ISO 27001 to ISO 42001: Gap Analysis Checklist

In this article

1. How Does an ISO 42001 Gap Analysis Work?
2. Start with your existing ISO 27001 evidence
3. Identify what ISO 42001 adds
4. The ISO 42001 Gap Analysis Checklist
5. 1. Scope and role (Clause 4)
6. 2. Leadership and AI policy (Clause 5)
7. 3. Planning: risk and impact (Clause 6)
8. 4. Support (Clause 7)
9. 5. Operation and lifecycle (Clause 8)
10. 6. Evaluation and improvement (Clauses 9 and 10)
11. ISO 42001 Gap Analysis at a Glance
12. What Will an ISO 42001 Gap Analysis Not Show You?
13. Classification and role under the AI Act
14. Article 15: Accuracy, robustness and cybersecurity
15. Quality management and EN 18286
16. AI literacy under Article 4
17. How Do You Turn the ISO 42001 Gap Analysis Into a Plan?
18. Rank the gaps
19. Give each gap an owner and a target date
20. Prepare for certification audits
21. Keep results in one system
22. Ready to run your ISO 42001 gap analysis?
23. Author: Nitin Grover

An ISO 42001 gap analysis helps organisations that already hold ISO 27001 identify which parts of their existing Information Security Management System (ISMS) can support an AI Management System (AIMS) and which requirements need additional work. The review typically covers six areas: AI scope and roles, leadership and AI policy, AI risk and impact assessment, support, operation, and evaluation and improvement.

Both standards follow ISO’s harmonised management system structure. This makes it possible to reuse relevant processes, responsibilities, and documented information. However, ISO 27001 certification does not automatically satisfy ISO 42001 requirements. The main gaps often concern AI-specific risks, impact assessments, lifecycle controls, and governance responsibilities.

This checklist provides a practical starting point for conducting an ISO 42001 gap analysis across a few working sessions. For the broader implementation strategy, read our guide to integrating ISO 27001 and ISO 42001. If you are comparing the purpose and scope of the two standards, start with ISO 27001 vs ISO 42001.

How Does an ISO 42001 Gap Analysis Work?

Start with your existing ISO 27001 evidence

Collect the documents and records your organisation already maintains, including the ISMS policy, risk assessment methodology, Statement of Applicability, internal audit programme, management review records and corrective action logs.

Compare this evidence against the requirements of ISO/IEC 42001:2023. For each requirement, record whether it is Covered, Partly Covered or a Gap. This three-level rating system is a practical recommendation for organising the assessment, not a rating scheme prescribed by ISO.

Do not assume that an existing information security process satisfies an AI management requirement simply because the two processes share a similar structure. Check whether the current process addresses the specific AI-related requirement and whether the organisation can demonstrate its implementation.

Identify what ISO 42001 adds

ISO 42001 introduces requirements specific to establishing, implementing, maintaining and continually improving an AI management system. These include determining the organisation’s role in relation to AI systems, conducting AI system impact assessments, setting AI objectives and selecting appropriate controls.

Annex A of ISO/IEC 42001:2023 contains 38 controls organised into nine control objectives. Annex C provides examples of AI-related risks and considerations, while Annex B offers implementation guidance for the controls in Annex A.

Use the published standard as the authoritative reference for your assessment. Practitioner summaries can help explain the requirements, but they should not replace the applicable standard.

The ISO 42001 Gap Analysis Checklist

Use the following checklist to assess your current processes. Adapt it to your organisation’s scope, AI activities and applicable requirements.

1. Scope and role (Clause 4)

• Identify the AI systems, AI-enabled products and related services within the proposed AIMS scope.
• Define the boundaries and applicability of the AI management system.
• Record the organisation’s role in relation to each relevant AI system.
• Identify interested parties and their relevant requirements.
• Identify applicable legal, regulatory and contractual obligations, including relevant EU AI Act requirements.
• Review whether the existing ISMS scope needs to change to cover the organisation’s AI activities.

2. Leadership and AI policy (Clause 5)

• Establish an AI policy appropriate to the organisation’s purpose and AI-related activities.
• Assign AI management responsibilities and authorities.
• Define accountability for AI risk assessment, impact assessment, documentation and monitoring.
• Ensure top management supports the AIMS and integrates relevant AI management requirements into organisational processes.
• Include AI management performance and relevant changes in management review.

