ISO 42001 gap analysis: what Sterling examines in your AI governance, what you receive, and what happens next

Readiness check, gap analysis or Stage 1: which is which?

The ISO/IEC 42001 readiness check is a free online questionnaire of weighted questions that returns a score and first priorities, based only on what you report. The gap analysis is Sterling's first engagement stage, where our consultants look at the evidence themselves. Stage 1 belongs to the certification body and comes after implementation; the Stage 1 and Stage 2 guide describes it.

What an ISO 42001 gap analysis examines

The yardstick is the 2023 edition, the first and only one published. Every finding is tied to a requirement clause or to one of the nine Annex A control groups, from A.2 policies related to AI to A.10 third-party and customer relationships. Six areas are examined.

The AI systems themselves

Before anything else we establish which AI systems exist, which of them the certificate should cover and whether you develop, provide or use each one. Departmental tools, features switched on inside existing software and unregistered model interfaces often surface here, and an incomplete inventory undermines every later assessment. The ISO/IEC 42001 scope guide covers how to settle the boundary.

Governance documents

Any AI policy or statement of principles, how it relates to the security, privacy and quality policies you already hold, the roles assigned for AI, and the objectives set for it. We check they are approved, controlled and used, not merely published.

Risk and impact practice

How AI risks are identified and rated today, whether the method would give consistent, comparable results if repeated, and whether anyone has considered what a system could do to individuals, groups or society, including through foreseeable misuse. We also look at whether controls are compared against Annex A and whether anything resembling a Statement of Applicability exists. The method itself is explained in the AI risk assessment guide and the impact assessment guide.

Life-cycle and data records

Requirements, design decisions, verification and validation results, deployment approvals, monitoring and event logs; for data, where it came from, how its quality was checked and how it was prepared. Records outweigh documents, because they cannot accurately be produced after the event.

Suppliers and customers

A third-party model still needs responsibilities allocated, so we read supplier contracts and documentation, and what you tell customers about intended use and limitations.

People and competence

Competence of those who design, deploy and oversee AI, staff awareness of the policy and of how to report a concern, and whether AI is a standing management agenda item.

How the evidence is gathered

1. Document request. You share what already exists: policies, an inventory if you have one, risk registers, model or system documentation, supplier terms and a few recent records. We read them before meeting anyone.
2. Opening session with leadership. Why the certificate is needed, who asked for it and the intended scope.
3. System walk-throughs. We follow sampled systems from business need through data, build or procurement, testing, release and monitoring, with the people involved.
4. Record sampling. Samples span risk levels and roles, and include a system that changed recently or drew a complaint.
5. Closing session. Provisional findings are discussed with leadership before the report is written.

What you get from the gap analysis

A gap report by clause and Annex A group

For clauses 4 to 10 and for each Annex A group, the report records what is in place and effective, what exists but is partial or not applied, and what is absent, with the evidence seen. It also gives a first view of which Annex A controls look necessary for your systems and where a justified exclusion is likely, the raw material for the Statement of Applicability you will build later.

A prioritised action plan

Each gap becomes an action with an owner, a target date and the resources needed. Work whose evidence takes longest to accumulate is scheduled first: the system inventory, the risk and impact assessments and the life-cycle records that must build up before an auditor can test them. Decisions reserved for top management, such as risk criteria and residual risk acceptance, are listed separately.

An effort and timeline estimate

The time your people will need by role, how the work could divide between your team and Sterling, and a realistic window for the certification audits. Most programmes take four to eight months in all, with organisations extending an ISO/IEC 27001 system nearer the shorter end; the ISO/IEC 42001 timeline guide explains what moves that range.

Who takes part

AI governance cuts across functions, so more roles take part than in most management system reviews.

The effort grows with the number of AI systems in scope and the roles you play for them, more than with headcount. Estimates go wrong when the people who build or procure the systems are left out.

What happens after the gap analysis

The report is reviewed with leadership, the action plan is agreed and the delivery route chosen. Under Design™ your team implements with Sterling's guidance, templates and workshops; under Drive™ our consultants carry the agreed work beside your system owners, who remain accountable for their systems. The plan's milestones are then tracked in Effivity, included with the engagement, at no additional cost, and the ISO/IEC 42001 implementation plan guide takes the project from there.

This is also the moment to start thinking about the certification body. Accredited ISO/IEC 42001 certification is newer than for the established standards, so check that the body is accredited for this standard, against ISO/IEC 17021-1 with ISO/IEC 42006, as the guide to choosing a certification body explains.

What a gap analysis does not do

• It does not certify. There is no pass mark and no certificate; only an accredited certification body decides, after Stage 1 and Stage 2.
• It does not replace the impact assessments. Performing them for each system is implementation work.
• It is not a legal opinion. It does not determine your obligations under the EU AI Act or any other law; the EU AI Act guide sets out what the certificate does and does not give.
• It is not your internal audit. The standard requires your own audit of a running AIMS, covered in the ISO/IEC 42001 internal audit guide.

ISO 42001 gap analysis: questions buyers ask