Service
AI Governance Gap Assessment
An AI governance gap assessment is a structured review that measures your current practices against all of ISO/IEC 42001's clause requirements and Annex A controls, then reports precisely which ones you already meet, partially meet, or fail. ai42001 delivers this in 3–4 weeks as a clause-by-clause scorecard, a prioritised remediation roadmap with effort estimates, and a certification readiness verdict you can take to your board. We review both sides in parallel: our team assesses your policies, contracts, and regulatory exposure, and inspects your actual AI systems, model pipelines, logging, and change-management evidence — so the report reflects what is really running, not just what is written down.
- Timeline
- 3–4 weeks
- Your effort
- 4–6 hours of your team's time per week
- Pricing
- Fixed fee — quoted after a 30-minute scoping call
Fit
Who this is for
This is for you if
- A customer, investor, or procurement team has asked whether you are ISO 42001 certified — and you need a real answer.
- You are already SOC 2 or ISO 27001 certified and want to know how much of that work carries over.
- You need a defensible budget and timeline for certification before you commit to it.
- You suspect your AI governance exists in slide decks rather than in your systems.
This isn't for you if
- You have fewer than about 20 people and no AI systems in production yet — a lighter advisory call is better value.
- You already have a completed gap assessment from a credible assessor; start with implementation instead.
Scope
What's included
Every item below is delivered by our team working in parallel — the legal analysis and the technical work happen together, not in sequence.
- AI system inventory
- We build the register of every AI and ML system in your organisation — including the shadow AI in your sales team's browser extensions — with owner, purpose, data classification, and risk tier for each.
- Clause-by-clause conformity scorecard
- Every requirement in ISO/IEC 42001 clauses 4–10 plus all 38 Annex A controls, rated Met / Partial / Not Met with the evidence we saw or the evidence that was missing.
- Technical control review
- On the technical side, our team reviews your model pipelines, evaluation and testing practices, data lineage, access controls, logging, and incident response against Annex A — in your repositories and cloud accounts, not from a questionnaire.
- Legal and regulatory exposure review
- On the legal side, our team maps your AI systems to EU AI Act risk categories, reviews your customer and vendor contracts for AI clauses, and flags where your current terms create obligations you are not meeting.
- Cross-framework mapping
- Where your existing ISO 27001, SOC 2, or NIST AI RMF work already satisfies an ISO 42001 requirement, we say so — so you do not pay to rebuild controls you already have.
- Prioritised remediation roadmap
- Every gap becomes a task with an owner type, effort estimate in days, dependency order, and a note on whether it blocks certification or is merely advisable.
- Readiness verdict and executive briefing
- A plain-language verdict on how long certification will realistically take, plus a 45-minute walkthrough with your leadership team and space for hard questions.
Deliverables
What you actually receive
- AI system inventory (spreadsheet + machine-readable JSON)
- ISO/IEC 42001 conformity scorecard covering clauses 4–10 and Annex A
- EU AI Act risk classification per AI system
- Control mapping: ISO 42001 ↔ ISO 27001 ↔ SOC 2 ↔ NIST AI RMF
- Prioritised remediation roadmap with effort estimates
- Executive readiness report and live briefing
The outcome
You finish with a credible, evidence-backed answer to "how far are we from ISO 42001, and what will it cost?" — and a roadmap you can execute with us or without us.
Usually followed by
Full AIMS Implementation
A 3–6 month engagement that builds your entire AI Management System — documentation, technical controls, and automated evidence — to the point where you are audit-ready.
Full Implementation detailOther engagements
- 3–6 months, depending on scope and AI system countFull ImplementationA 3–6 month engagement that builds your entire AI Management System — documentation, technical controls, and automated evidence — to the point where you are audit-ready.
- 4–8 weeks, plus audit daysAudit SupportWe prepare your evidence, rehearse your team, and sit with you through Stage 1 and Stage 2 so the audit is an inspection, not an interrogation.
- Monthly, 3-month minimum, cancel with 30 days' noticeFractional RetainerOngoing senior AI governance capacity — legal and technical — for companies that need the function but not two full-time hires.
Next step
Talk to us about gap assessment
A 30-minute call with our team. We will scope it properly, tell you what it costs, and tell you if a different engagement is a better fit for where you actually are.