AI inventory
Identify AI systems, AI features in existing software, suppliers and intended uses within the proposed scope.
ISO 42001 Gap Assessment
An ISO 42001 gap analysis compares how your organisation governs AI today with the requirements of ISO/IEC 42001:2023, the international standard for an artificial intelligence management system (AIMS). Umbrella Tech maps the AI you build, provide or use, reviews your policies, risk decisions and controls against the standard, and gives you a clear gap register and a prioritised plan towards a working AIMS.
When this assessment is useful
An ISO 42001 gap assessment helps when a customer or tender asks how AI is governed, when AI is moving from experiments into products or core processes, or when leadership wants to know how far the organisation is from certification. It also suits organisations with ISO/IEC 27001 that want to extend their management system to AI.
Assessment scope
Management system clauses
Review context, leadership, AI policy, planning, support, operation, evaluation and improvement.
Risk and impact
Examine how AI risks are assessed and treated, and whether AI system impact assessment exists.
Annex A controls
Review the reference controls relevant to your AI use and current practice.
Evidence and access
Depending on scope, evidence may include AI and data policies, AI tool and supplier lists, project and change records, risk registers, existing ISO/IEC 27001 documents, and interviews with the owners of AI systems. We agree what is needed and how it is handled before the assessment begins.
AI and data policies
AI tool and supplier lists
Project and change records
Risk registers
Existing ISO/IEC 27001 documents
Interviews with the owners of AI systems
Findings that lead to action
You receive a gap register linked to the clauses and Annex A controls, a draft AI inventory, and a prioritised roadmap. Findings distinguish missing processes, informal practice that needs recording, and controls that already work.
Illustrative findingsExamples only
- ExampleAI features enabled in business software without an approval record
- ExampleSupplier model used with no documented review of its terms or data handling
- ExampleAI risk discussed in meetings but never assessed against agreed criteria
These are examples of what a gap analysis can uncover, not findings about your organisation.
How it runs
Assessment method
01
Confirm the scope
Agree which AI systems, teams and locations are in scope and who to involve.
02
Map AI use
Build an initial inventory of AI systems, features and suppliers.
03
Review against the standard
Examine documents, records and practice against the clauses and relevant Annex A controls.
04
Report and plan
Present the gap register and agree a realistic sequence for closing it.
From assessment to remediation
The roadmap can lead into ISO 42001 Readiness or ISO 42001 Implementation, delivered by us or your own team. Technical findings about AI tools often connect with our AI & Automation services.
Assessment outputFindings and remediation roadmap
Umbrella TechWe deliver the improvements
DesignImplementValidate
Your organisationYour internal team
Your partnerYour existing technology provider
ISO/IEC 42001
ISO/IEC 42001 defines requirements for an artificial intelligence management system (AIMS) and uses the same harmonised structure as ISO/IEC 27001.
About ISO/IEC 42001 services →Preparing for certification
A gap analysis supports readiness; it is not a certification audit. Certification is voluntary and assessed separately by an independent certification body.
Gap assessmentUmbrella Tech
Remediation and implementationUmbrella Tech with your team
Operate and build evidenceYour organisation
External certification or assessmentIndependent body
Frequently asked questions
Can't see your question? Ask us directly →
What does an ISO 42001 gap analysis include?
An AI inventory, a review of the management system clauses, AI risk and impact processes and relevant Annex A controls, then a gap register and prioritised roadmap.
How long does the assessment take?
It depends on the number of AI systems and teams in scope, whether you build or only use AI, and existing documentation. We confirm scope and timing in discovery.
What evidence or access is required?
Existing policies and registers, a list of AI tools and suppliers if you have one, and time with the people who approve, build and use AI. We agree the list first.
What happens after the assessment?
You choose how to close the gaps. We can build the AIMS with you, support your team, or run a readiness check before you engage a certification body.
How much does it cost?
Cost depends on scope, the complexity of your AI use and whether an existing management system can be reused. We confirm scope and cost in discovery.
Establish your current position
Tell us how your organisation uses or builds AI and who is asking about governance. We will scope a gap analysis that gives you a clear starting point.