ISO 42001 AI Readiness Assessment

ISO/IEC 42001 AI readiness assessment: is your AI management system audit-ready?

Answer plain-language questions about how you develop, buy and use AI, and see how close you are to ISO/IEC 42001 certification, with a readiness score, gaps by requirement area and prioritised recommendations.

10–15 minutes

No account needed

Data stored in the EU

Readiness score + gap report

What is ISO/IEC 42001?

ISO/IEC 42001:2023 is the first international standard for artificial intelligence management systems (AIMS). It helps organisations that develop, provide or use AI systems to manage AI risks, act responsibly and show customers and regulators that AI is under control.

The standard follows the same clause 4–10 structure as ISO 9001 and ISO/IEC 27001, so it can be integrated into an existing management system. Annex A contains 38 reference controls, for example on AI policy, AI system impact assessment, data quality, the AI system life cycle and third-party relationships. Certification is issued by an accredited certification body.

Who needs ISO 42001?

SaaS and technology companies that build AI features into their products
Companies whose enterprise customers ask how AI is governed and controlled
Organisations preparing for the obligations of the EU AI Act
Fintech, healthcare, HR-tech and other companies using AI in sensitive decisions
Companies that already hold ISO/IEC 27001 and want to extend it to AI

What the ISO 42001 AI readiness assessment checks

Scope of the AI management system and the roles you play: developer, provider or user of AI
AI policy, leadership commitment and responsibilities
AI risk assessment and AI system impact assessment for people and society
Data quality, data provenance and documentation of AI systems
Life cycle controls: design, verification, deployment, monitoring and retirement
Suppliers and third-party AI, transparency to users, internal audit and improvement

Typical gaps

There is no inventory of AI systems and AI tools used in the company
AI risks are discussed informally but not assessed or recorded
No impact assessment for AI systems that affect customers or employees
Rules for employees on using generative AI tools are missing
Third-party AI models and APIs are used without a supplier assessment

ISO 42001 and the EU AI Act

ISO/IEC 42001 is voluntary, while the EU AI Act is law. They are different things, but an AI management system gives you the governance, risk management and documentation that the AI Act also expects. BALTUM also offers a separate EU AI Act self-assessment.

Related standards

How the free assessment works

Choose the standard

The questions are written in plain language, so you do not need a compliance specialist to answer them.

Answer 20–40 questions

Describe how your organisation actually works today. Honest answers give the most useful result.

Get your report

A readiness score, a gap analysis by requirement area and prioritised AI recommendations, with a PDF you can share.

Frequently asked questions

Is ISO 42001 mandatory?

No. ISO/IEC 42001 is a voluntary standard. Companies use it to prove responsible AI governance to customers and partners and to prepare for regulation such as the EU AI Act.

Can I combine ISO 42001 with ISO 27001?

Yes. Both standards share the same high-level structure, so policies, risk management, internal audit and management review can be run as one integrated system.

Does BALTUM certify against ISO 42001?

No. BALTUM is independent self-assessment software, not a certification body. The certificate is issued by an accredited certification body.

Do we need ISO 42001 if we only use ChatGPT or other AI tools?

The standard applies to AI users too, not only developers. Even if you only use third-party AI, the self-assessment shows whether you have basic rules, risk assessment and supplier control in place.