An ISO 42001 checklist is a clause-by-clause pass over context, leadership, planning, support, operation, evaluation and improvement, plus Annex A. Use it to mark gaps before Stage 1. It is a readiness pass. It is not a certificate, and it will not replace a certification body.

What this ISO 42001 checklist walks through

A laptop in a conference room shows a workbook named Final_v7. Every status cell is green. The owner column says “AI team”, which means nobody. Stage 1 is booked. The sampler will ask for the impact record on the model that scores leads, and for the person who can switch that model off.

People open an ISO 42001 checklist on a Friday and tick every box.

ISO/IEC 42001:2023 is the AI management system standard, the AIMS. Annex A holds 38 controls from A.2 to A.10. Mark evidence you can open in a minute. A workbook alone is not the system. Certification is voluntary. Seven Step Consulting does not issue the certificate. A certification body does. Check current scope on the NABCB directory or the IAF directory. This page names no logos and does not call a body accredited from memory.

A European buyer may ask about the EU AI Act. Most Annex III high-risk duties have applied since 2 August 2026. The sheet is evidence for that conversation. It does not by itself create a presumption of conformity.

When a buyer says “meet ISO 42001 requirements”, they mean a working AI management system, not a logo on the website.

Clause 4: context of the organization

Write the legal entity, the sites and the AI systems inside the boundary. Interested parties include the board, customers, people the model affects and the certification body. If personal data sits in prompts, training sets or outputs, record it. The main DPDP Act duties on notice, security, breach intimation and fiduciary obligations commence on 13 May 2027. Rules 1, 2 and 17 to 21 are in force now. Do not describe the full rulebook as already live. A model with no owner often hides outside the scope. Pull it in or write the reason it is out.

ISO 42001 requirements in clause 4 are context, interested parties and a scope that lists AI systems.

Clause 4 is done on the ISO 42001 checklist when the scope names the legal entity, the sites and every AI system you will show an auditor.

Clause 5: leadership

Top management shows commitment with an AI policy, named roles and an approval you can find. A town-hall slide does not carry the clause. Each AI system needs a person. “Platform team” fails. The owner can stop a release and knows which uses are forbidden.

Leadership under ISO 42001 requirements means a policy, roles and commitment from top management.

On clause 5, the ISO 42001 checklist is signed policy plus a named owner, not a slide the CEO saw once.

Clause 6: planning

You need an AI risk assessment, a treatment decision and an AI impact assessment where people can be affected. ISO/IEC 23894 guides the risk work. ISO/IEC 42005 guides impact. Objectives must be measurable this quarter. The Statement of Applicability records which Annex A controls apply and why an exclusion is acceptable.

Planning turns ISO 42001 requirements into an AI risk assessment, treatment, an AI impact assessment and objectives.

Clause 6 is done on the ISO 42001 checklist when the AI risk assessment, the treatment and the AI impact assessment have dates.

Clause 7: support

Resources, competence, awareness, communication and documented information sit here. The person who approves a model needs a competence record. Final_v7 on a personal drive is how two policies both look current. The owner, the developer and the person who demos the model should know where to raise a concern.

Support ISO 42001 requirements cover resources, competence, awareness, communication and documented information.

Clause 7 is done on the ISO 42001 checklist when competence records and the current procedure version sit in a controlled folder.

Clause 8: operation

Show the release you shipped, the monitoring you run and the impact review you repeated when the use changed. If a vendor swapped the hosted model behind an API, show that you noticed. A quiet internal tool counts when staff use it on customer content. Ask engineering for the API keys.

In operation, ISO 42001 requirements meet the model that is already in production.

Clause 8 is done on the ISO 42001 checklist when last month’s model change has a release record.

Clause 9: performance evaluation

Bring monitoring records, an internal audit that sampled a live AI system and a management review that discusses them. If you already hold ISO 27001, last year’s information-security audit did not automatically open the model. Do the internal audit before you ask a certification body for Stage 1 dates.

Evaluation under ISO 42001 requirements means monitoring, internal audit and management review.

Clause 9 is done on the ISO 42001 checklist when internal audit sampled a live system and management review minutes mention it.

Clause 10: improvement

A nonconformity needs a cause, a correction and a check that the fix held. “Human error” is rarely the cause. A missing owner or a vendor change you did not track is closer to the truth. A tighter prompt rule counts when it is recorded against the risk row.

Improvement under ISO 42001 requirements means you close nonconformity with a cause and a checked fix.

Clause 10 is done on the ISO 42001 checklist when a nonconformity has a cause, an action and evidence of close-out.

Annex A themes: policy through third parties

You select controls in the Statement of Applicability and keep evidence for the ones you include.

