Fixed fee · $9,750

ISO/IEC 42001 Readiness

ISO 42001
Gap Assessment

A fixed-fee, two-to-three-week review of your AI systems against every clause of ISO/IEC 42001 and its Annex A controls, ending in a written report, a prioritized plan and a realistic estimate of what certification would take.

"Keep it Simple. Keep it Real."

Book the Gap Assessment 858-240-4353

$9,750

Fixed fee

2–3 weeks

Start to report

Every clause

Plus Annex A

Jared Clark, ISO 42001 gap assessment consultant

What You Get

Four things, in writing, in three weeks

A gap assessment is only useful if it ends in a plan someone can budget against. Ours ends in four documents you own.

The AI system inventory

Every AI system in use, including vendor features inside software you already own and the tools staff adopted on their own. For each one: what it does, who owns it, what data it sees and what decisions it touches. This is the document most organizations do not have and every auditor asks for first.

The gap report

Clause by clause, control by control: what you have, what the standard expects, and how far apart they are. Where you already hold ISO 9001, 13485 or 27001 we mark what carries over, so the report shows the real size of the job rather than the size of the standard.

The prioritized plan

Gaps ordered by risk and by effort, grouped into the work you can do yourselves, the work that needs outside help, and the work that can wait until surveillance. Each item carries an owner suggestion and a rough duration.

The estimate

An honest range for time and cost to certification, including certification-body fees and internal time, and a plain recommendation on whether to certify now, align first, or wait. If the answer is wait, we say so.

How It Runs

Week by week

Discovery

Kickoff call, document request, and interviews with the people who own quality, IT and the main AI use cases. We ask the same questions an auditor will ask, in the same order. Two to four hours of your team's time in total.

Analysis

We map what we found against clauses 4 to 10 and each Annex A control, test a sample of records the way a Stage 2 auditor would, and draft the inventory, the report and the plan.

Readout

A working session with your leadership to walk the findings, argue about priorities, and agree what happens next. The final documents follow the readout with the changes you asked for.

Scope

What we look at

The assessment covers the whole standard, but the findings usually concentrate in a few places. We look hardest at the AI system inventory and whether it is complete; at whether anyone has done an AI impact assessment for the systems that affect people, products or decisions; at whether the AI policy has an owner and objectives behind it; at how AI-generated content is reviewed before it becomes a record; at what your contracts say about the AI your suppliers run on your behalf; and at whether there is any evidence of human oversight beyond a sentence in a procedure.

For companies that already hold a management-system certificate we also check the plumbing that carries over: document control, training records, internal audit, corrective action and management review. Most of clause 7, 9 and 10 is already there. Our job is to show what is missing, not to rebuild what works. Read the most common ISO 42001 gaps for what we typically find.

For FDA-regulated manufacturers there is one more question that no security-side assessment asks: whether the AI tools in the quality system have been validated for their intended use, and whether the records they touch would satisfy 21 CFR Part 11 and a data-integrity review. That question is the reason we also offer the AI in the quality system review, which goes deeper on records and validation for a smaller fee. If you are a GMP site and unsure which to start with, start with the call.

A good fit

A customer, auditor or regulator has asked about ISO 42001 or about how your AI is governed, and you need a defensible answer within a quarter.
You already hold ISO 9001, 13485, 27001 or run an FDA quality system and want to know how much of it counts.
You want a budget and a timeline before committing to certification, from someone who does not sell the certificate or the software.

Probably not yet

–You have no management system of any kind and fewer than ten people. A short conversation will get you further than a formal assessment.
–You need an EU AI Act conformity assessment. ISO 42001 does not provide one, and we will say so rather than sell you the wrong thing.
–You are an AI product company with a mature ISO 27001 program and a security team. Your existing assessor can likely extend what you have; we are glad to talk if they cannot.

Price And Terms

$9,750, fixed, quoted in writing before we start

The fee covers a single organization of up to a few hundred people with one management system, assessed remotely. Multi-site scopes, group companies and on-site days are quoted separately. You own every document we produce and may take the plan to any consultant, certification body or software vendor you like.

If you go on to implementation with us, the gap report becomes the scope of that engagement, so nothing is assessed twice. Details of what implementation involves are in our implementation guide, and the fees other firms charge are compared in what ISO 42001 costs.

Frequently asked questions

What does an ISO 42001 gap assessment cost?

Ours is a fixed $9,750, confirmed in writing before we start. Market rates in 2026 run from about $1,500 for a two-day review of a very small organization to $20,000 for a large scoped readiness review. The fixed fee covers organizations of up to a few hundred people with an existing management system; larger or multi-site scopes are quoted.

How long does the gap assessment take?

Two to three weeks from kickoff to the written report. The first week is documents and interviews, the second is analysis, and the report and a readout meeting close it. It runs remotely by default; on-site days can be added.

Do we need to be pursuing certification to use it?

No. Many organizations that ask for it want to answer a customer questionnaire or an auditor's question about AI, not to certify. The report tells you what alignment would take and what certification would take, and you decide.

What do we need to provide?

A list of the AI tools and systems in use, whatever policies or procedures already mention AI, your existing management-system documents if you have a certificate, and two to four hours of interview time from the people who own quality, IT and the main AI use cases.

Start with the gap assessment

Book a free 30-minute call. If the gap assessment is the right next step we will confirm the fixed fee in writing, agree a start date and send the document request the same week.

Book a Free Call Call 858-240-4353

Or email us at [email protected]

ISO 42001 Gap Assessment