This free ISO 42001 checklist is for AI governance leads, CISOs and ISMS managers adding AI to an existing management system, and compliance teams preparing for certification. It runs one year of an AI management system (AIMS) to ISO/IEC 42001:2023, from scope and AI roles through risk and impact assessment, the Statement of Applicability, internal audit and management review to corrective action, with the certification audits if you seek them. The result is an evidence file an auditor can follow from scope to a signed management review.
ISO/IEC 42001:2023, published on 18 December 2023, is the first certifiable management system standard for AI. It follows the same Harmonized Structure as ISO/IEC 27001 and ISO 9001, so clauses 4 to 10 will look familiar. What is new sits in clause 6.1 and the annexes. Annex A lists 38 controls in nine areas, A.2 to A.10. Annex B gives implementation guidance for each control, Annex C lists potential AI objectives and risk sources, and Annex D covers use across sectors.
Clause 4.1 also asks you to determine your role for each AI system. The standard draws on the ISO/IEC 22989 vocabulary of AI providers, producers, customers and partners, which does not line up exactly with the provider and deployer roles in the EU AI Act. A company that trains its own model and also buys a recruitment screening tool holds two roles, and its scope has to show both.
Asks: which AI risks matter, how likely they are and how serious, judged against criteria you set in advance.
Guidance: ISO/IEC 23894:2023 on AI risk management; Annex C lists risk sources.
Feeds: risk treatment, the choice of controls and the Statement of Applicability (6.1.3).
Asks: what the potential consequences of an AI system are for individuals, groups of individuals and society, beyond the organisation itself.
Guidance: ISO/IEC 42005:2025, published in May 2025, and the four controls under A.5.
Repeats: at planned intervals and when significant changes are proposed (8.4), with the results kept as documented information.
ISO/IEC 42006:2025, published in July 2025, adds AI-specific requirements for bodies that audit and certify an AIMS on top of ISO/IEC 17021-1, including the competence of their auditors. ANAB accredited its first ISO 42001 certification body in September 2024, and UKAS granted its first accreditation, to BSI, on 15 January 2026.
This checklist builds and runs the management system. Classifying each AI system under the law and working through provider and deployer duties belongs to the EU AI Act Compliance Checklist. The AIMS keeps that work owned and reviewed year after year.
Six phases run every year. Phase 7 appears only if you are seeking certification.
The first task records the certification stage and names the two people who sign off the year.
Clauses 5 and 7, with the Annex A areas on policy, internal organisation and resources.
The last task is an approval: the AIMS owner accepts the residual risks before the controls are rolled out.
Reassess any system that changes significantly, not only at the annual review.
The management review is an approval assigned to the top management sponsor named in Phase 1.
Open actions carry into next year’s checklist, which starts on an annual schedule.
Shown only when you are seeking certification; the stage on the first task decides which audit tasks appear.
Clauses 4 to 10 are requirements. Annex A is a reference list you justify your choices against. The table maps each to typical evidence and the phase that produces it. Certification bodies sample differently, so treat it as a starting point, not legal advice.
| Clause or annex | Requirement | Typical evidence | Evidenced in |
|---|---|---|---|
| 4.1–4.3 | Context, AI roles, interested parties, scope | Issues, roles, scope statement | Phase 1 |
| 5.1–5.3 | Leadership, AI policy, roles and authorities | Approved AI policy, responsibility matrix | Phase 2 |
| 6.1.2 | AI risk assessment | Risk criteria, risk register | Phase 3 |
| 6.1.3 | AI risk treatment and Statement of Applicability | Treatment plan, Statement of Applicability, risk acceptance | Phase 3 |
| 6.1.4 | AI system impact assessment | One documented assessment per system | Phase 3 |
| 6.2, 6.3 | AI objectives; planning of changes | Objectives with owners; change records | Phase 4 |
| 7.1–7.5 | Support, competence and documented information | Training records, document control | Phase 2 |
| 8.1–8.4 | Operational control; risk and impact assessment in operation | Life cycle records, reassessments after change | Phase 4 |
| 9.1 | Monitoring, measurement, analysis and evaluation | Metrics and their analysis | Phase 5 |
| 9.2 | Internal audit | Audit programme and reports | Phase 5 |
| 9.3 | Management review | Inputs, minutes and decisions | Phase 5 |
| 10.1, 10.2 | Continual improvement; nonconformity and corrective action | Findings log, root causes, verified actions | Phase 6 |
| Annex A (A.2–A.10) | 38 reference controls | Control evidence | Phases 2 to 4 |
| Certification | ISO/IEC 17021-1 and 42006 bind the certification body | Audit reports, action plans | Phase 7 |
At the time of review, ISO/IEC 42001:2023 was still the first and only edition, with no amendment published. Accreditation bodies were still adding certification bodies to their registers through 2026, so check the scope before you sign a contract. ISO/IEC 42001 is not a harmonised standard under the EU AI Act, so a certificate gives no presumption of conformity with the Act. Nothing on this page is legal advice.
The Statement of Applicability is a table inside its task: one row per Annex A control, with the decision, justification and status. Impact assessments and control evidence are attached to the tasks they prove.
An annual schedule starts each cycle. Conditional logic shows the certification phase only when you are seeking it, with only the stage 1 and 2, surveillance or recertification tasks that apply this year.
Risk acceptance and the management review are approvals assigned to the AIMS owner and top management sponsor named on the first task. The activity trail shows who decided and when.
CheckFlow is not a GRC platform, a certification body or a legal adviser, and it does not assess your AI systems for you. It runs the cycle and keeps the evidence your auditors sample. CheckFlow’s compliance checklist software applies the same approach to your other standards.
The legal obligations have their own template: the EU AI Act Compliance Checklist classifies each system and works through provider and deployer duties. If you already run an ISMS, the ISO 27001 Compliance Checklist shares the clause structure, and the ISO 27001 Internal Audit Checklist sets out an audit method you can reuse for clause 9.2. Where an AI system processes personal data, run the DPIA Checklist alongside its impact assessment.
Thirty-eight, in nine areas from A.2 to A.10: AI policy, internal organisation, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party and customer relationships. They are a reference set, not a mandatory list. You choose controls through risk treatment, compare them with Annex A, and justify each inclusion or exclusion in the Statement of Applicability.
Yes, and the shared clause structure makes it the usual route. Document control, internal audit, management review and corrective action can serve both systems. What does not carry over is the AI-specific work: AI roles, AI risk criteria, the impact assessment and the 38 Annex A controls, which are a different set from ISO 27001’s 93. ISO 42001 does not require ISO 27001 certification, so you can also certify it on its own.
They overlap, but each answers a different question. The ISO 42001 impact assessment looks at what an AI system could do to individuals, groups and society, whether or not personal data is involved. A DPIA under GDPR Article 35 covers high-risk processing of personal data. A fundamental rights impact assessment under Article 27 of the EU AI Act applies to some deployers of high-risk systems from 2 December 2027. One document with a section for each can work, provided each section meets its own requirements.
The AIMS has to have run, not just been written. Stage 1 reviews the documented system: scope, AI policy, risk and impact assessment methods and the Statement of Applicability. Stage 2 checks that it works in practice, and certification bodies expect at least one internal audit and one management review covering the scope before it. After certification there is usually a surveillance audit each year and a recertification audit every three years.
Yes. The standard is written for organisations that provide or use AI-based products and services, of any size. As an AI customer, your scope covers how you select, deploy, monitor and retire the systems you buy, and the A.10 controls on suppliers carry more weight. Controls about developing models may not apply, but each exclusion still needs a justification in the Statement of Applicability.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
