Reference
ISO/IEC 42001 gap assessment: what it actually does
A gap assessment is not an audit and it is not a certificate. It is a structured comparison between what the standard requires and what your organization currently has, producing a prioritised list of what is missing. This page sets out what to expect, what "readiness" honestly means, and where a workbook helps.
Written by Yosef Dabbit, Annexwright · Published 2026-09-23 · Last reviewed 2026-09-23 · Edition 2026.1
What it is
ISO/IEC 42001 splits into two things you can be measured against: the management-system clauses, which cover context, leadership, planning, support, operation, performance evaluation and improvement; and Annex A, the control set. A gap assessment walks both, asks "do we have this, and can we show it?", and records the answer with a justification.
The output is not a score for its own sake. It is a work list: what is missing, what exists but is undocumented, what is documented but not operating, and roughly what each one costs to close.
What it is not
- Not an audit. An audit is performed against evidence by someone independent, to a defined programme. A gap assessment is preparation.
- Not certification. Certification is issued by an accredited body after a two-stage audit. No assessment, workbook or document set produces a certificate.
- Not a one-off. The first run tells you where you are. The value comes from re-running it after remediation and seeing the list shrink.
What "readiness" honestly means
A readiness percentage is a useful management number and a poor promise. It reflects how much of the required documentation and control coverage is in place — it cannot reflect the records that only elapsed time produces. You can be documentation-complete and still not be auditable, because a certification audit expects to see a completed internal audit, a management review that actually happened, and corrective actions with dates against them.
A realistic reading: documentation coverage tells you whether you are ready to start operating the management system. Time and records tell you whether you are ready to be audited.
How a gap assessment is usually run
- Scope. Which legal entity, which products, which AI systems. Scope decisions drive everything after them.
- Inventory first. You cannot assess what you have not listed. Most first-run gap assessments stall here, because AI features inside SaaS tools and models called by one team were never registered.
- Clause walk. Requirement by requirement: present, partial or absent, with a note on the evidence.
- Control walk. The Annex A control set, with an applicability decision and a justification for each.
- Prioritise. Sequence by dependency, not by how easy each item looks. Policy and inventory come before risk treatment, because the later work references them.
- Re-run. After remediation, to produce a trend rather than a snapshot.
Where a workbook helps
The mechanical parts — holding 65 requirements consistently, scoring them the same way twice, rolling them into a readiness figure, and turning the result into a sequenced roadmap — are exactly what a spreadsheet does well and what a document does badly. What a workbook cannot do is make the judgement calls: scope, applicability, risk appetite and whether a control you operate genuinely satisfies the requirement.
Annexwright's Gap Assessment Workbook (AW-P04) is part of Professional, $397. It scores 65 requirements across clauses and controls and returns a readiness percentage, an effort estimate and a remediation roadmap. It sits alongside the Statement of Applicability (AW-P02, 38 Annex A control rows with justification columns), the internal audit programme and the audit evidence binder — because a gap assessment that does not feed the Statement of Applicability just creates a second list.
Take the crosswalk free
ISO/IEC 42001 mapped to NIST AI RMF, the EU AI Act and ISO/IEC 27001, clause by clause, as an Excel workbook. A complete file from the paid set. No signup, no email gate.
Professional — the set the gap assessment belongs to
AIMS manual, Statement of Applicability, gap assessment workbook, internal audit programme, management review pack, 16 KPIs, a 90-day roadmap and an audit evidence binder, plus everything in Essentials.
What you still do. Annexwright supplies the documentation architecture. You decide which systems are in scope, who owns them, what your risk appetite is and what you will actually do; you fill the registers, adapt the wording, operate the controls and keep the records. Buying documentation does not make an organization compliant or certified.
How this page was checked. Regulatory dates on this page were taken from the official texts and from the European Commission, the Illinois General Assembly, Texas Legislature Online, the Colorado General Assembly, the California Privacy Protection Agency, the New York State Senate and NYC DCWP, and were last reviewed on 2026-09-23. Where a date is an applicability or compliance deadline rather than an entry-into-force date, the page says so. Regulation changes; check the primary text before relying on any date for a decision. Nothing here is legal advice.