FREE CHECKLIST
ISO 42001 AIMS Compliance Checklist
The twelve-area ISO 42001 checklist for AI startups and model-first SaaS teams preparing for a Stage 1 and Stage 2 audit.
The 12 AIMS areas
🏛️
Governance
- ✓AI policy approved by executive leadership
- ✓AIMS scope documented (which AI systems are in scope)
- ✓AI roles and responsibilities assigned (model owner, oversight owner, risk owner)
- ✓Management review cadence set (at least annually)
📒
AI inventory
- ✓Every production AI system registered
- ✓Intended use and users documented per system
- ✓Risk tier assigned (low / medium / high)
- ✓Owner named per system
⚖️
Risk management
- ✓AI risk register with scenarios (bias, hallucination, misuse, safety, security)
- ✓Risk treatment plan with owners and target dates
- ✓Residual risk acceptance recorded for high-risk systems
- ✓Risk register reviewed at least quarterly
📝
AI impact assessments
- ✓Impact assessment completed for every high-risk system
- ✓Affected parties and risk scenarios documented
- ✓Mitigations traced to controls with evidence
- ✓Assessment revisited on material change or significant incident
🧪
Data governance
- ✓Dataset documentation (provenance, consent, retention)
- ✓Bias and quality checks on training data
- ✓Evaluation data separation from training data
- ✓Inference data retention aligned to policy
🔁
AI system lifecycle
- ✓Development gates with sign-off before deployment
- ✓Pre-deployment evaluation with benchmark + red-team
- ✓Change management procedure for model updates
- ✓Decommissioning procedure with data disposal
👥
Human oversight
- ✓Oversight workflow for high-risk inferences
- ✓Escalation path to human reviewer documented
- ✓Override capability tested and logged
- ✓Oversight staffing and competence recorded
📊
Monitoring in production
- ✓Drift monitoring in place for high-risk systems
- ✓Performance monitoring against defined thresholds
- ✓Incident log with AI-specific severity bands
- ✓Alerting routes to the oversight owner
🤝
Third-party AI vendors
- ✓Supplier register for foundation-model and tooling providers
- ✓Contract clauses covering acceptable use, data handling, incident notification
- ✓Risk assessment on vendor onboarding
- ✓Vendor review cadence set (at least annually)
📣
Transparency to users
- ✓Users informed when they interact with an AI system
- ✓System limitations communicated
- ✓Feedback or appeal mechanism in place
- ✓Acceptable-use terms for AI features
🎓
Workforce competence
- ✓AI awareness training for all employees
- ✓Role-based secure ML development training for engineering
- ✓Oversight training for human reviewers
- ✓Training completion tracked for audit sampling
🔍
Internal audit + continual improvement
- ✓Internal audit covering the AIMS at least annually
- ✓Non-conformities tracked with corrective actions
- ✓Management review minutes with actions and owners
- ✓Lessons from incidents fed back into controls
Prefer this as a PDF?
Download the full ISO 42001 checklist with the AI impact assessment template included.