3. Planning: risk and impact (Clause 6)

• Extend the existing risk assessment methodology to address AI-related risks.
• Consider issues such as bias, data quality, explainability, reliability, misuse, and unintended outcomes where relevant.
• Establish an AI system impact assessment process in accordance with Clause 6.1.4.
• Assess potential impacts on individuals, groups and society, as relevant to the AI system and its context.
• Distinguish impacts on people and society from risks to the organisation.
• Set measurable AI objectives where appropriate and define how progress will be evaluated.
• Select applicable Annex A controls and document the selection, exclusions and justification in the Statement of Applicability.
• Establish an AI risk treatment plan and identify the people responsible for implementing the selected measures.

4. Support (Clause 7)

• Assess the competence required by people performing work that affects AI management performance.
• Establish appropriate AI awareness activities for relevant staff and other people working on the organisation’s behalf.
• Determine the resources needed to establish and maintain the AIMS.
• Extend documented information controls to relevant AI policies, assessments, technical documentation and operational records.
• Define how AI management records are created, reviewed, updated, retained and protected.

5. Operation and lifecycle (Clause 8)

• Establish operational processes for AI risk assessment and risk treatment.
• Define relevant AI system lifecycle controls, from development or acquisition through deployment, use, monitoring and retirement.
• Establish appropriate processes for data management in AI systems.
• Define how information about AI systems is communicated to relevant interested parties.
• Establish rules and responsibilities for the responsible use and operation of AI systems.
• Define appropriate monitoring and operational controls for AI systems.
• Review supplier, partner and third-party AI arrangements.
• Determine whether AI system changes require reassessment of risks, impacts or controls.

6. Evaluation and improvement (Clauses 9 and 10)

• Include relevant AI management requirements and controls in the internal audit programme.
• Establish audit criteria and scope for the AIMS.
• Include AI management performance in management review.
• Monitor progress against AI objectives and evaluate whether the AIMS achieves its intended results.
• Record AI-related nonconformities and corrective actions where applicable.
• Review whether corrective actions address the underlying causes of identified problems.
• Repeat the gap analysis when the system, scope, requirements, or organisational context changes and before the planned certification assessment.

ISO 42001 Gap Analysis at a Glance

Area	Likely reuse from ISO 27001	Potential gap	Evidence to collect
Scope and role	Scope methodology and interested-party analysis	AI system scope and role definitions	AIMS scope and AI system role records
Leadership	Policy structure and management responsibilities	AI policy and AI-specific accountability	Approved AI policy and responsibility records
Planning	Risk methodology and control selection process	AI system impact assessment and AI objectives	Risk assessments, impact assessments and objective records
Support	Competence processes and document control	AI-related competence and documentation	Training records and controlled AI documentation
Operation	Change management and supplier processes	AI lifecycle, data management and AI-specific operational controls	Lifecycle records, data controls and supplier assessments
Evaluation	Internal audit and management review processes	AI-specific audit criteria and performance evaluation	Audit programme, findings and management review records

The reuse and gap columns describe likely outcomes for a typical organisation with an established ISMS. They are not universal findings. Your own ISO 42001 gap analysis may identify additional gaps or show that some existing processes already meet relevant requirements.

What Will an ISO 42001 Gap Analysis Not Show You?

An ISO 42001 gap analysis evaluates your management system against the requirements of a voluntary international standard. It does not, by itself, determine whether every AI system meets all applicable legal obligations.

For organisations operating in Europe, the assessment should be complemented by a separate review of relevant EU AI Act requirements.

Classification and role under the AI Act

Assess each AI system against the applicable provisions of the EU AI Act. The assessment should consider the system’s intended purpose, use context, relevant definitions, applicable risk categories, and any relevant exceptions.

An AI risk classification tool for the EU AI Act or an EU AI Act Compliance Checker can support an initial assessment. However, the output should be checked against the Regulation and the actual characteristics of the system. A tool result alone does not establish a definitive legal classification.

Determine whether the organisation acts as a provider, deployer or another regulated actor for each relevant system. These are legal roles under the AI Act and should not be confused with the organisation’s roles and responsibilities within its ISO 42001 management system.

AnnexOps helps teams organise AI inventory information, classification results, regulatory obligations and supporting evidence. Its tools support compliance operations rather than replace legal assessment.

