ISO 42001 Checklist

Use this ISO 42001 Audit Checklist to assess AIMS compliance, AI lifecycle controls, for an internal audit and gap analysis against the ISO IEC 42001 standard.

Download as free PDF

Library
ISO Standards
ISO 42001 Checklist

ISO 42001 Checklist

Clause 4 — Context Of The Organization

Clause 5 — Leadership And AI Policy

Clause 6 — AI Risk Assessment And Planning

Clause 7 — Support: Resources, Competence, And Documentation

Clause 8 — Operation

Clause 9 — Performance Evaluation And Internal Audit

Clause 10 — Improvement And Corrective Action

A.2.2 — AI Policy

A.2.3 — Alignment With Other Organisational Policies

A.2.4 — Review Of The AI Policy

A.3.2 — AI Roles And Responsibilities

A.3.3 — Reporting Of Concerns Regarding AI Systems

A.4.2 — Resource Documentation

A.4.3 — Data Resources

1. Documentation is maintained for every dataset used by AI systems, covering provenance, last-updated timestamps, categories (training, validation, test, production), labelling process, intended purpose, quality characteristics, retention policy, and known bias issues.

Photo Comment

A.4.4 — Tooling Resources

A.4.5 — System And Computing Resources

A.4.6 — Human Resources

A.5.2 — AI System Impact Assessment Process

A.5.3 — Internal Impact Assessment Of AI Systems

A.5.4 — Functionality And Behaviour Of The AI System

A.6.1.1 — Design Of The AI System

A.6.1.2 — Data For Development And Enhancement

1. Governance controls are in place for data used in AI system development, covering privacy and security implications, security and safety threats from data-dependent development, transparency and explainability requirements, representativeness of training data relative to the operational domain, and data accuracy and integrity.

Photo Comment

A.6.1.3 — AI System Development Documentation

1. Documentation is maintained throughout the development process capturing design decisions, testing procedures, validation results, and changes, creating an audit trail demonstrating the system was built in accordance with its specifications and governance requirements.

Photo Comment

A.6.1.4 — Addressing Bias In Data

A.6.1.5 — Robustness Of AI Systems

A.6.2.1 — AI System Operational Concept

A.6.2.2 — AI System Testing

A.6.2.3 — Human Oversight Of AI Systems

A.6.2.4 — AI System Event Logs

A.6.2.5 — AI System Deployment

1. A documented deployment plan and formal verification process confirms that all necessary requirements — including design specifications, testing results, impact assessments, oversight mechanisms, and operational documentation — are in place before each AI system goes live.

Photo Comment

A.7.2 — Data For Development And Enhancement Of AI System

1. Operational data management controls are in place covering privacy and security in data use, security threats from data-dependent AI, transparency and explainability aspects, representativeness of training data versus the operational domain, and data accuracy and integrity.

Photo Comment

A.7.3 — Acquisition Of Data

1. Governance of how data is sourced covers categories required, quantities, data sources, source characteristics, data subject demographics, prior handling, data rights (including personal data and intellectual property), metadata about labelling, and provenance.

Photo Comment

A.7.4 — Quality Of Data

A.7.5 — Processing Of Personal Information

A.8.2 — Transparency Of AI Systems

A.8.3 — Communication About Intended Use Of AI System

A.8.4 — Disclosure Of AI Interaction

A.9.2 — Intended Use

A.9.3 — Correct And Ethical Use

A.9.4 — Information Security For AI Systems In Use

A.9.5 — Safety Of AI Systems In Use

A.9.6 — Decommissioning Of AI Systems

A.10.2 — Responsible Use Policies In Third-Party Relationships

1. Contracts or agreements with third parties involved in AI activities — including suppliers, partners, and customers — include provisions covering responsible use of AI, data protection, incident notification, and compliance with applicable AI requirements.

Photo Comment

A.10.3 — Customer Responsibilities

A.10.4 — Third-Party AI Systems

Checklist by GoAudits.com – Please note that this checklist is intended as an example. We do not guarantee compliance with the laws applicable to your territory or industry. You should seek professional advice to determine how this checklist should be adapted to your workplace or jurisdiction.

Is this sample what you are looking for?
Sign up to use & customize this template, or create your own custom checklist.

NEW! Try generating a custom checklist with our free AI tool:

Easy inspection app for your digital checklists

Conduct inspections anytime, anywhere - even offline
Capture photos as proof of compliance or areas needing attention
Instantly generate and share detailed reports after the inspections
Assign & track follow-up tasks, view historical trends on a centralized dashboard

ISO 42001 Checklist

Use this ISO 42001 Audit Checklist to assess AIMS compliance, AI lifecycle controls, for an internal audit and gap analysis against the ISO IEC 42001 standard.

1. The organization has documented the external issues relevant to its AIMS, including applicable AI regulations, industry standards, and market expectations.

2. Internal issues affecting the AIMS are documented, including organizational culture, existing governance structures, and resource capabilities.

3. Interested parties relevant to the AIMS are identified, including customers, users, regulators, employees, and third-party AI vendors.

4. The requirements and expectations of each interested party are documented and reviewed periodically.

5. The AIMS scope statement is documented, clearly defining which AI systems, activities, and organizational units are covered.

6. AI systems included within scope are identified by name, function, and the organization's role (developer, provider, or deployer).

7. Any AI systems excluded from scope are listed with documented justification.

8. The AIMS scope is available to relevant interested parties.

9. An AI system inventory is maintained and aligned to the documented scope.

10. The AI system inventory includes system purpose, owner, operational status, and data inputs for each entry.

1. Top management has demonstrated commitment to the AIMS through documented resource allocation decisions and governance approvals.

