Tier 2 · fixed-price engagement
ISO/IEC 42001 gap assessment
Where your AI management system stands against ISO/IEC 42001 today, control by control, with the evidence index an auditor asks for first.
Who this is for
An organization whose customer contract, tender or group policy names ISO/IEC 42001 certification as the destination.
Fixed price
$8,900
- Duration
- 2 to 3 weeks
- Deposit
- $1,500
- Other currencies
- €8,100 · £6,890 · S$11,900
- Catalog
- T2-05
Thirty minutes with the engineer who would run the work, before any paperwork.
The work, stage by stage
In order, with what happens at each stage and what it produces. The timings are the ones the catalog prices, not an estimate written for this page.
Scope the management system
Days 1 to 2
Agree what the AI management system covers: which systems, which teams, which suppliers, and where its boundary sits. A scope drawn too wide is the most common reason a first audit goes badly.
Read what exists
Days 3 to 5
Policies, risk assessments, model documentation, change records, supplier agreements and incident history, read as they are rather than as described. What is missing is recorded as a gap; what exists but is unsigned, undated or unowned is recorded separately, because those fail an audit differently.
Interview the people who operate it
Week 2
Short sessions with the engineers, the owner of each policy, and whoever answers when something breaks. An auditor will ask them, so this asks them first and records where practice and documentation diverge.
Write the gap list and the evidence index
Week 2 to 3
Every gap gets an owner, a remediation step and a sequence position ordered by what an auditor asks for earliest. Every control already satisfied gets the artifact that proves it and the person who maintains it.
Walk it through
On delivery
A call on the document with whoever has to act on it, so the sequence is agreed rather than received.
Everything that arrives, listed
The contents of the document, and the artifacts that come with it. If something here would not be useful to you, say so before we start and the scope changes.
- A control-by-control status list, each entry marked satisfied, partial or absent, with the reasoning recorded
- An evidence index naming the artifact that satisfies each satisfied control and the person who maintains it
- A remediation sequence, ordered by what an external auditor asks for first rather than by what is easiest
- A section listing what you do not need us for, which is the part most firms leave out
- The scope statement the assessment was run against, so a later reader knows what was and was not examined
What this covers, and who takes the rest
Stated up front, because scope is what derails an engagement in week two rather than at the proposal.
Inside this engagement
- The AI management system as it operates today, not as documented
- Supplier and third-party arrangements that touch an in-scope AI system
- Evidence structure, so the artifacts exist before anyone asks for them
Handled separately
Named so you can plan and budget for it, whether we do it or somebody else does.
- The certification audit itself, which an accredited certification body runs on its own engagement and its own fee
- Remediation work, scoped once the gap list names what has to change
Start with a call, not a proposal.
Thirty minutes, straight to the engineer who would run the work. We will tell you if a smaller engagement answers your question, or if nothing here does.
Typical reply within one business day · Engagements start at $2,500
Fixed price · 2 to 3 weeks