ISO 42001 gap analysis: how to measure where your AI management system stands
An ISO 42001 gap analysis (or initial assessment) compares what the organization already does with what ISO/IEC 42001:2023 requires for an AI management system (AIMS). You review every requirement of clauses 4 to 10 and every Annex A control, mark each one as implemented, partially implemented, not implemented or not applicable, record the current evidence and the action still needed, and end up with a progress percentage per clause and a prioritized list of gaps that becomes the project plan. The standard does not require it, but it is the fastest way to know your starting point.
Is a gap analysis mandatory for ISO 42001?
No. No clause of ISO/IEC 42001:2023 asks for a gap analysis, and a certification auditor will not require it as documented information. Even so, almost every project starts with one for three reasons: it sizes the work (how many requirements are missing and of what kind), it lets you prioritize sensibly, and it gives management a baseline to track progress.
If the organization already holds ISO 27001, the assessment usually shows that much of clauses 4 to 10 (context, leadership, documented information, internal audit, management review, improvement) can be extended instead of built from scratch. The big gaps tend to be AI-specific: AI system impact assessment (6.1.4 and 8.4), life cycle, data and third-party relationships.
What is assessed: 27 requirements and 38 controls
The NexoDocs gap self-assessment (AIMS-GAP-01) splits the standard into two sheets. Titles and summaries are written by NexoDocs: the standard is cited by clause and control number, never copied.
| Part of the standard | What it covers | Rows in the assessment |
|---|---|---|
| Clause 4 · Context | Context and roles regarding AI, interested parties, scope, management system | 4 |
| Clause 5 · Leadership | Top management commitment, AI policy, roles and authorities | 3 |
| Clause 6 · Planning | Risks and opportunities, AI risk assessment and treatment, impact assessment, objectives, changes | 6 |
| Clause 7 · Support | Resources, competence, awareness, communication, documented information | 5 |
| Clause 8 · Operation | Operational control and performing risk assessment, treatment and impact assessment | 4 |
| Clause 9 · Performance evaluation | Monitoring and measurement, internal audit, management review | 3 |
| Clause 10 · Improvement | Continual improvement, nonconformity and corrective action | 2 |
| Annex A (A.2 to A.10) | Policies, internal organization, resources, impact assessment, life cycle, data, information for interested parties, use of AI and third parties | 38 controls in 9 groups |
The largest Annex A group is the AI system life cycle (A.6, 9 controls), followed by resources (A.4) and data (A.7) with 5 controls each. They also take the longest when the organization develops or trains its own models.
ISO 42001 Toolkit: documentation for your AI management system
30 Word documents · 31 Excel tools · 38 Annex A controls
See the ISO 42001 documentation toolkitHow to run the gap analysis step by step
- Set a provisional scope: which AI systems, processes and sites are in. Without a scope, the assessment mixes things that will later be left out.
- Bring in the people who know actual practice: the AIMS manager, whoever develops or buys the AI systems, data, legal or compliance, and information security.
- For each requirement and control, choose one of four statuses: implemented, partially implemented, not implemented or not applicable.
- Record the current evidence (document, record, tool). With no evidence, the status is not "implemented", even if the practice exists informally.
- Write the action needed as a verifiable sentence and assign an owner.
- Review the dashboard: progress by clause and control group, number of items not implemented and rows not yet assessed.
- Turn the gaps into tasks in the project plan, starting with clauses 4 to 6, because everything else depends on them.
How progress is scored
In the template, each row gets a score from its status and each clause's percentage is the average of its rows:
| Status | Score | When to use it |
|---|---|---|
| Implemented | 100% | It is done, documented where required, and there is evidence |
| Partially implemented | 50% | Done in part, without a document or without enough records |
| Not implemented | 0% | Not done, or no evidence at all |
| Not applicable | Excluded from the average | Only for Annex A controls excluded with a justification (for example, the organization does not develop models) |
Worked example: if clause 7 (5 requirements) has 2 implemented, 2 partial and 1 not implemented, progress is (100 + 100 + 50 + 50 + 0) / 5 = 60%. Clauses 4 to 10 do not allow "not applicable": they are mandatory for any organization seeking certification. Annex A exclusions are justified later in the Statement of Applicability.