Article 15: Accuracy, robustness and cybersecurity

Article 15 of the EU AI Act sets requirements for the accuracy, robustness and cybersecurity of high-risk AI systems. The applicable requirements should be assessed against the system itself and its intended use.

An existing ISO 27001 ISMS can provide useful supporting processes for information security risk management, access control, incident handling and other relevant security measures. However, holding ISO 27001 certification does not establish that a high-risk AI system satisfies every applicable Article 15 requirement.

Organisations should assess the AI system against the relevant legal requirements and retain evidence that supports their conclusions.

For the relevant implementation timeline, see our Annex III deadline guide.

Quality management and EN 18286

Article 17 of the EU AI Act establishes quality management system requirements for providers of high-risk AI systems. Organisations should determine which requirements apply to them and assess their existing management system against those obligations.

CEN-CENELEC has reported the citation of EN 18286:2026 in connection with Article 17 in October 2026. Before relying on this reference in a compliance assessment, verify the exact Commission Implementing Decision, its publication date, and the scope of the cited standard in the Official Journal of the European Union.

Where a harmonised standard is cited for a specific legal requirement, applying it may provide a presumption of conformity for the requirements it covers, subject to the applicable legal conditions. This does not mean that the standard automatically establishes compliance with every provision of the AI Act.

ISO/IEC 42001 can provide a useful foundation for AI governance and management processes. However, an ISO 42001 certificate alone does not establish conformity with Article 17 or the EU AI Act as a whole.

For further context, read what a certificate does and does not cover.

AI literacy under Article 4

Article 4 of the EU AI Act entered into application on 2 February 2025. It requires providers and deployers to take measures to support the AI literacy of their staff and other people involved in operating or using AI systems on their behalf.

The measures should take account of relevant technical knowledge, experience, education and training, the context in which the AI systems are used, and the people or groups on whom the systems are used. Article 4 does not require providers or deployers to guarantee a specific level of AI literacy for every individual.

No specific AI literacy certificate is required by Article 4. Organisations can retain internal records of training and other initiatives, but documentation should support the measures taken rather than replace them.

ISO 42001 competence and awareness processes can help organise AI-related training and responsibilities. They should not be treated as an automatic substitute for the applicable Article 4 obligation.

Read our guide to AI literacy training under Article 4.

How Do You Turn the ISO 42001 Gap Analysis Into a Plan?

Rank the gaps

Prioritise gaps according to their significance, dependencies, implementation effort, planned audit date and applicable legal or contractual obligations. An AI system impact assessment process and clear role definitions may require additional coordination, depending on the organisation’s existing processes and AI activities.

Do not prioritise gaps solely by how easy they are to close. Consider the potential consequences of leaving a requirement unaddressed.

Give each gap an owner and a target date

Assign a responsible owner to every identified gap. Record the action required, the evidence needed to demonstrate implementation, the target completion date, and the review status.

A gap register should make it clear who is responsible for each action and how the organisation will determine whether the gap has been closed.

Prepare for certification audits

ISO 42001 certification commonly involves a readiness and documentation review followed by an assessment of implementation and effectiveness. Many certification programmes use a two-stage audit process: Stage 1 reviews readiness and documented information, while Stage 2 evaluates the implemented management system.

The exact arrangements depend on the certification body and applicable certification requirements. Confirm the scope, stages, and evidence expectations with your chosen certification body.

An internal audit and management review are important parts of AIMS evaluation, but they do not replace an external certification audit when certification is sought.

Keep results in one system

A spreadsheet can work for an initial gap analysis. However, managing a growing inventory of AI systems, assessment results, responsibilities, supporting documents and regulatory obligations can become difficult when information is spread across multiple files.

AnnexOps AI Governance Platform helps teams organise AI inventory, risk classification, ownership and supporting evidence in one place. As AI compliance software, it supports operational management of EU AI Act readiness and AI governance activities, including evidence tracking and continuous-monitoring workflows.

AnnexOps supports compliance operations and does not replace legal advice, independent conformity assessment, or an accredited certification audit.

Author: Nitin Grover

Nitin Grover is an AI compliance strategist and writer focused on EU AI Act compliance, AI governance, Annex IV documentation, AI risk management, and AI compliance operations for AI startups, SaaS companies, and enterprise AI teams across Europe.