Most organisations that fail an ISO 42001 audit did not lack policies. They lacked evidence that those policies operate in production. This iso 42001 checklist walks through what the standard requires, from the mandatory clauses to the Annex A controls to the two audit stages, so you can find your gaps before an auditor does. It also shows how the standard connects to AI and data protection duties in Singapore and India.

ISO 42001 checklist:

ISO/IEC 42001:2023, published in December 2023, is the first international standard for an AI management system, known as an AIMS, and it can be certified by an accredited body. A readiness checklist covers the mandatory clauses 4 to 10, the 38 Annex A controls across 9 objectives that you select and justify in a Statement of Applicability, and a two stage certification audit. For Singapore and India, the evidence should also map to local duties: MAS AI risk management guidelines for financial institutions, PDPC guidance under the PDPA, and the DPDP Rules notified on 13 November 2025.

What is ISO/IEC 42001?

ISO 42001 specifies requirements for establishing, implementing, maintaining and continually improving an ai management system inside an organisation. ISO says it applies to any organisation that provides or uses AI systems, whatever its size or type. It certifies a management system, not an individual model. An auditor tests whether you govern AI consistently, not whether one algorithm is accurate.

Think of it as an ai security governance framework that an auditor can test. It follows the same high level structure as ISO 27001, so organisations already certified for information security can often reuse document control, audit and management review machinery. For comparisons with other approaches, see the ISO 42001 versus other frameworks and AI governance framework versus alternatives.

Measure Your AI Readiness with a Free Assessment

Why this matters now for enterprises in Singapore and India

Four developments make readiness a practical priority in 2026.

• A certifiable standard now exists, and customers are starting to ask for it. ISO/IEC 42001:2023 gives organisations an auditable structure for ai compliance. Customers and regulators are beginning to request evidence of AI governance.

• Singapore financial institutions now have dated expectations. MAS issued its final Guidelines on Artificial Intelligence Risk Management on 7 October 2026. They take effect on 7 October 2027, with lifecycle controls and capability expectations following by 7 October 2028. An AIMS can give a structure for producing that evidence, but certification does not by itself demonstrate compliance.

• Singapore regulators have also set expectations on personal data in AI. The PDPC's Advisory Guidelines on use of personal data in AI recommendation and decision systems, issued 1 March 2024, explain how the PDPA applies. They are advisory, not legally binding, and they do not address generative AI.

• India's data protection regime is now operating in phases. MeitY notified the DPDP Rules on 13 November 2025, and its data protection framework page hosts the Act and Rules. Some provisions apply from notification, more from 13 November 2026, and the main obligations after 18 months. A constitutional challenge to certain provisions is also before the Supreme Court.

See how this connects to risk practice in AI risk assessment framework and the wider direction in the future of AI governance.

The ISO 42001 readiness checklist: five phases

Work through the phases in order, since each one produces the inputs the next needs.

1. Scope the AIMS and run a gap assessment. Decide which AI systems, business units and locations the AIMS covers, then compare current practice against the clauses and controls. An iso 42001 gap assessment commonly shows that AI inventories and use case records are the weakest area, and vendor supplied AI is often missing.

2. Build the AIMS documents and processes. Clauses 4 to 10 call for items such as an AI policy, defined roles, objectives, an AI risk assessment and AI system impact assessments. Risk treatment decisions here drive your control selection. ISO points to ISO/IEC 23894 for AI risk guidance, and AI risk management as a model covers the logic in depth.

3. Select and implement the Annex A controls. The Annex A controls number 38 across nine objectives, A.2 to A.10: AI policy, internal organisation, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third party relationships. You do not implement all 38 by default. You select those your risk work justifies, record them in the Statement of Applicability, and justify every exclusion. AI security compliance services support building the technical controls and evidence behind this step.

4. Run an internal audit and a management review. An internal audit tests the AIMS before an external auditor does. Management review confirms that leadership is engaged, not just signing documents.

5. Pass the certification audit. An accredited certification body runs Stage 1, a documentation and readiness review, then Stage 2, which tests whether the AIMS operates as designed. The certificate lasts three years, with surveillance audits in between. Samta.ai's Veda platform and the Veda AI decision analytics product can help keep model, monitoring and decision data traceable across connected systems, acting as the engineering execution layer on a client's existing Databricks, Snowflake or Microsoft stack.

A note on timelines. Practitioner guides commonly report four to nine months from start to certificate, shorter if an ISO 27001 system already exists. These are industry reported ranges, not ISO figures, and your own timeline depends on scope and starting maturity.

Comparing five AI governance frameworks

Framework	Certifiable	Scope	Status	Best fit
ISO/IEC 42001	Yes, by an accredited certification body	Organisation wide AI management system	Voluntary international standard	Enterprises needing auditable proof of AI governance
NIST AI Risk Management Framework	No	Risk management across govern, map, measure and manage	Voluntary guidance	Organisations wanting a risk method without certification
ISO/IEC 27001	Yes	Information security management	Voluntary international standard	Security baseline, often reused as the foundation for an AIMS
MAS Guidelines on AI Risk Management	No	Singapore financial institutions, all forms of AI	Final, effective 7 October 2027, phased to 2028	MAS regulated firms planning their implementation
PDPA and DPDP data protection law	No	Personal data handling in AI systems	Binding law, with PDPC AI guidance advisory	Any organisation processing personal data in AI

Only the first row produces a certificate for AI governance itself. For a platform level view of how connected data supports continuous evidence, see Veda versus a general Data Intelligence Platform.

