Toolkit
ISO/IEC 42001 readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Any organisation that develops, provides or uses AI systems and wants a structured, auditable AI governance programme.
Scope
- Covers the whole AI life cycle: design, data, deployment, monitoring and retirement
- Scope starts with your role for each AI system — developer, provider, customer or user can differ by system
- Voluntary — demand mostly comes from customers and procurement requirements, not law
Key requirements
- Inventory every AI system in use, including vendor features and shadow AI
- Define roles and scope for each system or category
- Set an AI policy and objectives aligned to legal obligations and organisational values
- Run AI risk assessment and treatment, covering AI-specific sources like data quality, model drift and lack of transparency
- Run an AI system impact assessment — the consequences for individuals, groups and society, separate from organisational risk
- Select controls from Annex A and record them in a Statement of Applicability
- Operate and monitor: track performance, drift, incidents and complaints
Evidence to gather
- AIMS scope, AI policy and objectives
- AI system inventory with role definitions
- AI risk assessments, treatment plans and Statement of Applicability
- AI system impact assessments
- Life-cycle records: requirements, design decisions, test and validation results
- Data provenance, quality and preparation records
- Monitoring results and incident records
Common gaps
- Treating it as a technical standard for data scientists rather than a governance and management-system standard
- Skipping the impact assessment — organisational risk registers often miss harm to people outside the organisation
- No maintained AI inventory, so scope and controls drift quickly
- Assuming certification says anything about a specific model's fairness or safety — it certifies the management system, not the model
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full ISO/IEC 42001 guide, the official text, or a qualified adviser.