%201.svg)
HIPAA Compliance Checklist for 2025
TL;DR
- ISO 42001 certification runs through five phases: foundation, inventory and gap assessment, risk and controls, internal audit and management review, and the external certification audit
- Most implementation delays happen in phase two: teams try to write policy before they have an accurate AI inventory to write policy about
- Annex A controls require technical evidence, not just documentation. This is where most checklists stop being useful
- Certification typically takes 6 to 18 months, and the timeline is almost always set by how long the evidence-gathering phase takes, not the audit itself
- CloudEagle's AI governance module produces the AI inventory, risk scoring, policy enforcement logs, and audit evidence this checklist calls for, automatically
This ISO 42001 implementation checklist is built for the team actually running the certification project, not for understanding what the standard means.
Five phases. Each with the concrete actions an auditor expects to see evidence of, not just a policy that describes them.
If you are looking for an explanation of what ISO 42001 requires and why enterprise customers are starting to ask about it, that is covered here: 👉 What ISO 42001 Requires and Why Your Enterprise Customers Are Already Asking
This checklist picks up where that one stops.
1. What Does an ISO 42001 Implementation Checklist Need to Cover?
ISO 42001 follows the same high-level management-system structure as ISO 27001: scope and leadership, planning, support, operation, evaluation, and improvement.
A real ISO 42001 implementation checklist has to move through all five phases in order. Skipping ahead to write policy before finishing the inventory phase is the single most common reason implementations stall, because every downstream risk assessment has to be redone once the inventory is complete.
Each phase below maps to the clause structure of the standard. Each checklist item maps to something an auditor will look for evidence of, not just documentation that describes the intention.
2. Phase 1 Checklist: Scope, Leadership, and Policy Foundation
This phase establishes the organizational infrastructure the AIMS sits on. Nothing downstream is auditable without it.
Scope definition:
- Define the AI Management System scope: which business units, AI systems, and jurisdictions are included
- Document what is explicitly out of scope and why
- Confirm the scope covers both internally developed AI and AI accessed through vendor products
Leadership and governance structure:
- Secure documented top management commitment to the AIMS, not a verbal endorsement, a signed policy or board resolution
- Assign a named AI governance owner with authority to enforce policy across business units
- Define roles and responsibilities for AI governance across IT, Security, Legal, and business leadership
Policy foundation:
- Draft and approve an AI policy statement covering acceptable use, risk tolerance, and escalation paths
- Ensure the policy is communicated to all employees and acknowledged, not just published
- Identify interested parties: regulators, customers, employees, and partners, and document their AI governance expectations
Completion signal: Top management has signed the AI policy. A named owner exists. The scope document is finalized and reviewed by the certification body before Phase 2 begins.
3. Phase 2 Checklist: AI Inventory and Gap Assessment
This is the phase that determines whether everything else runs on schedule or not.
Most teams underestimate how long building an accurate AI inventory actually takes. SSO logs show the apps IT provisioned. They do not show the AI features embedded in approved SaaS products, the personal accounts employees are using alongside enterprise seats, or the AI tools adopted by business units through expense cards.
A complete AI inventory for ISO 42001 certification requires all of those, not just the approved list.
AI inventory:
- Build a live inventory of every AI system in use, sanctioned and shadow, across the organization
- Include AI features embedded inside approved SaaS tools that were never separately reviewed
- Include personal-account AI usage that falls outside the enterprise identity provider entirely
- Document the purpose, data sensitivity, and autonomy level of each AI system
- Assign a named business and technical owner to every AI system in the inventory
- Flag AI systems with no assigned owner for immediate remediation before the gap assessment proceeds
Gap assessment:
- Run a structured gap assessment against ISO 42001 Annex A controls: current state versus required state for each control
- Document which controls have no evidence, partial evidence, or full evidence today
- Prioritize gaps by risk level: high-risk AI systems with no governance controls take precedence
- Confirm the inventory is complete before beginning Phase 3. An incomplete inventory makes every downstream risk assessment wrong
Completion signal: A complete AI inventory exists. Every system has an owner. The Annex A gap assessment is documented with a priority order for remediation.
CloudEagle's AI governance module builds this inventory automatically by correlating SSO, browser, Zscaler, CrowdStrike, and finance signals simultaneously, surfacing the shadow AI and embedded AI features that a manual audit consistently misses.
Starting Phase 3 Without a Complete AI Inventory Is the Most Common Implementation Delay.
4. Phase 3 Checklist: Risk Assessment and Annex A Control Implementation
This phase is where most ISO 42001 implementation checklists stop being useful. Listing the Annex A controls is not enough. Each control requires a specific, named piece of technical evidence that demonstrates it is operating, not just documented.
Risk assessment:
- Assess risk for each inventoried AI system across three dimensions: data exposure risk, model behavior risk, and vendor security posture
- Assign a risk level to each AI system: high, medium, or low, based on the assessment criteria defined in Phase 1
- Build a risk treatment plan with a named owner and remediation deadline for each identified risk
- Document the risk acceptance decision for risks where treatment is not feasible within the certification timeline
Access governance controls:
- Implement least-privilege access for every AI system: provisioned based on role, not on request
- Extend access reviews to AI tools, same cadence and evidence requirements as SaaS access reviews
- Implement automated deprovisioning for AI tool access when employees leave or change roles
- Include AI agents and non-human identities in the access governance scope, not just human users
For access review implementation: 👉 User Access Reviews
Policy enforcement controls:
- Implement technical policy enforcement at the point of AI tool access, not just a written acceptable-use policy
- Deploy browser-layer controls that redirect employees to approved AI tools when they attempt to access unsanctioned ones
- Implement monitoring for sensitive data submitted to AI tools, PII, PHI, financial data, IP
- Generate AI vendor risk scores for every tool in the inventory, covering data residency, training data policies, and security certifications
Evidence mapping:
- Map each Annex A control to a specific, named piece of evidence it will produce
- Confirm evidence is generated continuously, not assembled manually before the audit
- Verify that access logs, policy intervention records, and risk assessment histories are available on demand
Completion signal: Every Annex A control has a named evidence source. Risk treatment plans are documented and owned. Technical controls are operating and producing logs.
