ISO/IEC 42001 is the world's first certifiable AI Management System (AIMS) standard. Certification is awarded through a two-stage audit: Stage 1 checks that your system is designed correctly; Stage 2 checks that it actually works in practice. This interactive checklist helps you verify you're ready for both — before the auditor arrives.
Work through the checklist below to generate your Stage 1 and Stage 2 readiness snapshot.
Discuss your readiness with a former ASX-listed CISO — no obligation.
ISO/IEC 42001:2023 is the world's first certifiable management system standard for artificial intelligence. Published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it sets out how an organisation should govern the AI it develops, provides, or uses — responsibly, transparently, and with appropriate human oversight.
It does for AI what ISO 27001 does for information security: it provides a structured, auditable framework — an AI Management System (AIMS) — that an accredited body can certify against. Because it follows the same Harmonized Structure as ISO 27001 and ISO 9001, organisations that already hold those certifications find much of the management-system machinery carries across. The genuine new ground is AI-specific: bias, fairness, transparency, data quality, model lifecycle governance, and societal impact.
Unlike a purely technical standard, ISO 42001 is risk-based and governance-led. It does not prescribe which models to use or how to build them. Instead, it requires you to understand your AI risks, assess the impact your systems have on people and society, and put proportionate controls and accountability in place — then prove those controls actually operate.
Whilst ISO 42001 is not yet mandatory for most organisations, it is rapidly becoming a commercial and regulatory expectation. It is increasingly referenced by:
Enterprise customers — procurement and vendor-risk teams now ask AI suppliers to evidence responsible AI governance before signing. Regulators — as AI-specific regulation matures (including the EU AI Act and emerging Australian AI guidance), a certified AIMS demonstrates due diligence. Investors — due-diligence teams treat AI governance as a material risk, particularly for AI-native businesses. Boards — directors carry accountability for AI risk and want demonstrable governance, not assurances.
The role question comes first. Before anything else, ISO 42001 asks what part you play in the AI supply chain — provider (you supply an AI product or service), producer (you develop, deploy, or operate AI), user/customer (you use AI built by others), or partner. Most organisations are more than one. This determines which of the 38 Annex A controls genuinely apply to you, so it is worth settling before you begin the checklist.
The Nine Annex A Control Objectives
ISO 42001 Annex A groups its 38 controls into nine objectives. The checklist below walks through each in turn, alongside the Clause 4–10 management-system requirements.
An approved AI policy, aligned to your other policies and reviewed over time — the foundation everything else hangs off.
Clear AI roles and accountabilities, plus a protected channel for raising concerns about AI.
An inventory of the data, tooling, compute, and people each AI system depends on across its lifecycle.
A repeatable process to assess how AI systems affect individuals, groups, and wider society.
Responsible design, development, validation, deployment, and monitoring — the operational heavy lifting.
Management, quality, provenance, and preparation of the data that feeds your AI systems.
User documentation, external reporting routes, and a plan for communicating AI incidents.
Responsible day-to-day use, human oversight, and controls that prevent unassessed scope creep.
Allocating responsibility across the AI supply chain, plus supplier and customer obligations.
ISO 42001 certification follows the same two-stage model as ISO 27001 and ISO 9001, conducted by an accredited certification body. Understanding what each stage examines is the key to preparing efficiently — many organisations over-prepare documentation and under-prepare evidence, then stumble at Stage 2.
Stage 1 is primarily a review of your documented information. The auditor confirms that the foundational elements of your AI Management System exist, are aligned to the standard, and that you are ready to proceed to Stage 2. It typically lasts one to two days.
Concerns raised here are called Areas of Concern (AOCs). These are an early warning — addressing them before Stage 2 prevents them becoming formal nonconformities.
Stage 2 evaluates operating effectiveness. The auditor looks for evidence that your documented system is genuinely embedded in day-to-day activity — not a set of policies written the week before. It typically lasts two to five days depending on scope.
This is where a single snapshot fails. Auditors expect a period of operating evidence: dated records, monitoring logs, completed assessments, and decision trails that show the AIMS running over time.
The critical insight: Stage 1 failures are about missing documents. Stage 2 failures are about documents that don't match reality. Before any external auditor arrives, ISO 42001 requires you to have completed at least one internal audit cycle and one management review — treat these as your dress rehearsal. A nonconformity found internally costs days to fix; the same one found at Stage 2 can cost your timeline.
For each item select ✓ Yes (in place & evidenced), ~ Partial (exists but incomplete), or ✗ Gap (missing). Each item is tagged S1 or S2 for the audit stage it primarily relates to.
This is a high-level readiness aid based on the published structure of ISO/IEC 42001:2023. It does not replace a formal gap analysis or an accredited certification audit. Annex A controls are risk-based — some may be marked not applicable in your Statement of Applicability.
Two decisions shape everything else in your ISO 42001 programme, and getting them wrong early is expensive to correct.
Your scope. Define which AI systems are inside the boundary of your AIMS. Scope too narrowly and the certificate won't satisfy your customers; scope too widely and every additional system adds risk assessments, impact assessments, and audit time.
Your role. ISO 42001 asks whether you are an AI provider, producer, user, or partner — and most organisations are more than one. The role you land on determines which Annex A controls genuinely apply to you. An organisation that builds and sells its own AI product carries far more lifecycle and data obligations than one that simply uses a third-party tool.
A note on honesty: The value of this checklist depends entirely on accurate self-assessment. If a policy exists but has never been reviewed, or an impact assessment was done once and never repeated, mark it 'Partial' — not 'Yes'. Auditors test for operating evidence over time, and a generous self-score simply moves the discovery of the gap from your desk to the auditor's report.
Unlike some standards, ISO 42001 requires that every applicable Annex A control is documented. At minimum, these documents must exist and be under version control before Stage 1:
For organisations that already hold ISO 27001, much of the management-system machinery (context, leadership, planning, support, evaluation, improvement) carries across — the genuine delta is the AI-specific Annex A and the impact assessment process. If you'd like to discuss a practical path to certification for your organisation, book a free discovery call.