ISO/IEC 42001 Implementation Project Plan Template
An editable plan for implementing an ISO/IEC 42001 AI management system, from scope to the Stage 2 audit: twelve phases with tasks, owners, deliverables, exit criteria and indicative durations.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Subscribers customise it with their own details and generate the document for their own work.
Plan preview: phases, owners and deliverables
Durations are indicative planning figures, not a benchmark. The full template adds exit criteria and 35 tasks with owners, outputs, status and target dates.
| Phase | Indicative duration (weeks) | Phase owner | Deliverables |
|---|---|---|---|
| Scope and context (clause 4) | 3 | AIMS manager | Context register; interested parties and requirements; AIMS scope statement |
| Gap assessment | 3 | AIMS manager | Gap report against clauses 4–10 and Annex A areas; prioritised action list |
| Policy, roles and objectives (clauses 5 and 6) | 3 | AIMS manager | AI policy; roles and responsibilities (RACI); AI objectives with KPIs |
| AI risk and impact assessment (clauses 6 and 8) | 6 | AIMS manager | AI risk method; AI risk register; AI system impact assessments; risk treatment plan |
| Statement of Applicability | 2 | AIMS manager | Statement of Applicability with justifications and implementation status |
| Control implementation (Annex A) | 12 | AI system owners | Implemented controls with owners; operational records; supplier terms |
| Documented information (clause 7) | 4 | AIMS manager | Document register; controlled documents and records |
| Competence and awareness (clause 7) | 4 | HR / learning | Competence matrix; training records; awareness evidence |
| Internal audit (9.2) | 3 | Internal audit | Audit programme; audit reports; nonconformities with corrective actions (10.2) |
| Management review (9.3) | 1 | Top management | Management review minutes, decisions and actions |
| Stage 1 audit | 2 | AIMS manager | Stage 1 report; fixes for Stage 1 concerns |
| Stage 2 audit and certification decision | 4 | AIMS manager | Stage 2 report; corrective action plan for any nonconformities; certification decision |
Customise it with your organisation’s details and download it as Word, PDF, Markdown or CSV with Pro.
An editable implementation plan for an ISO/IEC 42001 AI management system, from scope to the Stage 2 audit: scope and context, gap assessment, policy and objectives, AI risk and impact assessment, Statement of Applicability, Annex A controls, documented information, competence, internal audit, management review, and the Stage 1 and Stage 2 audits. Each phase has tasks, owners, deliverables, an exit criterion and an indicative duration.
Your context
Assumptions and constraints
Phases
One row per phase. Durations are indicative.
Tasks
Tasks per phase with who is Responsible and Accountable, the output, status and target date.
Loading…
TL;DRWhat this template gives you
4 points
- Twelve phases in the order most AIMS implementations run them, from clause 4 scope to the certification body's Stage 2 audit and decision.
- Each phase has an owner, deliverables and an exit criterion; each task has who is Responsible and Accountable and the output it produces.
- Durations are indicative planning figures for a mid-size organisation with an existing ISO/IEC 27001 ISMS, not a benchmark.
- The summary adds up the phases, gives an indicative finish date from your start date and tracks task status.
Frequently asked questions
How long does ISO/IEC 42001 implementation take?
It varies with scope, the number of AI systems, what an existing ISO/IEC 27001 ISMS already provides and certification body lead times. The sample phases add up to about 47 weeks if run one after another; several run in parallel in practice. Use it as a starting estimate, not a benchmark.
What happens at Stage 1 and Stage 2?
Stage 1 is the certification body's review of your AIMS design and documentation and of your readiness for Stage 2. Stage 2 assesses whether the AIMS is implemented and effective, through interviews and evidence sampling. The certification decision follows, made by the accredited certification body.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. A free account gets 3 free tool runs, shared across every tool; after that, customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) needs Pro, $5/month or $40/year. Your work is saved in your own browser.
Tools for each standard
AI standards toolkit →Every ISO tool on PlayCISO, grouped by the standard it supports. Standards are described in our own words; you still need your own copies of them.
ISO/IEC 27090: AI security guidance
Guidance on security threats to AI systems. It cannot be certified; apply it inside your ISO/IEC 27001 or 42001 management system.
- ISO 27090 Readiness ChecklistProScore six weighted themes and see your gaps ranked.
