Preparing for Your First ISO 42001 Audit
A concrete 90-day plan for AI companies pursuing ISO 42001 for the first time, written by teams who have shipped it.
Most first-time ISO 42001 audits fail on evidence completeness, not on control design. A tight 90-day plan focuses on making evidence produceable rather than on writing more policies.
Days 0–30: scope and gap
Pick the AI systems in scope, document their intended purpose, and run a gap analysis against the standard's clauses. Assign owners for each control.
Days 30–60: instrumentation
Turn the highest-risk controls into instrumented artifacts: decision logs, bias metrics, deployment records, and impact assessment templates linked to model versions.
Days 60–90: dry run
Run an internal audit. Have someone outside the AI team try to answer the standard's questions using only your systems. Where they fail, that is your real gap list.