ISO/IEC 42001 AI Competence & Awareness Matrix
Decide what each AI role needs to know, record what people actually know, and see the gaps. Set a target level (aware, practitioner or expert) for eight AI competencies per role, record each person's current level, training, evidence and next refresh, and the heat map shows where the AI management system is short. Each gap links to a PlayCISO course or lab that helps close it.
Loaded with sample data for a fictional lender. Saved in your browser only. A template, not certification advice.
You are looking at sample data for a fictional lender. Edit anything, or (keeps the default roles). Your changes are saved in this browser only.
Targets met
79%
of required person × competency pairs
Below target
9
people, 17 gaps
Refresh overdue
4
1 due in 30 days
No evidence
2
people with nothing on file
Role × competency heat map
Each cell shows the target level and how many people in the role are below it. Click a role to see its people. Scroll sideways for all eight competencies.
| Role | AI governance | AI risk management | AI security threats | Data quality and provenance | AI impact assessment | Human oversight | AI incident response | Applicable law |
|---|---|---|---|---|---|---|---|---|
| Pmet | P1/1 below | Amet | A1/1 below | Amet | Amet | Amet | Amet | |
| Emet | Emet | Pmet | Pmet | Pmet | Pmet | Pmet | Pmet | |
| Pmet | Pmet | P1/1 below | Pmet | P1/1 below | Pmet | Amet | Amet | |
| Amet | Pmet | P1/2 below | Emet | Pmet | P1/2 below | Amet | Amet | |
| Amet | Pmet | E1/1 below | Pmet | Amet | Amet | E1/1 below | Amet | |
| Pmet | Pmet | Amet | P1/1 below | Pmet | Amet | Amet | Emet | |
| Amet | P1/1 below | Amet | Amet | - | - | A1/1 below | Pmet | |
| Amet | Amet | Amet | - | - | Pmet | P1/1 below | - | |
| A1/2 below | - | A1/2 below | - | - | - | A1/2 below | - | |
| Amet | Emet | P1/1 below | Pmet | Pmet | Pmet | Amet | P1/1 below |
Overdue refreshers
Due in the next 30 days: Kofi Brandt (2026-11-13)
Close the gaps
- AI security threats (5 gaps)ISO/IEC 27090 10-minute course · ISO/IEC 27090 practice path · 27090 threat mapping lab · RAG poisoning lab
- AI incident response (4 gaps)Prompt injection incident lab · Agent incident tabletop lab · AI incident response checklist
- AI risk management (2 gaps)AI risk register · ISO/IEC 23894 risk treatment plan
- Data quality and provenance (2 gaps)Training data provenance · RAG poisoning lab
- AI governance (1 gap)AI governance board lab · ISO 42001 gap assessment lab · AI standards toolkit
- AI impact assessment (1 gap)ISO/IEC 42005 impact assessment · AI fairness assessment
- Applicable law (1 gap)EU AI Act classifier · EU AI Act documentation builder
- Human oversight (1 gap)Human-in-the-loop decision advisor
For organisation-wide awareness (clause 7.3), plan the campaign with the awareness programme planner.
People below target
| Person | Role | Competency | Current → target |
|---|---|---|---|
| Procurement | AI risk management | Aware → Practitioner | |
| Procurement | AI incident response | None → Aware | |
| Legal / privacy | Data quality and provenance | Aware → Practitioner | |
| All staff | AI governance | None → Aware | |
| All staff | AI security threats | None → Aware | |
| All staff | AI incident response | None → Aware | |
| AI security engineer | AI security threats | Practitioner → Expert | |
| AI security engineer | AI incident response | Practitioner → Expert | |
| Support / operations | AI incident response | Aware → Practitioner | |
| Board / top management | AI risk management | Aware → Practitioner | |
| Board / top management | Data quality and provenance | None → Aware | |
| AI product owner | AI security threats | Aware → Practitioner | |
| AI product owner | AI impact assessment | Aware → Practitioner | |
| Model risk validator (custom) | AI security threats | Aware → Practitioner | |
| Model risk validator (custom) | Applicable law | Aware → Practitioner | |
| Data scientist / ML engineer | AI security threats | Aware → Practitioner | |
| Data scientist / ML engineer | Human oversight | Aware → Practitioner |
TL;DRWhat this matrix does
5 points
- ISO/IEC 42001 clause 7.2 expects you to decide what competence each AI role needs, make sure people have it through education, training or experience, act to close gaps, and keep evidence. Clause 7.3 covers awareness for everyone working under your control.
- Nine starting roles (board, AIMS owner, AI product owner, data scientist or ML engineer, AI security engineer, legal and privacy, procurement, support and operations, all staff), plus your own.
- Eight AI competencies per role, each with a target level: aware, practitioner or expert. Record people with their current level, training (date and source), evidence and next refresh date.
- The gap view shows a role × competency heat map, overdue refreshers and everyone below target, with PlayCISO courses and labs suggested for each gap.
- Free to use, saved in your browser. CSV and Markdown export are part of Pro.
What an auditor looks for in competence records
An auditor will usually pick a few people in AI roles, ask what competence the role needs, and then look for evidence that the person has it. Gaps are normal; what matters is that you know about them and are acting. A matrix that says everyone is an expert, with no certificates, lab records or work products behind it, tends to prompt more questions than one that shows honest gaps and a dated plan to close them.
AI roles need competencies a classic security or quality matrix leaves out: data quality and provenance for the people training models, impact assessment for product owners, human oversight for the operations staff who review AI decisions, and AI-specific threats such as prompt injection and data poisoning for security engineers. The ISO/IEC 27090 practice path and the AI labs give people completion records you can file as evidence.
Competence evidence is one of the records listed in the documented-information register. Staff competence and resourcing also feed your management review, and an unaddressed gap found at audit belongs in the nonconformity tracker.
Frequently asked questions
What does ISO/IEC 42001 clause 7.2 require for competence?
In plain terms: determine the competence needed by people whose work affects your AI performance, make sure they are competent on the basis of education, training or experience, take action to acquire the competence where it is missing and evaluate whether that action worked, and keep documented information as evidence of competence. Check the standard text for the exact wording.
What is the difference between competence (7.2) and awareness (7.3)?
Competence is role-specific: can this person do the AI work their role needs? Awareness applies to everyone working under the organisation's control: do they know the AI policy, how they contribute to the AI management system, and what happens if they do not follow it? In this matrix, the "All staff" role carries the awareness targets and the other roles carry competence targets.
What evidence of competence will an auditor accept?
Typically certificates, course or lab completion records, CVs, role descriptions, records of supervised work, work products such as impact assessments or threat models the person wrote, and sign-off sheets. The auditor will sample a few people and check the evidence matches the level your matrix claims. "Attended a webinar" alone rarely supports an expert level.
How do the target levels work?
Aware means the person knows the topic exists, why it matters and who to ask. Practitioner means they can do the work unsupervised. Expert means they can design the approach, teach it and defend it to an auditor. The default targets are starting points only; set yours from your AI risks and the systems each role touches.
How are gaps and colours worked out?
For each role and competency the tool compares every person's current level with the role's target. Green means everyone in the role meets it, amber means some are below, red means most are below or someone is two levels short, and a dashed cell means the role has a target but nobody assigned. Refreshers are overdue when the next refresh date has passed.
Where is my data stored, and is this tool free?
Everything is saved in your own browser with localStorage; nothing is sent to PlayCISO, and clearing site data or using a private window removes it. Roles, people, the gap view and suggestions are free. Exporting to CSV or Markdown is part of Pro ($5/month or $40/year).
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.