ISO 42001 checklist

Tick off the 17 documents and records an auditor will ask for, the 27 clause 4 to 10 requirements and the 38 Annex A controls. Progress updates as you go, and the whole checklist downloads as a CSV for Excel or a Word document.

Nothing you tick or type leaves your browser. A self-assessment, not an audit or certification.

Organisation name (optional, used only in your Word download)

0 of 82 done · 0%

Clause 4 Context of the organisation 0 / 4

4.1 Context and your AI roles
You have recorded the internal and external issues that affect your AI work and the roles you play (for example developer, provider or user of AI systems). Evidence: Context analysis naming your AI roles; list of internal and external issues.
4.2 Interested parties
You know who has a stake in your AI systems (customers, regulators, affected people, staff) and which of their requirements you will meet. Evidence: Register of interested parties and their requirements.
4.3 Scope of the AI management system
The boundaries are written down: which AI systems, teams, sites and activities are in or out of scope, and why. Evidence: Approved scope statement.
4.4 The management system itself
The processes of the AI management system and how they connect are set up, run, maintained and improved. Evidence: Process map or management system manual.

Clause 5 Leadership 0 / 3

5.1 Leadership commitment
Top management visibly backs the AI management system: it provides resources, builds it into business processes and directs people to support it. Evidence: Executive meeting minutes; approved budget.
5.2 AI policy
Top management has approved an AI policy that sets direction, commits to meeting requirements and to improvement, and has been communicated. Evidence: Signed AI policy; record that it was communicated.
5.3 Roles, responsibilities and authorities
Responsibility for the AI management system is assigned, including who reports on its performance to top management. Evidence: RACI chart; role descriptions.

Clause 6 Planning 0 / 6

6.1.1 Risks and opportunities for the system
Risks and opportunities that could affect what the management system achieves are identified, and actions are planned. Evidence: Risk and opportunity log for the management system.
6.1.2 AI risk assessment method
A defined, repeatable method assesses AI risks, with criteria for when a risk is acceptable. Evidence: AI risk methodology; AI risk register.
6.1.3 AI risk treatment and Statement of Applicability
Each AI risk has a chosen treatment; controls were compared with Annex A; a Statement of Applicability and a treatment plan are approved by the risk owners. Evidence: Risk treatment plan; Statement of Applicability; risk owner sign-off.
6.1.4 AI system impact assessment process
A process exists to assess the possible consequences of your AI systems for individuals, groups and society. Evidence: Impact assessment procedure.
6.2 AI objectives
AI objectives are measurable, have owners, resources and deadlines, and are tracked. Evidence: Objectives register with measures.
6.3 Planning of changes
Changes to the AI management system are planned and made in a controlled way. Evidence: Change log for the management system.

Clause 7 Support 0 / 5

7.1 Resources
The people, budget and tools needed for the management system are identified and provided. Evidence: Resource plan; budget line.
7.2 Competence
The competence needed for AI work is defined, and gaps are closed through training, mentoring or hiring. Evidence: Skills matrix; training records.
7.3 Awareness
People know the AI policy, how they contribute, and what happens if the system isn't followed. Evidence: Awareness training completion records.
7.4 Communication
You have decided what to communicate about the AI management system, when, to whom and how. Evidence: Communication plan.
7.5 Documented information
Required documents and records are created, approved, version-controlled, protected and kept. Evidence: Document control procedure; document register.

Clause 8 Operation 0 / 4

8.1 Operational planning and control
AI processes run to defined criteria and controls, including processes you outsource. Evidence: Operating procedures; supplier controls.
8.2 AI risk assessments carried out
AI risk assessments are run at planned intervals and when significant changes happen, and the results are kept. Evidence: Dated AI risk assessments.
8.3 AI risk treatment carried out
The AI risk treatment plan is being implemented and its effect is checked. Evidence: Treatment plan status report.
8.4 AI system impact assessments carried out
Impact assessments are completed for your AI systems at planned intervals and on significant change. Evidence: Completed impact assessments.

Clause 9 Performance evaluation 0 / 3

9.1 Monitoring and measurement
You have decided what to monitor and measure, how and when, and you evaluate the results. Evidence: Monitoring reports; KPI dashboard.
9.2 Internal audit
An internal audit programme checks the management system at planned intervals, with objective auditors. Evidence: Audit programme; internal audit reports.
9.3 Management review
Top management reviews the management system at planned intervals and records its decisions. Evidence: Management review minutes.

Clause 10 Improvement 0 / 2

10.1 Continual improvement
You keep improving how suitable, adequate and effective the management system is. Evidence: Improvement log.
10.2 Nonconformity and corrective action
Nonconformities are corrected, root causes are found, corrective actions are taken and records are kept. Evidence: Corrective action log.

