From Gap Analysis to Certificate: Using Software to Run Your ISO 42001 Project

One Connected Project, Not Five Disconnected Efforts

Step 1: Gap Analysis Becomes the Backlog

The gap analysis shouldn't be a static report you read once — its output should become the actual project backlog, with each gap assigned an owner and a deadline directly, rather than requiring someone to manually transcribe findings into a separate task tracker.

Step 2: Closing Gaps With Reviewed Drafts

Step 3: Operating With Evidence Mapped as You Go

During the operating period, each piece of evidence — a completed training session, an internal audit finding, a management review — should be tagged to the specific clauses and controls it satisfies at the moment it's created, not reconstructed later when someone tries to remember what happened months ago.

Step 4: Internal Audit Using the Same Structure

The internal audit should check against the same clause and control structure used throughout the project, with findings recorded directly against the relevant control — creating a closed loop instead of a separate audit report disconnected from the rest of the record.

Step 5: The Certificate Export

1. Confirm every clause has current, complete evidence
2. Confirm the Statement of Applicability matches your actual registered AI systems
3. Generate the full audit package for the certification body
4. Schedule Stage 1 once the package is internally reviewed

Primary Sources

• ISO — ISO/IEC 42001:2023
• NIST — AI Risk Management Framework

When the Scope Changes Mid-Project

New AI systems get built during a certification project — that's normal, not a sign of poor planning. When one is added, it should flow through the same gap-analysis-to-evidence pipeline as everything registered before it, rather than being handled as an exception. Projects that treat scope changes as one-off additions tend to end up with an inconsistent Statement of Applicability by the time Stage 1 arrives.

Keeping Momentum During the Operating Period

• Put the internal audit and management review dates on the calendar at the start of the project, not once documentation is 'done'
• Review the backlog from the gap analysis monthly, not just at kickoff
• Treat any newly discovered gap the same way as an original one — assign an owner and a deadline immediately

Who Should Actually Run This Project

A single accountable owner — usually a compliance lead — should run the project end to end, even if specific tasks are delegated across engineering, legal and HR. Splitting ownership across multiple people without one clearly accountable lead is one of the most common reasons a certification project stalls partway through the operating period, once the initial kickoff energy fades and nobody is left explicitly responsible for keeping it moving.

Where Unorma Fits