ISO 42001 checklist: a step-by-step readiness checklist

Before you start

Two things make the whole programme easier: executive sponsorship (ISO 42001 needs top-management ownership) and a defined scope (which AI systems and processes the management system covers). Settle both first.

The ISO 42001 readiness checklist

1. Define scope and context — decide which AI systems are in scope and document the issues and interested parties.
2. Secure leadership and write your AI policy — top-management commitment, an AI policy, and assigned roles.
3. Build your AI system inventory — a register of every AI system in scope, with owners.
4. Run AI risk assessments — identify and treat the risks each system creates.
5. Run AI impact assessments — assess the effect of each system on individuals and groups.
6. Select and implement Annex A controls — choose the controls that fit your risks and record them in a Statement of Applicability.
7. Set up data governance and lifecycle controls — data quality and controls across the AI lifecycle.
8. Establish monitoring, competence and documentation — the support and operation requirements.
9. Run an internal audit — test yourself against the standard before the certification body does.
10. Hold a management review — leadership reviews the system's performance and signs off readiness.

Turn the checklist into evidence

A checklist tells you what to do; certification needs evidence that you did it. As you work through each item, keep the records — assessments, minutes, the Statement of Applicability, audit results — because Stage 2 of the audit is an evidence review. See how to get ISO 42001 certified and the full requirements.

How AramGRC helps

AramGRC runs this as a formal ISO/IEC 42001 gap assessment — scoring you against every requirement and Annex A control and handing you a prioritised, certification-ready roadmap, so the checklist becomes a plan.