Services / Packages
ISO/IEC 42001 Gap Assessment
An assessment of your AI management system against ISO/IEC 42001, the international standard for governing AI.
From $7,5004–6 weeks
Public agencies receive quotes structured to fit their procurement rules.
You own everything we produce.
Who this is for
Organizations usually call us about this when:
A customer added ISO 42001 to its vendor security questionnaire.
You already hold ISO 27001 or ISO 9001 and want to know what ISO 42001 adds.
Leadership wants a clear cost and timeline before committing to certification.
Overview
ISO/IEC 42001 sets requirements for how an organization governs AI, from leadership and risk assessment to controls and continual improvement. We assess where you stand against each clause and the Annex A controls, review your evidence, and give you a plan to reach certification readiness.
What’s included
- Clause-by-clause gap analysis against ISO/IEC 42001
- Review of Annex A controls and their applicability
- Review of documentation and evidence
- Assessment of AI risk and impact assessment processes
- A certification readiness plan
- A findings readout for leadership
How it works
Plan
We confirm scope, the AI systems covered, and your certification goals.
Assess
We review documentation, interview owners, and test evidence against each requirement.
Roadmap
You receive the gap analysis and a plan to reach readiness.
How it works for your organization
The same service, tailored to the obligations and realities of each sector.
Private Sector
Companies pursue ISO/IEC 42001 to prove responsible AI to customers, partners, and regulators.
- Readiness for customer audits and enterprise procurement
- Alignment with existing ISO/IEC 27001 programs
- Evidence for EU AI Act and state law obligations
- A path to third-party certification
Public Sector
Agencies and public institutions use ISO/IEC 42001 as a recognized benchmark for AI oversight.
- A structured framework for agency-wide AI governance
- Requirements agencies can reference in vendor contracts
- Evidence of oversight for auditors and oversight bodies
- Alignment with state AI policies
Nonprofits
Larger nonprofits use ISO/IEC 42001 to show funders and partners that AI is governed responsibly.
- A recognized standard to cite in grant and partner applications
- Controls for AI used with client or health data
- A phased approach that fits nonprofit budgets
- Readiness without committing to certification right away
Frequently asked questions
How much does ISO/IEC 42001 Gap Assessment cost?
ISO/IEC 42001 Gap Assessment starts at $7,500. The final price depends on scope, and we confirm it in writing before any work begins.
How long does it take?
Most engagements take 4–6 weeks, depending on scope and how quickly information is available.
What do we receive?
The engagement includes: clause-by-clause gap analysis against ISO/IEC 42001; review of Annex A controls and their applicability; review of documentation and evidence; assessment of AI risk and impact assessment processes.
What if a deliverable doesn’t meet the agreed scope?
We revise it until it does, at no extra cost. And if we miss an agreed delivery date, we take 10% off that deliverable.
Who owns the deliverables?
You do. Everything we produce for you is yours to keep, use, and share.
Related Guides
- AI Governance Blueprint for Credit UnionsWho owns AI decisions at a credit union, how new AI uses get approved, how the board oversees AI, and how to size the structure to your asset size.
- AI Risk Register for Credit UnionsA sample register of common credit union AI uses, the data each one touches, its risk tier, the controls it needs, and who owns it.
- AI Impact Assessment Example for Credit UnionsA worked example assessing an automated personal loan decision model, from purpose and data to risks, controls, and approval.
- AI Laws by StateWhere each state’s AI and privacy rules stand, with key dates and a page for every state.
Related services
AI Governance Readiness Assessment
A gap analysis of your AI governance against the NIST AI RMF, with a prioritized plan for what to fix first.
AI Risk Review
An independent review of one AI tool, vendor, or use case before you adopt it or expand it.
Fractional Chief AI or Privacy Officer
A named senior executive who owns your AI governance or privacy program and reports to your leadership.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.