An ISO 42001 gap analysis has no fixed duration: you need a scoped estimate based on the AI systems, records and people the review must cover. The assessment identifies gaps; closing those gaps and completing certification are separate work. For your 2026 plan, agree the evidence requirements and report deadline before you commit to a timetable.
How long does an ISO 42001 gap analysis take?
The duration depends on the agreed scope and the evidence available for review. ISO 42001 sets requirements for an AI management system. It does not prescribe a universal number of days for a gap analysis.
Ask for a timetable that separates preparation, assessment and reporting. A deadline for the final report means little if nobody has agreed when the reviewer receives the records or meets the responsible people.
The standard covers 7 management-system clauses, numbered 4–10, and includes 38 reference controls grouped under 9 control objectives in Annex A. These define what needs consideration, not how many days your assessment takes; control applicability depends on your risks and their treatment.
Use this sequence to build a defensible estimate:
- Define scope. Identify the organisational boundary, AI activities and systems under review.
- Prepare evidence. Gather existing policies, risk records, operating records and responsibilities.
- Review records. Compare the management system and applicable controls with the standard.
- Interview owners. Check how the documented arrangements work in practice.
- Agree findings. Confirm gaps, unresolved evidence requests and corrective actions.
For the wider process, read how to run an ISO 42001 gap analysis before certification. Keep the assessment deadline separate from the deadline for completing its actions.
Why this matters
A quick report is not the same as a useful report. You need findings that explain what is missing, why it matters and who must act.
For a 2026 certification plan, the gap analysis should give you a starting position. It should not imply that certification follows automatically when the report arrives.
Plan around evidence and decisions, not just meetings. A workshop without supporting records can identify questions, but it cannot establish that the management system operates as described.
Separate review time from elapsed time
Review time is the effort spent examining evidence, interviewing owners and writing findings. Elapsed time is the period between the agreed start and delivery of the report.
Those are different measures. A reviewer can finish examining a policy while still waiting for the records that show staff follow it.
Ask your assessor to explain both measures in the proposal:
- Assessment effort: the work included in the engagement.
- Calendar schedule: when each activity starts and finishes.
- Dependencies: the records, access and decisions you must supply.
- Completion condition: what must be delivered before the assessment ends.
Do not accept an unexplained deadline. Ask whether it assumes all evidence is available at the start and whether follow-up questions are included.
Also name the person who can resolve conflicting answers. If product, legal and engineering teams describe the same AI system differently, the reviewer needs an agreed account of its purpose, ownership and operation.
Choose the assessment depth before choosing the deadline
A document review and an evidence-led assessment answer different questions. Neither should be described as certification.
| Assessment approach | Best for | What it establishes | Benefit | Limitation |
|---|---|---|---|---|
| Document review | Checking the written starting position | Whether supplied documents address relevant requirements | Identifies missing or incomplete documentation | Does not establish that documented processes operate consistently |
| Evidence-led assessment | Planning corrective work before certification | Whether documents, records and owner explanations support the management system | Produces findings tied to operational evidence | Requires access to records and responsible people |
Choose an evidence-led assessment when you need an actionable certification plan. Use a document review when your immediate question is whether the written foundation is complete.
For a 2026 assessment, state the depth explicitly. Ask whether the reviewer will examine operating records, challenge inconsistent evidence and discuss findings with process owners.
A narrower review has a narrower conclusion. That is acceptable when the limitation is clear; it becomes a problem when a document check is presented as proof of readiness.
What should happen during the gap analysis?
The assessment should follow a clear sequence. Agree the outputs at each stage so you can see whether the work is progressing or waiting on an unresolved request.
Define scope
Write down which organisation, activities and AI systems the review covers. Include your role in those systems: developing, providing or using AI creates different responsibilities to examine.
Do not use the product name as the entire scope statement. Describe the activities, teams and boundaries that the management system needs to manage.
Prepare evidence
Collect the current records before the reviewer starts examining them. Mark drafts clearly and identify the owner of each document.
Useful evidence includes:
- The AI management system scope and policy.
- Assigned roles and responsibilities.
- AI risk assessment and treatment records.
- AI system impact assessment records.
- Relevant development, deployment and operating records.
- Supplier arrangements and supporting information.
- Monitoring, internal audit and management review records, where available.
Missing records are findings to investigate. Do not create retrospective evidence that implies an activity happened when it did not.
Review records
Map each relevant requirement to the evidence that supports it. Distinguish a missing document from a process that exists but lacks reliable records.
