ISO 42001 checklist: 20 points to check before you certify

ISO 42001 follows the same high level structure as ISO 9001 and ISO 27001. Clauses 4 to 10 describe the management system itself. Annex A adds the controls that apply specifically to AI systems. The checklist below goes through the clauses in order, so you can tick off points with the person who owns each topic.

Most companies have more evidence than they expect. A policy in the intranet, a risk list kept by the IT lead, supplier contracts with data clauses: these count. What is usually missing is the link between them, meaning one scope, one owner and one review rhythm.

Settle three questions before you start the clauses.

AI inventory

A list of every AI system you build, provide or use, including tools bought from suppliers. Without it, scope and risk assessment have no basis.

Your role

The standard asks you to determine whether you act as AI provider, producer or user. Many firms are more than one at the same time.

Scope

Decide which AI systems, teams and locations the management system covers. A narrow, honest scope is better than a broad one you cannot maintain.

• ISO standards for small and medium businesses

These points are about direction. Auditors and assessors look here first, because a missing policy or an unnamed owner makes everything else hard to judge.

1. 01

   Internal and external issues are identified

   Think of customer expectations, regulation, technology dependencies and your own AI ambitions. Evidence: workshop notes or a short context paper.

2. 02

   Interested parties and their requirements are listed

   Customers, employees, regulators and the people affected by AI outputs. Evidence: a stakeholder list with the requirement of each party.

3. 03

   The scope is written down

   Evidence: a scope statement that refers to the AI inventory.

4. 04

   An AI policy is approved by management

   Evidence: a signed policy, communicated to staff, for example on the intranet.

5. 05

   Roles and responsibilities are assigned

   Someone is accountable for AI governance, and someone owns each AI system. Evidence: role descriptions, an organisation chart or a responsibility matrix.

6. 06

   Management provides resources

   Evidence: budget decisions, project approvals or meeting minutes that mention the AI management system.

Clause 6 is the core of ISO 42001. Besides the usual risk assessment, the standard requires an impact assessment for the people your AI systems affect. This is the part most companies have not done before.

1. 01

   An AI risk assessment method is defined

   Criteria for likelihood and severity, and a rule for what is acceptable. Evidence: a method document of one or two pages.

2. 02

   Risks are recorded per AI system

   Evidence: a risk register with owner, rating and status.

3. 03

   Risks are treated and a Statement of Applicability exists

   For each Annex A control you state whether it applies and why. Evidence: the Statement of Applicability and a treatment plan.

4. 04

   Impact assessments are carried out

   For each relevant AI system you assess effects on individuals and groups, such as unfair outcomes or loss of privacy. Evidence: completed assessment forms.

5. 05

   AI objectives are measurable

   Evidence: a list of objectives with owner, target and date.

6. 06

   People who build or use AI are competent and aware

   Evidence: training records, onboarding material, proof of qualifications.

7. 07

   Documented information is controlled

   Evidence: a document register or a wiki with version history and approval.

Here the standard checks whether the system runs in daily work and not only on paper. Evidence is mostly records that your teams create anyway.

1. 01

   Life cycle controls are applied

   From design and training to release and retirement. Evidence: test reports, release approvals, change records.

2. 02

   Data for AI systems is managed

   Origin, quality and permitted use of training and input data. Evidence: data descriptions, source records, licence or contract terms.

3. 03

   Third-party AI is assessed

   Models, APIs and tools from suppliers are part of your risk picture. Evidence: supplier assessments and contract clauses.

4. 04

   Operation is monitored

   Performance, errors and incidents are tracked. Evidence: a monitoring dashboard and an incident log.

5. 05

   An internal audit has been planned and held

   Evidence: audit plan, findings, report.

6. 06

   Management reviews the system

   Evidence: minutes that cover results, risks and decisions.

7. 07

   Nonconformities lead to corrective action

   Evidence: a log of issues with cause, action and closing date.

The table collects the typical evidence per clause and the person who usually holds it. A company of 20 to 50 people can cover all of it in a few documents and registers. A manual of hundreds of pages is not needed.

• Compare the certification routes

Once the points above are covered, the online self-assessment is the next step. It has 40 yes/no questions on ISO 42001. Thirteen of them are mandatory requirements of the standard and all must be answered yes. Among the other 27 you need at least 18 yes answers to pass.

There is no on-site audit. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. After you pass and pay, the certificate arrives within 4 hours as a PDF with a number and a QR code. Your customers can check it on the public verification page.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. You can cancel in your customer account at any time to the end of the paid year.

• Start the free self-assessment
• ISO 42001 certificate at Zertify
• See pricing