Context and scope
AI inventory, roles, interested parties and management-system boundaries.
A simple view
Eight areas that make the standard easier to navigate
The checklist summarises clauses 4–10 and the Annex A control groups in understandable blocks. It does not turn the standard into 38 mandatory tick boxes.
Leadership and governance
Policy, accountability, authority, objectives and escalation channels.
Risk and impact
Criteria, assessments, treatment and the Statement of Applicability.
Resources and competence
People, assets, training, communication and controlled evidence.
Lifecycle
Requirements, validation, deployment, monitoring, change and retirement.
Data for AI
Origin, rights, quality, representativeness, preparation and traceability.
Transparency, use and third parties
Information, human oversight, incidents, suppliers and customers.
Evaluation and improvement
Metrics, audit, management review and corrective action.
Answer from evidence
Assess what exists and can be demonstrated today, not what is merely planned.
Compare eight areas
The 2–1–0 score reveals strengths and gaps instead of hiding them in an average.
Turn gaps into actions
Get ordered priorities and a local PDF to organise the next steps.
What the result means
This tool measures an indicative level of readiness. It does not declare conformity, decide whether an organisation can be certified or prove compliance with the EU AI Act. That requires review of scope, applicability, evidence and the actual effectiveness of processes.
Everything is calculated in your browser: answers are not sent, stored or transferred from your device. The PDF is also generated locally. There are no cookies, analytics or usage measurement.
Before you start
Answer according to what exists today and could be demonstrated, not what is planned. If you need context, read ISO/IEC 42001: what it is, how it works and where to start.
No fine print
Frequently asked questions
What does this ISO 42001 checklist assess?
It provides an indicative assessment of 24 practices across eight areas: context, governance, risk and impact, resources, lifecycle, data, transparency and third parties, and improvement.
Does the score confirm compliance with ISO/IEC 42001?
No. The score indicates readiness and does not determine conformity, certification or compliance with the EU AI Act.
Where are my answers stored?
They are not stored on any server. The calculation and PDF are generated locally in your browser; your answers are neither sent nor retained.
How is the result calculated?
Each Yes answer scores 2 points, Partly 1 and No 0. Not applicable is excluded, and every applicable question has equal weight.
Does the checklist replace an ISO 42001 audit?
No. It helps organise a starting point but does not replace the official standard, an applicability analysis, evidence review or an audit.
Ready to work on requirement 5.2? Use the AI policy guide with a free editable Word template to define commitments, owners and evidence.
Sources and scope
ReferencesISO/IEC 42001:2023, official page · UNE-EN ISO/IEC 42001:2026 · ACBSEC practical guide
The questions are a plain-language synthesis and do not reproduce the standard. Content reviewed on 9 September 2026.
Your assessment
Answer according to today’s reality
Four blocks with six questions each. You can go back without losing answers while this page remains open.
0%Readiness
Indicative result
—
Your readiness by area
Do not look only at the lowest bar: consider the dependencies between governance, risk, data and operation.
Suggested priorities
These are the first issues to turn into actions, starting with answers marked “No”.
Want to turn the result into a proportionate plan?
We can validate scope, review evidence and turn gaps into owners, priorities and actions the organisation can maintain.