What to do with the results
- Prioritize by dependency, not by ease: without context (4.1), scope (4.3) and AI policy (5.2) you cannot do risk or impact assessment properly.
- Group gaps into work packages (governance, risk and impact, life cycle and data, suppliers, evaluation and improvement) and put them in the project plan with dates.
- Use the assessment as input to the AI system inventory and the risk assessment, not as a replacement for them.
- Repeat the self-assessment every quarter: the same file shows management the progress without extra reports.
- Before the certification audit, check it against an internal audit (9.2): a self-assessment tends to be optimistic.
Common mistakes
- Marking "implemented" because "we do it", with no evidence to show.
- Using "not applicable" for clauses 4 to 10, which allow no exclusions.
- Running it from compliance alone, without the people who build or buy the AI systems.
- Confusing AI risk assessment (6.1.2) with AI system impact assessment (6.1.4): the first looks at the organization, the second at affected individuals and groups.
- Filing the assessment away: if it does not become a plan with owners and dates, it is useless.
Template: the gap assessment in the ISO 42001 toolkit
The NexoDocs ISO 42001 toolkit includes the AIMS-GAP-01 gap self-assessment: a macro-free Excel file with the 27 requirements of clauses 4 to 10 and the 38 Annex A controls preloaded with our own summaries, a color-coded status drop-down, automatic scoring and a dashboard with progress by clause and control group. It links to the project plan with a Gantt chart (AIMS-PRJ-01), where the gap assessment is the second task, and to the implementation guide in the same toolkit. If you want to start with the most AI-specific part, you can download the free AI system impact assessment template.
Next step
Try it free or go straight to the complete solution.
ISO 42001 Toolkit: documentation for your AI management system
30 Word documents · 31 Excel tools · 38 Annex A controls
See the ISO 42001 documentation toolkit
Free sample
Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.
Get the free sampleFrequently asked questions
How long does an ISO 42001 gap analysis take?
It depends on size and on how many AI systems are in scope. In a small or mid-sized organization, with the right people in the room, two or three working sessions plus a review of existing evidence is usually enough.
Can I reuse an ISO 27001 gap analysis for ISO 42001?
It helps with clauses 4 to 10, which share the same structure in both standards, but it does not cover the ISO 42001 Annex A controls or AI system impact assessment. A dedicated AI assessment is worth it.
What is the difference between a gap analysis and an internal audit?
A gap analysis is a planning self-assessment with no required format. The internal audit (clause 9.2) is mandatory, is carried out by objective and impartial people under a defined programme, and its findings are recorded as nonconformities or observations.
How often should it be repeated?
At the start of the project and then every quarter during implementation. Once the AIMS is running, follow-up moves to indicators, internal audit and management review.
Does a 100% score guarantee certification?
No. Certification is decided by a certification body after its audit; the gap analysis is a self-assessment that organizes the work and shows progress.
Related guides
What is ISO/IEC 42001? The artificial intelligence management system
What ISO/IEC 42001:2023 is, who it is for, clauses 4 to 10, the 38 Annex A controls and how it relates to ISO 27001 and the EU AI Act.
Read the guide →ISO 42001 mandatory documents (AI management system)
The documented information ISO/IEC 42001:2023 requires for an AI management system, with the clause for each document and the records auditors ask for.
Read the guide →ISO 42001 AI system impact assessment template: free Excel with automatic scoring
Free ISO 42001 AI system impact assessment template in Excel: screening, impacts with automatic scoring, residual impact and approval. No email needed.
Read the guide →Updated: 2026-10-29