The ISO 42001 Readiness Index: Score Yourself Before Your Auditor Does

Why a Readiness Index, and Why Now

ISO 42001 certification audits are structured in two stages. Stage 1 is a documentation review: does your AI management system exist on paper? Stage 2 is an implementation review: does it operate in practice? The majority of enterprises attempting certification for the first time pass Stage 1 and fail Stage 2. They arrive with governance policies, risk registers, and supplier questionnaires — and then an auditor asks for evidence that those controls ran on a real system in production. The silence that follows is expensive.

A practitioner-grade readiness index exists to surface that gap before the auditor does. The five indicators below are leading predictors of Stage 2 readiness. Each can be self-scored in a governance workshop. Each maps to a specific remediation priority. Together, they give an AI Governance Lead or Head of Enterprise Risk a defensible position when presenting a certification business case to the board — because the board will ask whether you are certifiable or merely aspirational.

Indicator 1 — AI Inventory Completeness (Score 0–4)

Ask yourself: can you produce, right now, a registry of every AI system in production that includes the system's risk classification, the data it processes, the business decision it influences, and the team accountable for it? If yes, score 4. If you have a partial list that covers your highest-profile systems but not shadow AI or third-party embedded models, score 2. If your inventory lives in a spreadsheet that was last updated during a previous audit cycle, score 1. If the question produces a debate about where the list even lives, score 0.

ISO 42001 Clause 6.1 requires a risk-based approach to AI, which presupposes a complete inventory. No downstream control — risk classification, monitoring, supplier oversight — is credible without it. Inventory remediation is typically the longest-lead item for large enterprises, because it requires coordination across business units that did not procure their AI systems through a central governance function. Expect this work to take longer than any single team estimates, particularly where embedded analytics in SaaS platforms have never been catalogued.

Indicator 2 — Risk Classification Operationalization (Score 0–4)

Ask yourself: for each AI system in your inventory, has a documented risk classification been assigned using a defined methodology — and does that classification drive differentiated control requirements? Score 4 if the methodology is documented, applied consistently, and produces observable differences in how high-risk systems are treated versus low-risk ones. Score 2 if classifications exist but all systems receive the same control set regardless of risk tier. Score 0 if risk classification is a planned activity.

The EU AI Act's prohibited and high-risk categories have sharpened board attention on this indicator, and ISO 42001 Annex A controls implicitly require it. The failure mode here is cosmetic classification: every system is labelled, but the label changes nothing operationally. Auditors probe this by asking what a high-risk designation triggers — if the answer is a longer review meeting rather than a materially different control regime, the classification is not operationalized.

Indicator 3 — Control Evidence Maturity (Score 0–4)

Ask yourself: for your three highest-risk AI systems, can you produce time-stamped evidence that your stated controls ran during the last review cycle — bias assessments, performance threshold checks, explainability reviews, human-in-the-loop escalation logs? Score 4 if evidence exists and is retrievable in under 24 hours. Score 2 if evidence exists for some controls but relies on manual reconstruction. Score 0 if controls are described in policy but have not yet been executed against a live system.

This is the indicator most directly responsible for Stage 2 failures. Auditors do not grade your policy library. They grade the evidence that your controls ran, caught something, and produced a documented response. Enterprises that have completed ISO 27001 certification often assume their information security control evidence habits transfer to AI — they partially do, but AI controls require additional artifacts: model cards, evaluation harness outputs, drift detection logs, and human review sign-offs that information security audits never demanded.

Indicator 4 — Third-Party AI Oversight (Score 0–4)

Ask yourself: for AI systems you procure from vendors or embed from APIs, do your supplier agreements include provisions for audit rights, performance disclosure, and incident notification — and have you exercised any of those rights? Score 4 if agreements exist and at least one vendor has been assessed against your AI risk criteria in the last twelve months. Score 2 if agreements are being negotiated but none are complete. Score 0 if your vendor AI risk program is the same as your general vendor risk program with no AI-specific additions.

ISO 42001 Clause 8.4 addresses external AI providers directly. The common enterprise failure here is that procurement teams negotiate data processing agreements and security clauses but have not yet added AI-specific obligations. Fourth-party risk — the AI your vendor's vendor uses — is an emerging gap that standard supplier questionnaires do not reach. If your fraud scoring platform relies on a foundation model from a third-party provider, your audit trail for that model's behavior is only as strong as the disclosure your vendor contractually owes you.

Indicator 5 — Post-Deployment Monitoring Cadence (Score 0–4)

Ask yourself: for your production AI systems, is there a defined monitoring cadence with documented thresholds, an alert owner, and a remediation workflow that has been tested? Score 4 if monitoring is automated, thresholds are calibrated to the system's risk tier, and at least one real alert has been investigated and closed with documentation. Score 2 if monitoring dashboards exist but threshold review is ad hoc. Score 0 if monitoring means checking whether the system is online.

Post-deployment monitoring is where AI governance becomes an operational discipline rather than a documentation exercise. ISO 42001 requires continual improvement evidence, which in practice means showing that your monitoring detected a degradation or a compliance signal and that your organization responded to it. Enterprises in BFSI and insurance often have model monitoring for statistical drift already; the gap is usually in connecting that monitoring output to the governance record in a way that satisfies an auditor rather than just a model risk committee.

Reading Your Score and Sequencing Your Remediation

A total score of 16–20 places you in the certifiable range, with isolated hardening needed. A score of 10–15 means you will likely pass Stage 1 but face major findings at Stage 2 without targeted remediation. A score below 10 means your current maturity maps to a remediation cycle before a first audit attempt is advisable.

The prioritized action sequence follows the indicator order deliberately. Inventory completeness must precede risk classification, because you cannot classify what you have not catalogued. Risk classification must precede control design, because controls are calibrated to risk tier. Control evidence must be built before you schedule an audit, because scheduling pressure does not accelerate evidence maturity — it just compresses the timeline for discovering gaps. Third-party oversight and monitoring cadence can run in parallel once the first three are established, but neither can substitute for them.

Enterprises targeting the 2025–2026 certification window that score below 10 today should treat this as a planning signal, not a failure. The index exists to surface the gap while there is still time to close it in an orderly sequence rather than in the compressed sprint that typically follows a failed Stage 2 audit. Certification is achievable; the organizations that achieve it are not better-resourced than their peers — they started their ISO 42001 readiness assessment earlier and sequenced the work correctly.