The readiness check
ISO 42001 gap analysis, at a fixed price
Before you build an AI management system, appoint a certification body or promise a customer a certificate, find out where you actually stand. Our gap analysis measures your organisation against every clause and control of ISO 42001 and hands you a costed roadmap to close the distance, for a fixed fee agreed before we start.
What it covers
Clause by clause, evidence first
The assessment works through the whole of ISO 42001: the management clauses on context, leadership, planning, support, operation, performance evaluation and improvement, then each Annex A control theme against every AI system in scope. For each requirement we record whether the practice exists, whether evidence proves it, and what the shortfall would look like to a certification body's auditor.
That evidence-first discipline matters because gap analyses done by questionnaire flatter you. Asking a team whether AI risks are assessed gets a yes; asking to see the assessment for a named system gets the truth. Everything in the roadmap is priced, so the output doubles as the business case: the board sees what certification takes, what it costs and in what order, on one page.
You receive
- A clause-by-clause readiness position against ISO 42001, scored and evidenced
- An Annex A control applicability view for every AI system in scope
- An AI system inventory, often the first complete one the organisation has held
- A costed remediation roadmap, sequenced by dependency and effort
- A certification body briefing: what stage 1 will ask and what to show them
- A summary written for the board, not the audit file
The fee
One fixed fee, agreed before we start
The ISO 42001 gap analysis is a fixed fee inside the published £8,500 to £16,700 readiness range, set by scope. That figure is confirmed at the scoping call, published on our pricing page with everything else we sell, and does not move if the assessment uncovers more work than anyone expected. Consultancy in this market is usually quoted by the day after a sales meeting; we would rather you knew the number before you got in touch.
The fee covers the full assessment, the costed roadmap, the board summary and the debrief. If you go on to certification, the roadmap sets out the remaining costs, including the certification body's own fees, so there is a single, complete figure for the whole journey. Book the scoping call to confirm yours.
When to commission one
Three situations that call for a gap analysis
Almost every engagement we scope starts from one of these positions.
Certification is on the horizon
A customer questionnaire, a tender or the board has put ISO 42001 on the agenda. The gap analysis converts that intention into a scoped, costed plan before anyone commits budget to implementation or appoints a certification body.
AI adoption ran ahead of governance
Copilots, chatbots and models arrived team by team, and nobody can list them all, let alone evidence how each is controlled. The assessment builds the inventory and shows how far current practice sits from a defensible baseline.
The EU AI Act has reached you
A customer, subsidiary or regulator has raised the Act, and you need a structured answer. Because the standard's impact assessments and lifecycle controls map well onto the Act's obligations, the same readiness exercise serves both conversations.
How it runs
From scoping call to roadmap
Four stages, in a fixed order, and you decide after the third whether we stay involved.
Stage 1
Scoping call
We establish which AI systems, teams and sites belong in scope, what documentation already exists and whether an ISO 27001 ISMS is in place to build on. You get the fixed fee confirmed before anything starts.
Stage 2
Assessment
A consultant works through every clause of the standard and every Annex A theme against your actual practice: interviews with system owners, review of the evidence you hold, and inspection of how each AI system is really run.
Stage 3
Roadmap and debrief
You receive the scored readiness position and the costed remediation roadmap, then a working debrief where your team can push back on any finding before the board sees it.
Stage 4
Optional implementation support
If you want help closing the gaps, we quote the implementation work as a separate fixed package from the roadmap. There is no obligation: many clients take the roadmap and run it internally.
Checking yourself first
What a real ISO 42001 readiness checklist covers
Searching for an ISO 42001 checklist or toolkit mostly surfaces template packs: dozens of pre-written documents to fill in. Templates are not the hard part. A checklist only tells you anything if each line demands evidence, and these are the six areas any credible one has to probe.
Scope and inventory
Every AI system identified, with an owner, a purpose and a record of the data it touches. Most organisations fail the checklist here, on the very first line.
Policy and leadership
A management-approved AI policy, assigned roles and a route for AI concerns to reach leadership with evidence they act on them.
Risk and impact assessment
A defined methodology, plus a completed risk assessment and impact assessment for each in-scope system, covering the people the system affects as well as the organisation.
Lifecycle and data controls
Documented requirements, testing and deployment gates for each system, records of training data provenance, and a defined route to switch a misbehaving system off.
Suppliers and transparency
Model and platform providers under contractual control, responsibilities allocated across the supply chain, and users told what the AI does and how to report problems.
Checking mechanisms
Internal audit of the AIMS, management review minutes and evidence that nonconformities get fixed. Certification bodies read this section first.
Work through those six areas yourself and you have a rough self-assessment. The gap analysis is the professional version: every line evidenced, scored and priced into a roadmap a certification body will recognise.
Asked before commissioning
The gap analysis, questioned
What is an ISO 42001 gap analysis?
A structured assessment of your current AI governance against every requirement of the standard: the management clauses and the Annex A controls. It produces a scored readiness position, an inventory of in-scope AI systems and a costed remediation roadmap showing exactly what certification would take.
How much does it cost?
It is a fixed fee inside the published £8,500 to £16,700 readiness range, set by scope, confirmed at the scoping call and published alongside all our other fees. The price does not move if the assessment finds more gaps than expected; that risk is ours, not yours.
Do we need one before going for certification?
The standard does not mandate it, but arriving at a stage 1 audit blind means paying certification body rates to discover your gaps. The gap analysis surfaces the same issues first and turns them into a sequenced, costed plan you control.
What if we only want alignment, not the certificate?
The engagement is identical. The roadmap simply becomes your internal improvement plan rather than a certification runway, and you can activate the certification steps later without repeating the assessment, provided your AI estate has not changed materially.
Know before you build
Scope your ISO 42001 gap analysis
Tell us about your AI estate on a short call and we will confirm the fixed fee, the systems in scope and what the roadmap will give your board.