ISO 42001 checklist for small teams

Gap review versus certification work

An initial ISO 42001 gap checklist helps a small team understand whether it has the basic management-system ingredients: scope, ownership, policy, inventory, risk review, supplier evidence, training records, monitoring, management review, and improvement tracking. It is not certification, audit assurance, or legal advice.

ISO 42001 audit checklist versus gap checklist

An ISO 42001 audit checklist is usually used to test whether management-system requirements are implemented and evidenced. A gap checklist is earlier and more practical for small teams: it identifies missing owners, records, policies, reviews, and corrective actions before the organization speaks with an auditor or certification body.

• Use a gap checklist when the team is still building its AI management evidence base.
• Use an audit checklist when the management system is already operating and evidence can be sampled.
• Do not describe the company as ISO 42001 certified or audit-ready unless a qualified process has confirmed it.

Governance ownership and evidence

The first practical question is who owns the AI management work. Without ownership, policies age, inventories become stale, supplier evidence is not refreshed, and management review does not happen. Evidence should be dated and attached to a decision, not stored as undated screenshots or unreviewed trust-center links.

• AI policy owner and backup owner
• AI inventory owner
• Risk and impact reviewer
• Supplier or vendor evidence owner
• Training and competence owner
• Management review sponsor

Records small teams should inspect first

A useful checklist starts with operating records the team can actually maintain. Look for an AI system inventory, risk register, vendor evidence matrix, approved-tools list, training attendance, exception log, incident path, management review agenda, and corrective-action tracker.

When specialist support is needed

Bring in qualified certification, legal, privacy, security, or regulatory support when the organization is pursuing formal certification, deploying high-impact AI systems, handling regulated data, making employment or eligibility decisions, or making customer-facing claims about compliance readiness.

Supplier and vendor evidence

Supplier evidence belongs in the gap review because many AI systems are delivered through external tools. Small teams should capture whether the vendor explains model-training use, prompt and file retention, deletion rights, subprocessors, enterprise controls, audit evidence, security documentation, and contract terms. The checklist should not treat a trust-center link as enough unless someone reviewed and dated the evidence.

Corrective-action tracking

A useful checklist ends with actions, not a score alone. Each gap should become an owner-backed action with priority, target date, evidence expected, dependency, and review status. This creates an improvement record that management can revisit without claiming that the team is certified or fully compliant.

Monitoring and management review

The checklist should ask whether management receives enough information to make decisions about AI use. Useful inputs include new AI systems, open risk items, supplier issues, training completion, incidents, exceptions, overdue corrective actions, and changes in company AI use. This keeps the checklist connected to an operating rhythm instead of a one-time document exercise.