ISO/IEC 42001 AIMS Gap-Assessment Lab
A set of organisation scenarios lands on your desk — a firm with no AI policy, a high-stakes model with no impact assessment, a deployment that skipped the V&V gate, a third-party model API with no responsibility split, and a chatbot that is actually run well. For each, map it to the right Annex A control area, set the conformity verdict, and choose the corrective action that closes the gap — because a missing process is a Major nonconformity, an isolated lapse is a Minor, and an effective control should be left alone. An internal readiness drill against the certifiable AI management system standard — not a certification.
The real job. More noise, a tighter clock.
Gap-assessment queue
1 / 9 assessed
models shipped ad hoc · no documented AI policy · scope undefined
Several product teams have put models into production. There is no documented, approved AI policy, no stated scope for an AI management system, and no link to the company's objectives or risk appetite. Each team decides for itself what is acceptable.
1 · Annex A control area
2 · Conformity verdict
3 · Corrective action / evidence
Pick a control area, a verdict, and a corrective action to continue.
Gap map
This scenario: map the control area and judge how big the gap is.
Gap assessment
A set of org scenarios across the AI management system. For each of 9, decide the Annex A control area, the conformity verdict, and the corrective action that closes the gap.
So far: 0 / 9 scenarios assessed.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based gap-assessment lab: work a set of organisation scenarios against ISO/IEC 42001 — the certifiable AI management system (AIMS) standard — and decide where each one conforms and where it falls short.
- For every scenario you map it to the right Annex A control area (A.2 policies, A.3 internal organization, A.4 resources, A.5 impact assessment, A.6 AI system life cycle, A.7 data, A.8 information for interested parties, A.9 use, A.10 third-party relationships), then set the verdict and the corrective action that closes the gap.
- Verdicts mirror a real management-system audit: Conformant, Opportunity for improvement, Minor nonconformity (an isolated lapse) and Major nonconformity (a required control or process absent or systemically failing).
- The core skill it drills: match the corrective action to the control area and grade severity honestly — a missing process is a Major NC, an isolated slip is a Minor, a better way to do a conforming thing is an OFI, and an effective, evidenced control is left alone.
- This is an internal readiness drill, not a certification: ISO/IEC 42001 is certified only by an accredited third-party body, and it pairs with ISO/IEC 27001 (ISMS), ISO/IEC 42005 (AI impact assessment), ISO/IEC 27090 (AI security threats) and the NIST AI RMF.
The corrective action follows the control area — and the severity has to be honest
Most gap-assessment mistakes come from two habits: putting a finding in the wrong control area, and grading its severity by feel. The scenarios in this lab are built to force both distinctions. ISO/IEC 42001 structures an AI management system around the Annex SL management clauses and a set of Annex A controls — policies, internal organization, resources, assessing impacts, the AI system life cycle, data, information for interested parties, use, and third-party relationships. A scenario about who is accountable belongs in internal organization; one about telling users a decision is automated belongs in information for interested parties; one about a supplier contract belongs in third-party relationships. Map it right and the corrective action — the policy, the AI system impact assessment(which links to ISO/IEC 42005), the competence record, the supplier clause, the monitoring evidence — follows naturally.
Just as important: grade severity honestly and do not over-flag. A required control or process that is simply absent — no policy, no impact assessment, no allocation of third-party responsibilities — is a Major nonconformity. An isolated slip in a control that otherwise exists and works is a Minor. A conforming control that could be done better is an Opportunity for improvement, not a nonconformity. And a control that is in place, effective and evidenced is Conformant — the right call is to keep the evidence and move on. Recognising the control that is already doing the right thing is as much the auditor's skill as catching the gaps, and it is why certification is only ever awarded by an accredited third-party body after a real audit — this drill is how you get ready for one.
Frequently asked questions
What does the ISO/IEC 42001 Gap-Assessment Lab teach?
It teaches how to run an internal gap assessment of an AI management system (AIMS) against ISO/IEC 42001. For each organisation scenario you decide which Annex A control area it belongs to, whether it is conformant or a nonconformity, and which corrective action or piece of evidence actually closes the gap. It builds the judgement an AIMS owner, internal auditor or AI governance lead uses when preparing for certification.
Is ISO/IEC 42001 a certification, and does this lab certify anything?
ISO/IEC 42001:2023 is the certifiable standard for an AI management system, built on the Annex SL management-system structure plus the Annex A controls. Certification is granted only after an audit by an accredited third-party certification body — it is not something a tool can award. This lab is an internal readiness and training drill: it does not assess your real organisation, connect to anything, or issue any certificate. It scores your decisions on synthetic scenarios so you practise the audit judgement before the real thing.
How do the conformity verdicts differ?
A Major nonconformity is a required control or process that is absent entirely or failing systemically — for example, no AI policy at all, or no impact-assessment process for a high-stakes model. A Minor nonconformity is an isolated lapse in a control that otherwise exists and works — one deployment that skipped a sign-off gate. An Opportunity for improvement is a conforming control that could simply be done better, with no nonconformity to raise. Conformant means the control is in place, effective and evidenced — the right call is to leave it alone and keep the evidence, not to over-flag it.
How does ISO/IEC 42001 relate to ISO/IEC 27001, 42005, 27090 and the NIST AI RMF?
ISO/IEC 42001 is the management system for AI, and it is designed to sit alongside other standards. ISO/IEC 27001 is the information security management system it most closely mirrors and integrates with. ISO/IEC 42005 gives guidance on the AI system impact assessment that the Annex A impact control (A.5) points to. ISO/IEC 27090 provides guidance on AI security threats. The NIST AI RMF is a complementary, voluntary risk-management framework. The lab references these accurately so you understand where 42001 fits, without quoting the standards verbatim.