ISO 42001 Readiness Checklist: A Free Self-Assessment You Can Copy

Before you invite an auditor, you want to know one thing honestly: are you actually ready, or do you just think you are? A readiness checklist answers that question while it is still cheap to answer wrong. It walks you through what ISO/IEC 42001 expects, clause by clause, and lets you mark where you stand before anyone with a certificate on the line is looking.

This is a self-assessment, not an audit. The point is not to pass; it is to find the gaps early, while there is still time and budget to close them. The free checklist below is organized by the five phases of implementation and written so you can copy it straight into a spreadsheet, score each item, and turn it into a working plan.

ISO/IEC 42001 was published in December 2023 as the first certifiable AI management system standard, so most organizations are starting from a blank page rather than refining a mature system. A readiness checklist is how you find out which parts of that page you have actually filled in.

What an ISO 42001 Readiness Checklist Is For

A readiness checklist turns a vague question, are we ready for ISO 42001, into a list of specific, checkable items. Each item maps to something the standard requires, so working through the list tells you exactly what exists, what is half-built, and what has not been started. It is a planning tool first and a confidence check second.

Used honestly, it does three things: it surfaces the gaps that would otherwise be found by an auditor at the worst possible moment, it gives you a defensible order of work by showing what blocks what, and it creates a baseline you can re-score later to see whether you are actually moving. Used dishonestly, by ticking boxes you cannot evidence, it does nothing at all, because the auditor will ask for the evidence the checklist only claimed.

The Free ISO 42001 Readiness Checklist

Copy each phase below into a spreadsheet and add three columns: a status (not started, in progress, ready), the owner, and a link to the evidence. The phases follow the structure of the standard, so they double as a map of the whole implementation.

Phase 1: Context, Leadership, and Policy (Clauses 4 and 5)

Phase 2: Planning and Risk Assessment (Clause 6)

Phase 3: Support and Operations (Clauses 7 and 8)

Phase 4: Performance Evaluation (Clause 9)

Phase 5: Improvement and Audit Readiness (Clause 10)

How to Score Your Readiness

Mark every item not started, in progress, or ready, and be strict about what ready means: you can produce evidence today. Scoring this way turns the checklist into a simple maturity model for your AI management system, where readiness is not a yes or no but a position on a scale you can watch move.

A useful rule of thumb: you are ready for a certification audit only when every item is ready and nothing material is still in progress. A single not-started item in Phase 4, such as never having run an internal audit, is enough to fail Stage 2, because the standard treats those activities as mandatory, not optional. Score honestly, because the auditor will.

Readiness Checklist, Gap Analysis, and Audit Checklist: Which Is Which

Three tools get confused because they overlap, but they do different jobs at different moments. A readiness checklist is the quick, forward-looking self-assessment on this page, used to see roughly where you stand. A gap analysis is the deeper, documented study that quantifies each gap and plans the remediation. The audit checklist is the evidence-based list used to verify requirements are met during an audit.

The sequence is natural: run the readiness checklist first to get the lay of the land, commission a gap analysis to plan the detailed work, then use the audit checklist to confirm you are done. They share most of their content because all three trace back to the same standard, but one estimates, one plans, and one verifies.

What Being Ready Actually Means

Readiness is not having written the documents; it is having operated the system long enough to have evidence that it works. The most common misjudgment is to treat a complete set of policies as readiness. A policy that was approved last week but has governed no actual decisions is not evidence of a working management system, and an auditor will say so.

Real readiness has a time dimension. Because Stage 2 tests whether your controls operate in practice, you need records of the system running, internal audits performed, and at least one management review held. That is why the honest answer to when will we be ready is usually a few months after the documents are finished, not the day they are signed.

Where Organizations Are Least Ready

Across early ISO 42001 efforts, the same items tend to be marked not started long after the policies are done. The AI inventory is often incomplete, because shadow AI and third-party features are missed, which undermines the whole risk assessment built on top of it. Impact assessments are frequently skipped, even though they are a distinctive requirement of this standard. And the Clause 9 activities, internal audit and management review, are often left until last, despite being exactly what Stage 2 examines most closely.

If you are short on time, score these items first. They are the ones most likely to be both missing and decisive.

Who Should Run It, and How Often

The readiness check works best when it is not done alone by one person. The people who own each area, data science for the lifecycle controls, legal and risk for the risk and impact assessments, IT and security for infrastructure, should score their own items, because the owner knows what evidence truly exists and an outsider only sees the documents. The implementation lead then consolidates the scores into one picture and resolves the inevitable disagreements about what counts as ready.

Re-run it on a cadence rather than once. A first pass at the start sets the baseline and the plan; a second pass midway shows whether the work is actually moving or just being talked about; and a final pass before you engage a certification body confirms that nothing material is still in progress. Teams that score once at the beginning and never again tend to discover, right before the audit, that items they assumed were finished months ago were quietly never closed.

Keep the completed checklist after certification too. It becomes the starting point for every surveillance audit, and re-scoring it each year is a fast way to catch the drift that creeps in as AI systems and the people running them change.

From Checklist to Certification

The readiness checklist tells you where you are; it does not get you the rest of the way. Once you know your gaps, the implementation guide lays out the full build phase by phase, and when the system is genuinely ready, the guide to getting certified covers the audit itself. Work the checklist, close what it surfaces, and the certification audit becomes a confirmation rather than a gamble.

Frequently Asked Questions

What Is an ISO 42001 Readiness Checklist?

It is a self-assessment that lists what ISO 42001 requires, clause by clause, so you can mark where you stand before a certification audit. It is a planning and confidence tool, not the audit itself, and its value is finding gaps early while they are still cheap to fix.

Is the Readiness Checklist the Same as a Gap Analysis?

No. The readiness checklist is a quick, forward-looking self-check; a gap analysis is the deeper, documented study that quantifies each gap and plans the remediation. You normally run the checklist first and commission a gap analysis to plan the detailed work it surfaces.

How Do I Know When I Am Ready for Certification?

When every checklist item is genuinely ready with evidence you can produce today, and when the system has operated long enough to show records, at least one internal audit, and a management review. Completed documents alone are not readiness, because Stage 2 tests whether controls work in practice.

Can I Use This Checklist if I Am Already ISO 27001 Certified?

Yes, and you will likely start further along. ISO 42001 shares the high-level structure of ISO 27001, so your context, leadership, support, and performance-evaluation items may already be partly met. Focus your scoring on the AI-specific items, especially the risk assessment, impact assessments, and the AI inventory.

Does a Complete Checklist Guarantee I Will Pass?

No. The checklist confirms coverage, but passing depends on the evidence behind each item. An honestly completed checklist where you can produce evidence for every ready item means the audit will cover ground you have already walked; a checklist ticked without evidence means the opposite.

Turn Readiness Into Capability

A checklist shows the gaps; closing them takes people who understand what each requirement means and how to evidence it. That understanding is what training builds. You can see every route through the ISO 42001 courses, with the implementer path taught clause by clause in the Lead Implementer certification, so your team can turn a checklist of gaps into a system that is genuinely ready.