ISO 42001 Readiness Assessment: How to Run One

A readiness assessment is the honest self-evaluation of your AIMS maturity before booking the Stage 1 audit. Skip it and you pay for findings. Do it well and you cut certification time by months.

Updated 27 June 2026 · 5 min read

● Free · 3 minutes · Built by ISO 42001 specialists

ISO 42001 Readiness Assessment

A clause-by-clause readiness check across 9 AIMS governance domains. Get your score, your specific regulatory exposure, and the exact documents that close each gap.

Get your full readiness report

Your complete breakdown, every gap mapped to the exact ISO 42001 document that closes it, plus your regulatory exposure and recommended path. Downloads instantly.

No spam. Your assessment data stays private.

`; const blob=new Blob([html],{type:'text/html'}), url=URL.createObjectURL(blob), a=document.createElement('a'); a.href=url; a.download='ISO-42001-Readiness-Report.html'; document.body.appendChild(a); a.click(); document.body.removeChild(a); setTimeout(()=>URL.revokeObjectURL(url),4000); } function raRoute(pct){ const r=$("raRoute"); r.classList.remove("ra-hide"); const c=window._raCtx||{}; const BOOK="https://cal.com/humanaudit/discovery-call-20-minutes-free", PROD="https://iso42001toolkit.com/products.html"; const sspaUrgent=(c.sspa==="yes"&&c.sensitive==="yes"); let html=""; if(pct<55){ html=`

Your recommended path

${sspaUrgent?"With a mandatory SSPA requirement and foundational gaps, the fastest safe route is expert help. ":""}You scored in the range where teams save weeks by not starting from a blank page. Start with the full toolkit, or book a free call to map the fastest path.

Book a free 20-min call → See the toolkits

`; } else if(pct<75){ html=`

Your recommended path

You have real structure with specific gaps. The Professional toolkit closes most of them with the exact documents named above${sspaUrgent?", including the Microsoft SSPA Section K mapping you need":""}.

Close the gaps, see the toolkit → Or book a quick call

`; } else { html=`

Your recommended path

You're close to audit-ready. The Audit-Ready tier gives you the evidence binders, pre-audit self-assessment, and auditor briefing pack to finish, the fastest route to certification.

Get the Audit-Ready pack → Questions? Book a call

`; } r.innerHTML=html; r.scrollIntoView({behavior:"smooth",block:"nearest"}); } render(); })();

Readiness assessment vs gap analysis vs pre-audit

These three terms are used loosely and often interchangeably in the market. The distinction that matters:

Gap analysis, early-stage review of what exists vs what the standard requires. Done at the start of an implementation programme. Scope: the whole standard.
Readiness assessment, late-stage review of whether the AIMS is ready for external audit. Done weeks before Stage 1. Scope: specific implementation maturity and evidence quality.
Pre-audit, a mock Stage 1, usually run by a certification body or qualified external auditor. Often paid separately from the real Stage 1.

What a readiness assessment covers

A proper readiness assessment walks through:

Documentation completeness

All 23 core documents present, signed, dated, current?
Are versions and approvals traceable?
Does the Statement of Applicability cover all 38 Annex A controls with justifications?

Implementation maturity

Has at least one full cycle of internal audit been completed?
Has at least one Management Review happened with required inputs and outputs?
Is the CAPA process active, has at least one corrective action been opened, worked, and closed?
Are AI impact assessments done for every in-scope system?

Evidence quality

For each "Applicable" Annex A control, is evidence findable within 5 minutes?
Are records consistent (dates, owners, versions match across documents)?
Can a staff member answer basic questions about the AIMS in their area?

Scope alignment

Does the Scope Statement match the AI System Inventory?
Are exclusions defensible in writing?
Is the scope consistent with regulatory obligations (EU AI Act, Colorado AI Act)?

Internal vs external readiness assessment

Internal readiness assessment

Run by your own compliance team or a cross-functional working group using a structured checklist. Pros: zero external cost, builds internal knowledge. Cons: blind spots, confirmation bias.

Our Audit-Ready tier includes the Pre-Audit Self-Assessment Checklist (AR-01), a 100+ item structured review organised exactly the way an auditor will work. For organisations with mature governance, this is often sufficient.

External readiness assessment

Run by a qualified external assessor, either a consultancy or an accredited certification body as a paid pre-audit. Pros: fresh eyes, explicit alignment with how a real auditor works, a written report you can act on. Cons: $5,000–$15,000 typical cost.

Most certification bodies (A-LIGN, Schellman, BSI, DNV, SGS) offer pre-audits as a separately-priced service. Consultancies specialising in ISO 42001 offer the same. Ask for fixed-fee; ask for the report format; ask for the assessor's ISO 42001 track record (the standard is young enough that many consultants are learning on your engagement).

Hybrid, the efficient pattern

Run the internal Pre-Audit Self-Assessment (AR-01) honestly. Close every ✗ item.
When internal shows "green", engage a 1–2 day external pre-audit for blind-spot check ($3,000–$5,000 typical).
Close any findings.
Book Stage 1.

Total cost: $3,000–$5,000 vs $5,000–$15,000 for full external readiness. The internal work concentrates external effort on verification rather than discovery.

Signs you're NOT ready for Stage 1

Any AI System in scope lacks a completed impact assessment
Internal audit hasn't been run yet
Management Review hasn't happened
Statement of Applicability has "TBD" in multiple rows
Nonconformity Register is empty (no system finds zero issues, an empty register suggests the process isn't being used)
Staff who'll be interviewed can't describe the AI Policy in their own words
Document control has gaps (drafts, missing signatures, stale versions)

Signs you ARE ready

All 23 core documents current, signed, dated within the last 12 months
At least one full internal-audit + management-review + CAPA cycle has run
SoA complete, evidence traceable for every Applicable control
Staff familiar with the AIMS in their area of responsibility
Document control is tight, versioning, approval, retention
AR-01 self-assessment comes back with only ✓ or ⚡ (no ✗)