Discover Where Your AI Models Are Most Exposed

Real world use cases

Regulated bank: strong policy, thin operating evidence (illustrative scenario)

A bank has a well written AI policy and a complete Statement of Applicability, so Stage 1 looks comfortable. In an internal audit, the team cannot produce monitoring records showing the policy operating on a live credit model. Building automated drift logs and review records before the external audit closes the gap, because Stage 2 asks what actually happened in production. See documented examples in Samta.ai's case studies.

General enterprise: reusing an ISO 27001 system (illustrative scenario)

A manufacturer with ISO 27001 certification extends its document control, internal audit and management review processes to cover AI. The AIMS needs new content, such as AI impact assessments, but not new machinery. The real effort goes into the AI inventory, since nobody has a complete list of models in use. This is the engineering discipline described in enterprise AI engineering in Singapore.

Key risks and failure modes

• Writing policies without producing operating evidence. Stage 1 can pass on documents, but Stage 2 tests whether the controls operate in practice.

• Treating all 38 Annex A controls as mandatory. The standard expects selection based on risk, with justified exclusions.

• Citing the wrong control count. Some sources cite 70 controls. The correct figure is 38 across 9 objectives.

• An incomplete AI inventory. Missing or inconsistent use case records are a common first finding, and vendor supplied AI is often forgotten.

• Choosing a certification body not accredited for ISO 42001. Such a certificate carries little weight with customers or regulators.

• Ignoring local duties. Certification does not by itself show compliance with DPDP / PDPA obligations or, for financial institutions, MAS guidelines.

Who needs an AI management system, and when to start

Start a full AIMS programme if:

• Customers or regulators are asking for evidence of AI governance

• You run AI in regulated decisions such as credit, insurance or hiring

• You supply AI to other organisations that will ask about your controls

• You already hold ISO 27001 and can reuse its management system machinery

A lighter approach may work if:

• You use only a few low risk, internal AI tools

• No customer or regulator is asking for certification yet

• A risk assessment and a clear AI inventory are the better first step

Let’s Discuss Your AI Strategy

Conclusion

An AI policy on paper does not pass an audit. A management system that produces evidence from real operations does. Work through the five phases, select your Annex A controls with care, and map the result to your local regulatory duties. The next step is finding out honestly where your gaps are today.

About Samta

Samta.ai is a Singapore-headquartered AI Product Engineering & Data Intelligence partner helping enterprises build production-grade AI systems for regulated and data-intensive environments.We help organizations move beyond experimentation by engineering scalable, explainable, and enterprise-ready AI solutions from data foundations and model development to workflow automation and deployment.

Our capabilities combine deep AI expertise, data engineering, and product engineering to deliver measurable business impact across FinTech, BFSI, cybersecurity, regulatory technology, and enterprise operations.

Our enterprise AI products power real-world intelligence systems:

• TATVA : AI-driven data intelligence platform for governed analytics, monitoring, and operational insights

• VEDA : Explainable and audit-ready AI decisioning engine built for compliance-sensitive enterprise workflows

• CORA-Property Management Solutions: : Predictive intelligence platform for real-estate pricing, portfolio optimization, and investment analytics

Backed by ecosystem partnerships with Microsoft, Databricks, Snowflake, and AWS, Samta.ai delivers agile, cost-efficient AI engineering with faster turnaround and enterprise-grade scalability. Trusted by enterprises across FinTech, BFSI, and digital transformation initiatives, Samta.ai embeds AI governance, data privacy, and compliance-by-design principles directly into the AI lifecycle , enabling organizations to scale AI with transparency, accountability, and operational control. 

Enterprises leveraging Samta.ai automate 65%+ of repetitive data, analytics, and decision workflows while maintaining governance, explainability, and measurable business outcomes. Samta.ai provides the strategic consulting, AI engineering, and data modernization expertise needed to align enterprise operations with next-generation AI transformation goals.

Frequently asked questions

1. What is ISO/IEC 42001?

   ISO/IEC 42001:2023 is the first international standard for an AI management system, published in December 2023. It sets requirements for establishing, running and improving AI governance in an organisation, using the Plan Do Check Act method, and it can be certified by an accredited body. It certifies the management system as a whole, not the accuracy of any single model.

2. How do you prepare for ISO 42001 certification?

   Scope the AIMS, run a gap assessment, build the required documents and processes, implement the Annex A controls your risk assessment justifies, then complete an internal audit and management review. Finally, pass a two stage audit by an accredited certification body. Evidence from real operations matters more than polished documents, because Stage 2 tests how the controls work in practice.

3. Who needs an AI management system?

   Any organisation that develops, supplies or relies on AI in ways that affect customers, regulated decisions or other businesses can benefit, and the need grows when customers or regulators ask for proof of governance. ISO describes the standard as applicable to any organisation regardless of size or type. Providers of AI to other businesses often face the earliest demand.

4. ISO 42001 readiness checklist for an Indian enterprise

   Use the five phases above, then add an India layer. Map AIMS evidence to the DPDP Act and the DPDP Rules notified on 13 November 2025. The rules apply in phases, with some provisions in force from notification, more from 13 November 2026 and the main obligations after 18 months, so confirm which duties currently bind each AI system handling personal data.

5. ISO 42001 consultants in Singapore

   There is no single verified ranking of ISO 42001 consultants in Singapore. Evaluate candidates on whether they cover gap assessment, control implementation and audit support, and whether they understand PDPA expectations and, for financial institutions, the MAS AI risk management guidelines. Ask for specific evidence of audit outcomes, not only credentials.