← All checklists
ISO 42001:2023 readiness checklist
Every ISO/IEC 42001:2023 AI management system clause and Annex A control an organization has to act on, mapped to its clause or control number, with the evidence a certification auditor will ask for. Preview 11 of the 65 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers ISO/IEC 42001 2023Reviewed 30 Oct 202665 items · 9 sections
Clauses 4 and 5. Context and leadership
7 items
- 4.1Identify the internal and external issues that affect your AI management system, and your role as AI provider, producer, user or customer.Evidence: Context analysis including your documented AI roles.
Clause 6. Planning
6 items
- 6.1.1Determine the risks and opportunities the AIMS must address, and define acceptable versus unacceptable AI risk.Evidence: Risk criteria and planning records.
Clauses 7 and 8. Support and operation
9 items
- 7.1Provide the people, budget and tools needed to run the AIMS.Evidence: Resource plan or budget allocation.
Clauses 9 and 10. Evaluation and improvement
5 items
- 9.1Decide what to measure about AIMS performance, measure it, and analyze the results.Evidence: AIMS metrics reports.
Annex A.2 to A.4. Policies, organization and resources
10 items
- A.2.2Document an AI policy for developing or using AI systems.Evidence: Approved AI policy.
- A.2.3Check where AI touches other policies, such as security, privacy and quality, and align them.Evidence: Policy alignment review.
Annex A.5 and A.6.1. Impact assessment and development objectives
6 items
- A.5.2Set up a process to assess the potential consequences of AI systems for people and society.Evidence: Impact assessment procedure.
Annex A.6.2. AI system life cycle
7 items
- A.6.2.2Specify and document requirements for new AI systems or major changes.Evidence: Requirements specifications.
Annex A.7. Data for AI systems
5 items
- A.7.2Define and run data management processes for developing and improving AI systems.Evidence: Data management procedure for AI.
Annex A.8 to A.10. Interested parties, use and third parties
10 items
- A.8.2Give users the information they need about the AI system, including its limits.Evidence: User documentation and in-product notices.
- A.8.3Give interested parties a way to report adverse impacts of the AI system.Evidence: External reporting channel and report log.
Changelog
- v1.030 Oct 2026First release. Covers ISO/IEC 42001:2023 clauses 4 to 10 and all 38 Annex A controls.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.