Check applicability decisions as well. An excluded control needs a reason linked to your scope and risk treatment, not an empty cell in a spreadsheet.
Interview owners
Ask responsible people to explain how the process works. Compare their explanations with the records rather than treating either source as sufficient on its own.
Use interviews to resolve questions about approvals, responsibilities, monitoring and changes. Record unresolved points instead of assuming a favourable answer.
Agree findings
Give each finding an evidence reference, a clear explanation and an accountable owner. Separate confirmed gaps from questions that remain open because evidence was unavailable.
Agree the corrective work after the findings are understood. The report should show what needs attention without implying that every suggested action is already complete.
Agree the scope and evidence before assessing gaps.
Why ISO 42001 gap analysis duration varies
ISO 42001 assessments examine the organisation's management arrangements and relevant AI activities. The timetable needs to reflect what the reviewer must inspect and what your team must supply.
Check these factors before accepting an estimate:
- Scope breadth. Identify the AI systems, activities, teams and organisational boundaries included.
- Evidence readiness. Establish whether records are current, accessible and linked to their owners.
- Process maturity. Distinguish established operating practices from policies that have only been drafted.
- Owner availability. Schedule the people who can explain decisions and provide supporting evidence.
- Supplier dependencies. Identify information you need from external providers and who will request it.
- Assessment depth. Agree whether the engagement includes document checks, operating evidence, interviews and follow-up review.
Get these assumptions into the written scope. Otherwise, a changed boundary or an outstanding evidence request can leave you discussing a deadline that no longer describes the work.
For your 2026 schedule, identify dependencies before booking the final findings meeting. A meeting date does not resolve missing evidence.
What should the final report contain?
The report should let you move from assessment to corrective work without repeating the investigation. A list of requirement numbers and red status cells is not enough.
Ask for findings that contain:
- Requirement: what the assessment checked.
- Evidence: which records or explanations support the finding.
- Gap: what is missing, incomplete or inconsistent.
- Action: what needs changing or further investigation.
- Owner: who is accountable for the next step.
- Verification: what evidence will demonstrate completion.
Include the scope and limitations in the report. Readers need to know which systems were assessed and which records were unavailable.
Keep priorities separate from completion status. A high-priority finding is not resolved because someone has accepted responsibility for it; closure needs evidence of the completed action.
How do you shorten the assessment without weakening it?
Remove waiting and duplication, not evidence checks. Prepare the material, book the right people and keep questions in a shared action log.
Before the assessment starts:
- Confirm the scope with the reviewer and internal owners.
- Create an indexed evidence list with current versions.
- Check that the reviewer can access the records.
- Mark unavailable evidence and name the person handling each request.
- Book interviews with people who own the relevant processes.
- Agree how questions and findings will be approved.
During the review, answer the actual evidence request. Sending a folder of unrelated policies does not establish that the requested process exists.
Automation supports this work where it helps you manage compliance records. OneClickComply compliance automation software is for growing businesses seeking end-to-end cyber security compliance management.
OneClickComply provides software that automates cyber security compliance certifications, including ISO 27001, Cyber Essentials and SOC 2. Confirm ISO 42001 coverage before selecting it for this particular assessment; software does not replace accountable decisions or independent certification.
Does a gap analysis include fixing the gaps?
A gap analysis identifies differences between your current arrangements and the requirements under review. Corrective work is a separate activity unless the engagement explicitly includes it.
Ask the assessor to separate diagnosis, implementation support and reassessment in the scope. This keeps the report deadline from becoming confused with the date every finding will be closed.
Can existing ISO 27001 work shorten the assessment?
Existing ISO 27001 records provide useful starting material where the processes and organisational scope overlap. They do not establish ISO 42001 conformity on their own.
Reuse relevant document control, audit and management review arrangements, then assess the AI-specific requirements separately. Check the evidence rather than assuming that a familiar policy answers a different requirement.
Does finishing the gap analysis mean you are ready for certification?
Finishing the gap analysis means you have completed the agreed assessment, not that you have achieved certification. Readiness depends on the findings, corrective work and evidence that the management system operates.
Keep your 2026 certification milestone separate from the report delivery milestone. Agree the next review point after you understand the gaps.
Frequently asked questions
One last thing
Ask this before agreeing the timetable: What exactly makes the gap analysis complete?
The answer should identify the report, evidence boundaries, unresolved questions and agreed findings. A short deadline without that definition is not a useful plan.
Set the boundary. Gather the evidence. Assign the actions. Seriously Simple Cyber Compliance.