2. Evidence of leadership involvement in AIMS establishment is available, such as steering committee records, approval sign-offs, or management review minutes.

3. An AI policy is documented and approved by top management.

4. The AI policy includes a commitment to responsible and ethical AI development and use.

5. The AI policy provides a framework for setting AI objectives and includes a commitment to continual improvement.

6. The AI policy is communicated to all personnel involved in AI activities.

7. The AI policy is available to relevant external parties where appropriate.

8. AIMS roles, responsibilities, and authorities are documented and assigned.

9. Responsibility for ensuring AIMS conformity is formally assigned to a named role or individual.

10. Responsibility for reporting AIMS performance to top management is formally assigned.

11. Evidence that AIMS responsibilities have been communicated to relevant personnel is available.

1. An AI risk assessment process is documented, including risk identification, analysis, evaluation, and treatment steps.

2. Risk criteria are defined, including AI-specific criteria such as bias potential, explainability requirements, and societal impact thresholds.

3. Risk assessments have been completed for all AI systems within scope.

4. Risk assessments are reviewed and updated when AI systems undergo significant changes.

5. A risk register is maintained with risk owners, risk levels, and treatment status for each identified risk.

6. Risk treatment options have been selected for each identified risk, with documented rationale.

7. A Statement of Applicability (SoA) is documented, listing applicable Annex A controls with justifications for inclusions and exclusions.

8. A risk treatment plan is documented with assigned owners and target completion dates.

9. An AI impact assessment process is documented, covering intended use cases and foreseeable misuse scenarios.

10. Impact assessments have been completed for AI systems with potential to affect individuals or society.

11. Impact assessment results are retained and reviewed when system purpose or deployment context changes.

12. AI objectives are established, documented, measurable, and consistent with the AI policy.

13. Plans to achieve AI objectives include assigned responsibilities, required resources, timelines, and evaluation methods.

14. A change management process is documented for planned changes to the AIMS, including changes to AI systems, data sources, or use cases.

1. Resources required to establish, implement, and maintain the AIMS are determined and provided.

2. Budget allocation for AIMS activities is visible and documented.

3. Competence requirements are defined for all roles that affect AI system performance, safety, or governance.

4. Evidence of competence is available for personnel in AIMS roles, such as qualifications, training records, or assessed performance.

5. Training records are maintained where competence was developed through formal training.

6. Evidence that training effectiveness has been evaluated is available.

7. Personnel involved in AI activities are aware of the AI policy and their contribution to AIMS objectives.

8. Internal and external communication requirements for the AIMS are documented, specifying who communicates what, to whom, and by which channel.

9. A document control procedure is in place covering creation, approval, version control, and access management.

10. AIMS documents are properly identified, described, and protected from unauthorized changes.

11. Retention and disposal requirements for AIMS documented information are defined.

12. Documented information is accessible to those who need it and protected from unintended alteration or deletion.

1. Operational procedures are documented for AI system design, development, testing, deployment, monitoring, and decommissioning.

2. Criteria for controlling AI lifecycle processes are established and applied consistently.

3. Evidence that AI lifecycle processes are executed according to documented procedures is available.

4. AI risk assessments are performed at the design stage before new AI systems are deployed.

5. AI risk assessments are repeated following significant changes to model architecture, training data, use case, or deployment environment.

6. Change control records document approvals for model updates, prompt changes, retraining runs, and vendor changes.

7. Rollback procedures are defined and tested for AI systems where reverting to a prior version may be required.

8. Human oversight mechanisms are defined for AI systems where automated decisions carry material risk to individuals or the organization.

9. Human review and override records are maintained for AI systems with defined oversight requirements.

10. Model performance is tested against defined criteria before deployment, including accuracy, robustness, and intended-use alignment.

11. Post-deployment monitoring is in place to detect model drift, performance degradation, and unexpected outputs.

12. Monitoring results and incidents are recorded and reviewed at defined intervals.

13. AI-specific incident response procedures are documented and cover detection, containment, root cause analysis, and notification.

14. Records of AI incidents and near-misses are maintained and used to inform corrective action.

1. The organization has determined what to monitor and measure for AIMS performance, including AI system outcomes, risk treatment effectiveness, and objective progress.

2. Methods, frequency, and responsibility for monitoring and measurement are documented.

3. Monitoring results are analyzed, evaluated, and reported to relevant management at defined intervals.

4. An internal audit program is documented, covering audit scope, criteria, frequency, and auditor selection.

5. Auditor independence from the areas being audited is ensured and documented.

6. At least one complete internal AIMS audit cycle has been completed before the certification audit.

7. Internal audit reports document findings, evidence reviewed, conformities, and nonconformities.

8. Audit findings are communicated to relevant management and tracked to closure.

9. Management reviews are conducted at planned intervals by top management.

10. Management review inputs include AIMS performance data, audit results, risk register status, objective progress, and changes in internal or external context.

11. Management review outputs include decisions on improvement opportunities, resource needs, and any required changes to the AIMS.

12. Management review minutes are retained as documented evidence.

1. A process for identifying, recording, and managing nonconformities is documented.

2. Nonconformities, including AI system control failures and incidents, are recorded when they occur.

3. Root cause analysis is performed for each nonconformity to identify the underlying cause rather than the symptom.

4. Corrective actions are planned with assigned owners and target completion dates.

5. Corrective actions are verified for effectiveness before the nonconformity is closed.