A.2 Policies related to AI 0 / 3

A.2.2 AI policy
A documented policy guides how you develop, provide or use AI systems. Evidence: AI policy document.Not applicable
A.2.3 Alignment with other policies
The AI policy fits with your other policies, such as security, privacy and quality. Evidence: Policy cross-reference or mapping.Not applicable
A.2.4 Review of the AI policy
The AI policy is reviewed at planned intervals and when something significant changes. Evidence: Policy review record.Not applicable

A.3 Internal organisation 0 / 2

A.3.2 AI roles and responsibilities
Roles and responsibilities for AI are defined and allocated to named people. Evidence: Role descriptions; AI RACI.Not applicable
A.3.3 Reporting of concerns
People can raise concerns about AI systems through a defined channel, without fear of reprisal. Evidence: Concern-reporting procedure; channel details.Not applicable

A.5 Assessing impacts of AI systems 0 / 4

A.5.2 Impact assessment process
A process assesses the potential consequences of AI systems before and during use. Evidence: Impact assessment procedure.Not applicable
A.5.3 Documenting impact assessments
Impact assessment results are documented and kept for a defined period. Evidence: Stored impact assessment reports.Not applicable
A.5.4 Impact on individuals and groups
Impacts on people's rights, fairness, safety and wellbeing are assessed. Evidence: Individual and group impact analysis.Not applicable
A.5.5 Societal impacts
Wider effects on society (for example environment, employment, public trust) are assessed. Evidence: Societal impact analysis.Not applicable

A.8 Information for interested parties 0 / 4

A.8.2 Information for users
Users receive the information they need to use the AI system appropriately, including its limits. Evidence: User documentation; AI notices.Not applicable
A.8.3 External reporting
Interested parties can report adverse impacts of your AI systems. Evidence: External reporting channel.Not applicable
A.8.4 Communicating incidents
There is a plan to tell users and others about AI incidents. Evidence: Incident communication plan.Not applicable
A.8.5 Information for interested parties
Obligations to report information about AI systems to interested parties are identified and met. Evidence: Register of reporting obligations.Not applicable

A.9 Use of AI systems 0 / 3

A.9.2 Processes for responsible use
Processes define how AI systems are used responsibly in your organisation. Evidence: Responsible use procedure.Not applicable
A.9.3 Objectives for responsible use
Objectives guide the responsible use of AI systems. Evidence: Responsible use objectives.Not applicable
A.9.4 Intended use and human oversight
AI systems are used only as intended and documented, with human oversight where it matters. Evidence: Intended use statements; oversight records.Not applicable

A.10 Third-party and customer relationships 0 / 3

A.10.2 Allocating responsibilities
Responsibilities are split clearly between you, partners, suppliers and customers. Evidence: Responsibility matrix in contracts.Not applicable
A.10.3 Suppliers
Suppliers of AI models, services and data are assessed and held to your responsible-AI requirements. Evidence: Supplier assessments; contract clauses.Not applicable
A.10.4 Customers
Customer needs and expectations are considered in how you provide AI systems. Evidence: Customer requirements; terms of use.Not applicable

ISO 42001 templates

Free on this site: the gap assessment gives a draft Statement of Applicability and remediation plan (.xlsx with live formulas) and a gap report (.docx); this page gives the checklist as .csv and .docx. For the policy, registers and assessment workbooks themselves, the AI Governance Toolkit from Agent Trust Cloud is an instant download:

Starter: AI use and governance policy (Word), AI system inventory and risk register (Excel), AI system risk assessment (Excel) and a 30-day start-here plan.
Professional: Everything in Starter, plus an ISO/IEC 42001 gap assessment workbook, a NIST AI RMF mapping, AI vendor contract clauses and a days 31–90 plan toward an ISO/IEC 42001 certification audit.

Paid options

AI Governance Toolkit (instant download)

AI Governance Toolkit Starter

$199 one-time

AI use and governance policy (Word), AI system inventory and risk register (Excel), AI system risk assessment (Excel) and a 30-day start-here plan.

Buy: AI Governance Toolkit Starter, $199

AI Governance Toolkit Professional

$599 one-time

Everything in Starter, plus an ISO/IEC 42001 gap assessment workbook, a NIST AI RMF mapping, AI vendor contract clauses and a days 31–90 plan toward an ISO/IEC 42001 certification audit.

Buy: AI Governance Toolkit Professional, $599

Pay by card · instant download · all sales final (refund policy)

Prices in US dollars.

How to use the checklist

Start with the documents: most audit findings begin with a record that doesn't exist.
Work through clauses 4 to 10. All of them apply; none can be excluded.
For Annex A, mark controls that don't apply to your AI systems as not applicable and write down why for your Statement of Applicability. The Annex A controls guide explains each one.
When a section is complete, run the gap assessment for a scored view and target dates, then read how certification works.

Questions

What documents does ISO 42001 require?

Our summary of the clauses gives 17 documents and records: scope of the AI management system, aI policy, aI risk assessment method, aI risk treatment plan, statement of Applicability, aI system impact assessment process, aI objectives, evidence of competence, document control, operational records, aI risk assessment results, aI risk treatment results, aI system impact assessment results, monitoring and measurement results, internal audit programme and reports, management review records, nonconformity and corrective action log. Check the standard's own text for the definitive list.

Is there an ISO 42001 checklist for Excel?

Yes. Download this checklist as CSV and it opens in Excel, Google Sheets or Numbers with your ticks in the Status column. The gap assessment also gives a Statement of Applicability workbook with live formulas.

Does completing the checklist make us compliant?

No. It tracks whether each document, requirement and control is in place. Only an audit by an accredited certification body leads to a certificate.

Is my progress saved?

No. The checklist runs in this page and nothing is stored or sent. Download the CSV or Word file to keep it.

Sources

ISO/IEC 42001:2023 (ISO): edition 1, published December 2023, 51 pages, ISO/IEC JTC 1/SC 42.
Each source was opened and checked on 1 October 2026.