Buyer guide
ISO 42001 readiness: preparing your evidence
Start with the AI management-system scope, the people responsible for it and the evidence already available. Use this preparation guide to organise a readiness discussion, not as a complete list of certification requirements.
Discuss your assessment scopeStart with the management system
ISO/IEC 42001 concerns an AI management system. Before assembling documents, describe the organisational boundary and AI activities you want reviewed. Identify the decisions the readiness assessment needs to support.
Create an evidence inventory
For each topic, record the evidence owner, document or record location, date, scope and unanswered questions. Avoid treating the existence of a document as the conclusion of the review; make space to discuss what it demonstrates and what remains uncertain.
Separate preparation from a conclusion
Mark missing or unavailable evidence explicitly. Ask which information is needed to assess readiness and who can explain how the arrangements operate. This guide is a planning aid, not a reproduction of the standard or a certification checklist.
Agree the follow-up
Use the inventory to discuss assessment boundaries, how gaps will be recorded and who will own the next steps. The ISO 42001 readiness service page explains the SWSAM engagement; bring unresolved questions into that scope discussion.
Reference: ISO — ISO/IEC 42001
What should you compare in an ISO 42001 readiness proposal?
Compare proposals against the same organisational boundary, AI activities and intended decision. List the evidence already available and the people who can explain it. Ask each provider to identify the assumptions behind the proposed work.
For a useful cost discussion, separate the readiness review from implementation, technical security testing, internal audit and certification work. Ask what is included, what is excluded and which follow-up activities need a separate agreement.
An evidence checklist is a preparation aid. It helps organise the discussion; completing the checklist is not the same as establishing readiness. Record questions that still need review rather than marking every available document as sufficient.
- Which AI activities and organisational teams are in scope?
- Which records will be reviewed, and who needs to take part?
- How will missing evidence and identified gaps be presented?
- What follow-up work is included in the proposed fee and timetable?