An ISO 42001 gap analysis shows which clauses and Annex A controls would fail an auditor next month. The report covers scope, the AI system inventory, clause scores, a short risk note and a 90-day action list. In 2026 India market ranges the piece of work often sits between ₹1.5 lakh and ₹4 lakh, not a Seven Step fee.

The gap assessment cost, in 2026 India market ranges for one legal entity, is often ₹1.5 lakh to ₹4 lakh. That gap assessment cost is not a Seven Step rate card. People ask for a percentage score. An ISO 42001 gap analysis is more useful as a list of failures with owners than as a single mark out of ten. Seven Step Consulting is a consultancy in Gurugram. The report prepares an AI management system, the AIMS. It is not a certificate, and Seven Step does not issue one.

What an ISO 42001 gap analysis report actually contains

A usable ISO 42001 gap analysis has six parts. Leave one out and the board gets a mood, not a plan.

Scope comes first in an ISO 42001 gap analysis. Name the legal entity, the sites and the AI systems inside the boundary. “The organization” is not a scope. A customer chatbot, a credit model and a vendor copilot are three lines. If a team is pasting customer text into a public tool, that shadow system belongs on the list or in an explicit exclusion.

The inventory is the second part of an ISO 42001 gap analysis. Each system needs an owner, a purpose, the data it touches, and whether it is in production. A spreadsheet named Final_v7 with no owner column is itself a finding. An AI system that is already in production needs an owner, a purpose, and a record of how it was tested. If those three are missing, write that down. Do not smooth it into “partially met”.

Clause scores in an ISO 42001 gap analysis cover clauses 4 to 10. Context, leadership, planning, support, operation, performance evaluation, improvement. Score what exists this month. A policy that is still a blank template is not a partial pass. An ISO 42001 gap analysis that scores intent will not match what Stage 1 reads.

Annex A is the fourth part of an ISO 42001 gap analysis. There are 38 controls, grouped from A.2 to A.10. The Statement of Applicability is where you will later record what applies and why. At gap stage you are only marking which controls have evidence and which are a sentence. A one-line “not applicable” with no reason is a gap, not a decision.

A short risk note ties the worst gaps to harm. This is not the full AI risk assessment or the full AI impact assessment. Those come in the build, using ISO/IEC 23894 and ISO/IEC 42005 as guidance. The note should say which system, which people are affected, and which missing control matters first. Keep that note to two pages.

The 90-day action list closes an ISO 42001 gap analysis. Name the action, the owner and the week. “Improve governance” is not an action. “Name an owner for the credit model before Friday of week three” is an action. Ninety days is a planning horizon for a focused firm. It is not a promise of a certificate. A firm with a small inventory and leadership in the room can be ready for Stage 1 in about 90 days. Most builds take three to six months. The gap does not book the certification body.

A sample findings table

The rows below are a hypothetical example, not an ISO 42001 gap analysis of a real firm. They are not a client and not a Seven Step engagement.

Sample pages from an ISO 42001 gap analysis covering clauses, Annex A and the fee band
Report line Example finding Why it would fail a sampling
Scope Boundary written as “the organization”, no system named No one can see what the certificate would cover
Inventory Sheet called Final_v7, owner column blank No person to interview at Stage 2
Clause 5 Leadership has not approved an AIMS policy Commitment is a slide, not a record
Clause 6 No AI risk assessment for the live chatbot Planning is not evidenced
Annex A Control marked excluded in one line, no reason Statement of Applicability would not hold
90-day list “Name a model owner within 30 days” Specific enough to staff

Read the table as a shape. Your ISO 42001 gap analysis will name your systems, not these placeholders. If your file looks like the example, you are at the start.

What changes the figure

A single-product firm usually sits at the low end of the gap assessment cost band. A bank or multi-site file can sit at the high end of the gap assessment cost band, and sometimes the conversation grows past a gap into a full build. Ask whether the gap assessment cost includes the system inventory or assumes you already have one. Travel and a second site can move the gap assessment cost even when the clause list does not. Do not compare a gap assessment cost from 2024 with a quote you receive now. The gap assessment cost is the price of the report, not the price of the certificate.

Ten systems take longer than one. A regulated file adds interviews. That time is not a government fee.

As of 31 October 2026, only part of the DPDP Rules are in force. The main fiduciary duties commence on 13 May 2027, so do not score a duty that has not started. FREE-AI does not make ISO/IEC 42001 mandatory. The EU AI Act does not treat the standard as a presumption of conformity. MeitY’s guidelines of 5 November 2025 are non-binding.

Where an ISO 42001 gap analysis stops

An ISO 42001 gap analysis comes earlier than an ISO 42001 readiness assessment. An ISO 42001 readiness assessment asks whether you should book Stage 1. Do not buy an ISO 42001 readiness assessment when you still have no inventory. An ISO 42001 readiness assessment assumes the controls have been operated, at least in part. Stage 1 is what an ISO 42001 readiness assessment is trying to predict. A thin ISO 42001 readiness assessment that skips Annex A is a slide. You can run an ISO 42001 readiness assessment after the 90-day action list is closed. An ISO 42001 readiness assessment is still not the certification audit.

Count an ISO 42001 gap analysis and the later check as two products. An ISO 42001 gap analysis tells you what would fail next month. The later check tells you whether the failures were closed. Booking Stage 1 on the back of a gap, with the actions still open, wastes the body’s day and your fee. Stage 2 will sample the same systems the gap should already have named.

An AI governance assessment can be wider than a clause score. Use an AI governance assessment when the board wants a view of owners, use cases and buyer questions, not a certificate date. An AI governance assessment that never opens Annex A will not tell you what an auditor would find. FREE-AI and the DPDP Act timeline belong in an AI governance assessment for a bank. They do not replace the clause scores. An AI governance assessment is not a legal opinion. If a vendor sells an AI governance assessment as a certificate, you are in the wrong meeting. Pair an AI governance assessment with the system inventory or it floats above the models. The EU AI Act questions from a customer can sit inside an AI governance assessment as a note, not as a presumption of conformity.

NABCB accredits certification bodies. It does not accredit an ISO 42001 gap analysis. Check a body’s scope on the NABCB or IAF directory when you are ready to book, not on the morning the gap workshop starts. An accredited ISO 27001 mark is not an AIMS mark. This article names no body.

How to read the report on Monday

Put the 90-day list next to the calendar. An action with no name will not happen. Share the clause scores with the people who will sit in Stage 2 and with procurement. The report is a working paper. It goes stale when a new model ships and nobody adds a row.

An ISO 42001 gap analysis should be short enough to finish in a sitting. Annex tables can be long. The front of the report should not be. A director ought to see scope, the five worst gaps and the first month of actions without hunting.

Book the gap before you book the body

Book a gap assessment. We will score the clauses and Annex A against the systems you actually run, and we will separate that report from any certificate date. Use the contact page: https://www.sevenstepconsulting.com/contact-us/

Start with the systems you already run

If the board wants a date, give them the failures first. Book a gap assessment. We will keep the work inside an ISO 42001 gap analysis with named systems, clause scores and a 90-day list, rather than a percentage that nobody can audit.