AI use inventory, or agreement to build it first
- A management sponsor and an internal owner for the system
- Decision on certification scope and body, or support choosing them
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Can this integrate with our ISO/IEC 27001 system?
Yes, and it should. The standards share structure, and an integrated system avoids duplicating governance.
Do you perform the certification audit?
No. Certification is performed by an accredited body. We prepare you and support you, and our independence from the certifier is part of the value.
We use AI but do not build it. Does the standard apply?
Yes. The standard covers organizations that develop, provide or use AI systems. Scope determines which controls apply.