CloudEagle's AI governance module maps directly to this phase: AI vendor risk scoring, browser-layer policy enforcement, access reviews, and continuous audit evidence generation are all published capabilities.
👉 AI Usage Control and Policy Enforcement
📖 Worth a Read 👉 AI Governance Auditing: A 2026 Playbook for Internal Audit Teams
5. Phase 4 Checklist: Internal Audit and Management Review
This phase validates that Phase 3's controls are actually working, not just documented. The internal audit is also the rehearsal for the certification audit. Every nonconformity found here is a nonconformity the certification body will not find.
Internal audit:
- Conduct a full internal audit of the AIMS against every Annex A control, not a sample
- Assign a named internal auditor who is independent of the functions being audited
- Document every nonconformity found with a corrective action owner and a specific closure deadline
- Verify that evidence for each control is sufficient for an external auditor to rely on, not just internally legible
- Confirm that the AI inventory used in the audit reflects the current state, not the Phase 2 snapshot
Corrective action closure:
- Track corrective action closure against documented deadlines
- Re-audit any control where the corrective action changed the underlying process, not just the documentation
- Confirm no open nonconformities remain before scheduling the Stage 1 external audit
Management review:
- Present audit results, current risk posture, and Annex A control effectiveness to top management
- Document management review outcomes, including decisions made and resources committed
- Update the risk treatment plan and AI policy based on management review outcomes
- Confirm top management sign-off on the updated AIMS before proceeding to the external audit
Completion signal: Internal audit complete. All nonconformities closed or formally accepted with documented rationale. Management review conducted and documented. The certification body has confirmed Stage 1 can proceed.
6. Phase 5 Checklist: ISO 42001 Certification Audit Steps and Ongoing Surveillance
These are the ISO 42001 certification steps that follow from a completed Phase 4. The external audit itself is not where the work happens. The work happens in phases one through four.
Stage 1 audit: documentation review:
- Submit the AIMS documentation package to the certification body for Stage 1 review
- Confirm the scope document, AI policy, risk treatment plan, and Annex A evidence map are current and complete
- Address every gap the Stage 1 auditor identifies before scheduling Stage 2
- Document Stage 1 findings and the corrective actions taken in response
Stage 2 audit: full implementation review:
- Make all evidence available to the Stage 2 auditor on demand, including access logs, policy intervention records, risk assessments, and management review documentation
- Be prepared to demonstrate that controls are operating in real time, not just documented
- Address any minor nonconformities identified during Stage 2 within the agreed timeline
- Confirm that no major nonconformities remain open at the time of the certification decision
Post-certification:
- Receive certification and communicate the certificate scope internally and to customers who have requested evidence of AI governance
- Schedule annual surveillance audits and recurring internal audit cycles to maintain certification
- Update the AI inventory and risk treatment plan whenever a new AI system is added, modified, or retired
- Monitor for changes to Annex A control requirements as the standard evolves
Completion signal: Certificate issued. Surveillance audit schedule confirmed. Internal review cadence documented and owned.
Get Started
This ISO 42001 implementation checklist covers the five phases from foundation through certification audit. The phase that determines whether everything runs on schedule is Phase 2: building an AI inventory that is actually complete before risk assessment begins.
CloudEagle's AI governance module produces the AI inventory, risk scoring, access governance evidence, and audit-ready logs that phases two, three, and four of this checklist call for, automatically and continuously rather than manually assembled before each audit.
Book a demo with CloudEagle.ai to see how far along your AI inventory already is before the certification project officially starts.
Frequently Asked Questions
1. How long do the ISO 42001 certification steps actually take?
Typically, six to eighteen months. The biggest factor is how mature your AI inventory and evidence-gathering processes are. Teams with established inventory, access controls, and continuous audit evidence can move faster, while the certification audit itself is rarely the main bottleneck.
2. Can we use our existing ISO 27001 program as a starting point?
Yes. The management-system structure overlaps significantly, including scope, leadership, planning, support, evaluation, and improvement. However, ISO 42001's AI-specific Annex A controls, including AI inventory, risk assessment, lifecycle management, and policy enforcement, still need to be addressed.
3. What is the most common reason implementations get delayed?
Starting the risk assessment before the AI inventory is complete. Missing AI tools, embedded SaaS features, personal accounts, or cloud deployments can force teams to repeat their risk assessments and delay the entire certification process.
4. What should an organization complete before starting its ISO 42001 risk assessment?
Build a complete AI inventory first. It should include approved and unapproved AI tools, embedded AI features, personal accounts, cloud deployments, and AI agents. A reliable inventory gives the risk assessment a complete scope to evaluate.
5. Does ISO 42001 require continuous AI monitoring?
ISO 42001 requires organizations to maintain, monitor, evaluate, and improve their AI management system. Continuous visibility into AI usage, access, risks, and control evidence can make those ongoing governance and audit requirements easier to demonstrate.
Starting Phase 3 Without a Complete AI Inventory Is the Most Common Implementation Delay.
.avif)
.avif)
.avif)
.png)
.png)
.avif)
.avif)
.avif)
