ISO 42001 gap assessment for UK organisations

You have recorded the internal and external issues that affect your AI work and the roles you play (for example developer, provider or user of AI systems).

You know who has a stake in your AI systems (customers, regulators, affected people, staff) and which of their requirements you will meet.

The boundaries are written down: which AI systems, teams, sites and activities are in or out of scope, and why.

The processes of the AI management system and how they connect are set up, run, maintained and improved.

Top management visibly backs the AI management system: it provides resources, builds it into business processes and directs people to support it.

Top management has approved an AI policy that sets direction, commits to meeting requirements and to improvement, and has been communicated.

Responsibility for the AI management system is assigned, including who reports on its performance to top management.

Risks and opportunities that could affect what the management system achieves are identified, and actions are planned.

A defined, repeatable method assesses AI risks, with criteria for when a risk is acceptable.

Each AI risk has a chosen treatment; controls were compared with Annex A; a Statement of Applicability and a treatment plan are approved by the risk owners.

A process exists to assess the possible consequences of your AI systems for individuals, groups and society.

AI objectives are measurable, have owners, resources and deadlines, and are tracked.

Changes to the AI management system are planned and made in a controlled way.

The people, budget and tools needed for the management system are identified and provided.

The competence needed for AI work is defined, and gaps are closed through training, mentoring or hiring.

People know the AI policy, how they contribute, and what happens if the system isn't followed.

You have decided what to communicate about the AI management system, when, to whom and how.

Required documents and records are created, approved, version-controlled, protected and kept.

AI processes run to defined criteria and controls, including processes you outsource.

AI risk assessments are run at planned intervals and when significant changes happen, and the results are kept.

The AI risk treatment plan is being implemented and its effect is checked.

Impact assessments are completed for your AI systems at planned intervals and on significant change.

You have decided what to monitor and measure, how and when, and you evaluate the results.

An internal audit programme checks the management system at planned intervals, with objective auditors.

Top management reviews the management system at planned intervals and records its decisions.

You keep improving how suitable, adequate and effective the management system is.

Nonconformities are corrected, root causes are found, corrective actions are taken and records are kept.

A documented policy guides how you develop, provide or use AI systems.

The AI policy fits with your other policies, such as security, privacy and quality.

The AI policy is reviewed at planned intervals and when something significant changes.

Roles and responsibilities for AI are defined and allocated to named people.

People can raise concerns about AI systems through a defined channel, without fear of reprisal.

The resources each AI system needs across its life cycle are identified and documented.

The data used by each AI system is documented.

Tools, frameworks, libraries and models in use are documented.

Computing and infrastructure resources are documented.

The people and skills needed at each life cycle stage are documented.

A process assesses the potential consequences of AI systems before and during use.

Impact assessment results are documented and kept for a defined period.

Impacts on people's rights, fairness, safety and wellbeing are assessed.

Wider effects on society (for example environment, employment, public trust) are assessed.

Objectives for responsible AI development are set and built into the development process.

Design and development follow defined processes with responsible-AI checkpoints.

Requirements for new AI systems, or significant changes, are specified and agreed.

Design choices and development work are documented.

AI systems are tested against defined acceptance criteria before release and after changes.

A deployment plan is followed and release requirements are met before go-live.

AI systems in use are monitored for performance, errors, drift and misuse, with a plan to act.

Technical documentation is available to those who need it (users, partners, authorities).

AI systems record event logs at the right stages, and the logs are kept.

Data management processes cover the data used to develop and improve AI systems.

Where data comes from, and your right to use it, are recorded.

Data quality requirements are defined and data is checked against them.

The origin and history of data can be traced through the life cycle.

Methods used to prepare data (cleaning, labelling, transformation) are defined and documented.

Users receive the information they need to use the AI system appropriately, including its limits.

Interested parties can report adverse impacts of your AI systems.

There is a plan to tell users and others about AI incidents.

Obligations to report information about AI systems to interested parties are identified and met.

Processes define how AI systems are used responsibly in your organisation.

Objectives guide the responsible use of AI systems.

AI systems are used only as intended and documented, with human oversight where it matters.

Responsibilities are split clearly between you, partners, suppliers and customers.

Suppliers of AI models, services and data are assessed and held to your responsible-AI requirements.

Customer needs and expectations are considered in how you provide AI systems.