Policy. Align the AI policy with policies you already run, and review it on a cycle. Roles. Name people, and give them a path to report concerns. Resources. List data, tools, compute and skill for each AI system. Impact. Record effects on individuals and groups. Downtime alone is a security topic. Lifecycle. Leave a trail from design through test, deployment, operation and logs. Data. State provenance and quality, including prompt content when you do not train your own model. Information to users. State the intended use, the limits and how you report incidents. Use. Make the sales demo match the production limit. Third parties. Assess model and API suppliers. A contract clause with no review of the live call is incomplete.

Annex A does not replace ISO 42001 requirements in clauses 4 to 10. It supplies controls for the Statement of Applicability.

Annex A is done on the ISO 42001 checklist when the Statement of Applicability says which controls apply and the evidence exists for the ones you included.

Third parties belong on the ISO 42001 checklist because a hosted model you call by API is still your system to govern.

Data rows belong on the ISO 42001 checklist when training data, prompt logs or customer content can change the output.

Where ISO 42001 requirements sit in clauses 4 to 10

Clauses 4 to 10 are the management system. Annex A is the control set you apply through the Statement of Applicability. If a row has no owner, fix the row before you decorate the policy.

The table auditors can sample

The table is a compressed ISO 42001 checklist. Copy the rows. Do not add a hundred extra columns. This ISO 42001 checklist is the workbook you can ask for. The sheet can be sent after a short form. It is not a public file.

ISO 42001 checklist rows for clauses 4 to 10 and Annex A before a Stage 1 visit
Item What good looks like Evidence an auditor asks for
Clause 4 scope Legal entity, sites and AI systems are named Scope statement with version and date
Clause 5 policy Top management has approved the AI policy Signed PDF or approval email
Clause 5 roles Every AI system has a named owner who can stop it Role matrix with personal names
Clause 6 risk AI risk assessment has scores, owners and treatment Register extract and last review date
Clause 6 impact AI impact assessment covers people affected by the system Impact record and what you changed
Clause 7 documents Current procedures are controlled Document register, not Final_v7
Clause 8 operation Last model change has a release record Ticket, validation note, approver
Clause 9 internal audit Last audit opened a live AI system Report, sample list, findings
Clause 10 corrective action A nonconformity has cause, fix and a check Closed record with evidence
Annex resources and lifecycle Data, tools, compute, tests and logs exist per system Inventory note, test record, log sample
Annex data You can say where data came from and how good it is Data sheet and a quality check
Annex information to users Intended use and limits are visible to users Notice, release note or in-product text
Annex third parties API and model vendors are assessed Supplier file and contract clause

Keep the ISO 42001 checklist evidence column harder to satisfy than the status column. A red row on the ISO 42001 checklist is a gap. A green row with no file path is also a gap.

How to mark the ISO 42001 checklist without lying to yourself

Open the file before you color the cell. If you cannot show it in a minute, the row stays open. Do this with the owner present.

What an ISO 42001 audit checklist asks to see

An ISO 42001 audit checklist is the same topics written as questions an auditor can ask on site.

Stage 2 teams work from an ISO 42001 audit checklist even when the form carries the certification body’s logo.

Take the ISO 42001 audit checklist into the opening meeting so owners know which systems will be sampled.

An ISO 42001 audit checklist with no named owner next to each system is a wish list.

Internal audit can reuse the ISO 42001 audit checklist and reduce the sample. The person asking should not own the system being sampled.

The certification body will follow an ISO 42001 audit checklist into a live screen, not into your formatting.

Keep one ISO 42001 audit checklist for the management system and a short sample sheet per AI system.

If a row on the ISO 42001 audit checklist has no evidence, write the gap in the cell. Blank confidence delays Stage 1.

How to run the readiness checklist in the week before Stage 1

Treat the readiness checklist as a pass you can finish before you request a quote PDF from a certification body. Ask for audit days and sites. Do not ask the body to write your boundary.

A readiness checklist with every cell marked yes and an empty evidence column has failed. Remove the color until the path to the file is real.

Sit with the model owner while you fill the readiness checklist. A quality lead alone will guess.

The readiness checklist can be sent after a short form. It is not a public file. Name the legal entity on that form.

Founders ask if a readiness checklist will satisfy a US buyer. It shows gaps. The buyer still wants the inventory, the impact note and the vendor file.

After internal audit, update the readiness checklist so the next surveillance audit starts from current evidence.

If the policy is unsigned, the readiness checklist stays open on that row. Do not shade it amber and move on.

Clause 4 on the readiness checklist is interested parties, scope and the AI system list. Leave it blank and every later row is fiction.

Request the sheet

Download the checklist (email gate). We can send the sheet after a short form on https://www.sevenstepconsulting.com/contact-us/. Name the legal entity and the number of AI systems you believe are in scope. There is no public file address. If the gaps are wider than an internal week, see how a Gurugram team runs the build at https://www.sevenstepconsulting.com/iso-42001-aims-artificial-intelligence-management-system/.