- ISO 27090 in 10 MinutesFreeSix short modules with quizzes and a learning badge.
- Can You Be Certified to ISO 27090?FreeNo. What can certify or attest AI security instead.
- ISO 27090 Practice PathFreeAI security labs grouped by threat theme, with progress.
- ISO 27090 Threat-Mapping LabProMap AI scenarios to threat class, CIA property and fix.
- ISO 27090 Implementation LabProFive rounds as the CISO, ending with the auditor.
- ISO 27090 Auditor InterviewFreeAnswer an assessor; scored on evidence and ownership.
- ISO 27090 RACI TemplateProNine roles × 32 AI security activities, checked for one Accountable each.
- ISO 27090 Project Plan TemplateProEditable phases, tasks, owners, deliverables and indicative durations.
- ISO 27090 Project Plan GeneratorProA phased plan scaled to your size, systems and certifications.
- ISO 27090 Maturity TimelineProFive maturity levels with indicative months between them.
- ISO 27090 Cost EstimatorFreePeople-days per phase, a cost range and annual effort.
- ISO 27090 Sample ArtefactsProScope statement, threat register, policy, RACI and test log.
- ISO 27090 AI Security Test PlanProThirty test cases across ten AI threat areas.
- ISO 27090 Traceability MatrixFreeTrace each AI threat to controls, tests and evidence.
- AI Shared-Responsibility MatrixFreeProvider, customer or shared, per deployment model.
- AI Security Metrics SetFree20 KPIs and KRIs mapped to the threat themes.
- AI Security Review CalendarFree12 months of reviews with owners, as an .ics file.
- AI Security Board Briefing PackFreeA one-page board brief and five slides with notes.
- ISO 27090 Alignment StatementFreeSafe "aligned with 27090" wording for trust pages and RFPs.
ISO/IEC 42001: AI management system
The certifiable AI management system standard: clauses 4 to 10 plus Annex A controls, audited by an accredited certification body.
- ISO 42001 AIMS Scope BuilderFreeClause 4: context, interested parties and a draft scope.
- ISO 42001 Gap Assessment LabProPractise judging conformity against the AIMS standard.
- ISO 42001 RACI TemplateProTen roles × clauses 4–10 and Annex A areas A.2–A.10.
- ISO 42001 Annex A GuideFreeA.2 to A.10: what good looks like and audit evidence.
- ISO 42001 SoA BuilderProStatement of Applicability with status and justification.
- ISO 42001 Objectives PlannerFreeMeasurable AI objectives with owners and KPIs.
- ISO 42001 AI Competence MatrixFreeClauses 7.2 and 7.3: roles, target levels and gaps.
- ISO 42001 Documented Information RegisterFreeEvery AIMS document and record with owner and retention.
- ISO 42001 Evidence BinderProAudit evidence by clause and Annex A area.
- ISO 42001 Internal Audit PlannerFree9.2: a risk-based 12-month audit programme.
- ISO 42001 Management Review PackPro9.3: every input, KPIs, decisions and actions.
- ISO 42001 Nonconformity TrackerFree10.2: root cause, corrective action, effectiveness.
- ISO 42001 Mock AuditProRehearse the certification audit and get a debrief.
- ISO 42001 Stage 2 Audit LabFreeThree audit days with a certification auditor.
- ISO 42001 Certification CountdownFreePlan back from your certificate date.
- ISO 42001 + 27001 IMS PlannerFreeWhat an AIMS and an ISMS can share or merge.
ISO/IEC 42005: AI system impact assessment
How to assess an AI system's impact on people, groups and society; feeds the 42001 impact assessment.
- ISO 42005 AI Impact AssessmentProAssess impact on people, groups and society.
ISO/IEC 23894: AI risk management
Guidance on managing AI risk, built on ISO 31000; feeds the 42001 risk assessment and treatment.
- ISO 23894 AI Risk Treatment PlanProIdentify, analyse and treat AI risks with owners.
ISO/IEC 27001: information security management
The certifiable ISMS that most AI security controls plug into.
- ISO 27001 Readiness ChecklistProCheck ISMS readiness before a 27001 audit.
Across standards
Implement a control once and evidence it for every framework that asks for it.
- AI Standards CrosswalkPro42001, 27001, 27090, EU AI Act and NIST AI RMF side by side.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.