Documented system
Confirm the AIMS scope, AI policy, roles and required documents are complete and approved.
ISO 42001 Readiness
An ISO 42001 readiness assessment checks whether your artificial intelligence management system (AIMS) is ready for an external audit against ISO/IEC 42001:2023. Umbrella Tech reviews whether your AI policy, risk and impact assessments, controls, internal audit and management review are in place and producing records, then tells you what still stands between you and a certification audit.
When this assessment is useful
ISO 42001 readiness is the right check when an AIMS has been designed or implemented and you are considering engaging a certification body. It differs from a gap analysis: rather than asking what is missing from scratch, it tests whether the system you have built operates and can be shown to operate. It also helps after a major change, such as new AI products or suppliers entering scope.
Assessment scope
Operation
Test whether AI risk assessments, AI system impact assessments and approvals are happening for real AI uses.
Controls
Check selected Annex A controls against the Statement of Applicability or equivalent record.
Evaluation
Review internal audit, management review, objectives and corrective actions.
Evidence and access
Depending on scope, evidence may include AIMS core documents, AI inventory records, completed risk and impact assessments, approval records, supplier reviews, internal audit reports, and management review minutes. We agree access and handling before the assessment begins.
AIMS core documents
AI inventory records
Completed risk and impact assessments
Approval records
Supplier reviews
Internal audit reports
Management review minutes
Findings that lead to action
You receive a readiness rating for each area, a list of issues an auditor would be likely to raise, and the actions needed before an audit. Findings separate documentation gaps from evidence that the system is not yet operating.
Illustrative findingsExamples only
- ExampleImpact assessments completed for one AI system but not others in scope
- ExampleInternal audit that has not covered all clauses
- ExampleManagement review minutes that do not record decisions about AI objectives
These are examples of what a readiness review can uncover, not findings about your organisation.
How it runs
Assessment method
01
Confirm scope and target
Agree the AIMS scope and the audit timeframe you are working towards.
02
Review the system
Examine documents and registers for completeness and approval.
03
Test operation
Trace a sample of AI uses through risk, impact and approval processes.
04
Report readiness
Present the findings and agree the actions before an external audit.
From assessment to remediation
Remaining actions can be closed by your team or through ISO 42001 Implementation. If the review shows larger gaps, an ISO 42001 Gap Assessment may be the better starting point.
Assessment outputFindings and remediation roadmap
Umbrella TechWe deliver the improvements
DesignImplementValidate
Your organisationYour internal team
Your partnerYour existing technology provider
ISO/IEC 42001
ISO/IEC 42001 defines requirements for an artificial intelligence management system (AIMS), including AI risk assessment, AI system impact assessment and the reference controls in Annex A.
About ISO/IEC 42001 services →Preparing for certification
A readiness assessment is preparation, not a certification audit. Certification is voluntary and assessed separately by an independent certification body.
Gap assessmentUmbrella Tech
Remediation and implementationUmbrella Tech with your team
Operate and build evidenceYour organisation
External certification or assessmentIndependent body
Frequently asked questions
Can't see your question? Ask us directly →
What does an ISO 42001 readiness assessment include?
A review of the AIMS documents, testing of risk, impact and approval processes on real AI uses, a check of selected Annex A controls, and a review of internal audit and management review. You receive readiness findings and an action list.
How long does the assessment take?
It depends on the AIMS scope, the number of AI systems and how much operating evidence exists. We confirm scope and timing in discovery.
What evidence or access is required?
Your AIMS documents and registers, completed assessments and approvals, audit and review records, and time with the people who run the system. We agree the list first.
What happens after the assessment?
You close the remaining actions, with or without our help, and decide when to engage a certification body. We can recheck specific areas before the audit if needed.
How much does it cost?
Cost depends on scope and the volume of evidence to review. We confirm scope and cost in discovery. Certification body fees are separate.
Establish your current position
Tell us where your AIMS is up to and when you hope to engage a certification body. We will scope a readiness review that fits.