ASE Cloud Services Chatbot Interface
ISO/IEC 42001 GAP Assessment: your AI readiness and AI Act compliance assessment
Find out within 4 to 6 weeks where you stand and what steps you need to take to ensure you’re compliant with the AI Act.
ASE’s ISO/IEC 42001 GAP Assessment evaluates how AI-ready your organisation is and how well you comply with the EU AI Act. You will receive a report showing where you stand today and what specific steps you need to take, ready for your auditor.
What is an ISO/IEC 42001 GAP Assessment?
A GAP Assessment is a guided review of 4 to 6 weeks in which ASE compares your organisation’s AI governance with ISO/IEC 42001:2023 and the EU AI Act. Afterwards you know which measures are missing and in what order to tackle them. ASE is itself certified to ISO/IEC 42001:2023 (certificate number NL260412, valid until 28 April 2029), as well as to ISO/IEC 27001, ISO/IEC 27701 and ISO 9001.
One day, the question will come. From an auditor, a major customer, the board of directors, or a regulator. Not “Do you use AI?” but “Show us that you have it under control.” The transparency rules of the EU AI Act have applied since 2 August 2026, and the requirements for high-risk systems follow on 2 December 2027. The ISO/IEC 42001 GAP Assessment shows you where you stand today and which concrete steps you need to take, in a report designed to stand up to auditor scrutiny.
No lengthy theoretical report that disappears into a drawer. You receive a concrete gap analysis, an overview of the key AI risks facing your organisation, and a prioritized roadmap. Prepared by professionals who are themselves ISO/IEC 42001 certified.
You may think: our legal counsel or privacy officer will keep track of this. But the AI Act requires more than a legal perspective: it covers the entire AI lifecycle, from data quality to human oversight.
With the ISO/IEC 42001 GAP Assessment, we systematically assess how AI is used, controlled, and governed within an organisation. We look not only at policies and IT setup, but explicitly at day-to-day practice as well. Based on interviews, document analysis, and a review of existing measures, we assess your current situation against the requirements of an AI Management System. This includes governance, risk management, data quality, transparency, awareness, and human oversight throughout the entire AI lifecycle.
The outcome is a practical report providing insight into your current maturity against ISO/IEC 42001, a concrete gap analysis, the key AI risks, and a roadmap with recommendations for closing the gaps. This enables your organisation to work purposefully toward responsible, controlled, and compliant AI use, including in relation to relevant laws and regulations such as the EU AI Act. The GAP Assessment also serves as an AI Act readiness assessment, so you know well before the high-risk deadline of 2 December 2027 which risk categories your AI systems fall into.
What applies when? The AI Act timeline
The AI Act is being phased in. The Digital Omnibus on AI, in force since 27 July 2026, moved the dates for high-risk systems and softened the AI literacy duty. This is the position as of October 2026:
| Since or from | What applies | What the GAP Assessment does with it |
|---|---|---|
| 2 February 2025 | Prohibited AI practices (Article 5) and AI literacy (Article 4). Since July 2026: taking measures to support AI literacy. | We check whether any application falls into a prohibited category and which AI literacy measures you have. |
| 2 August 2025 | Rules for general-purpose AI models | Relevant if you provide a model yourself. Usually you are a user and this does not apply directly. |
| 2 August 2026 | Transparency obligations (Article 50), for example a chatbot telling people it is AI | We check each application for this notice. |
| 2 December 2026 | Marking of AI-generated content for systems placed on the market before 2 August 2026 | We include it as a dated action in the roadmap. |
| 2 December 2027 | Requirements for high-risk systems in Annex III, such as AI in recruitment, education or access to public services | We classify your AI systems so you know well in advance which ones are covered. |
| 2 August 2028 | Requirements for high-risk AI in products (Annex I) | Only relevant if AI is part of a regulated product. |
Source: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 (Digital Omnibus on AI); White & Case, “EU AI Omnibus enters into force, amending the AI Act” (2026).
How do we run an ISO 42001 gap analysis?
A gap analysis against ISO/IEC 42001 follows six steps. Allow 4 to 6 weeks and 40 to 60 hours of work on our side.
- Scope and intake (week 1). We agree which AI applications, departments and suppliers are in scope, and who your contacts are.
- AI inventory and risk classification (weeks 1 to 2). We map the AI systems you use or provide, your role (provider or deployer) and the AI Act risk category of each system.
- Document review (week 2). We read your policies, record of processing activities, DPIAs, contracts with AI suppliers and, if you have it, your ISO/IEC 27001 documentation.
- Interviews (weeks 2 to 3). We talk to four to eight key people, from the board to the staff who use AI every day, so we test practice and not just paperwork.
- Assessment per requirement (weeks 3 to 4). We score every requirement in clauses 4 to 10 of ISO/IEC 42001 and the controls in Annex A.
- Report, roadmap and presentation (weeks 4 to 6). You receive the gap analysis and the prioritised roadmap, and we present the findings to your executive team or board.
What do you receive?
| Deliverable | For whom | Purpose |
|---|---|---|
| Maturity score per domain, measured against ISO/IEC 42001 | Board, CISO | Knowing where you stand |
| Gap analysis per requirement and control | Compliance officer, internal or external auditor | Knowing what is missing |
| AI inventory with risk classification under the AI Act | Privacy officer, data protection officer | Knowing which obligations apply to each system |
| Overview of the key AI risks | Risk manager | Setting priorities |
| Roadmap with priorities and quick wins | Project lead | Starting with what delivers most |
| Management presentation | Executive team or board | Taking decisions and releasing budget |
What does a GAP Assessment cost?
A full GAP Assessment takes 40 to 60 hours of work on our side. At our public rate of €175 per hour, that is €7,000 to €10,500 excluding VAT. After the intake you receive a fixed price, so you know in advance where you stand.
After the GAP Assessment you can carry out the roadmap yourself or have us guide you through our AI Consulting Services, at a public rate of €175 per consultant per hour, with no subscription. If your staff need to learn to work responsibly with AI, the AI Adoption Programme follows directly from the roadmap.
You can see what such a roadmap looks like in practice in our own applications: the IRIS AI Chatbot tells people it is AI from the very first message (Article 50), and the AI Workspace Assistant works with role-based access on your own documents, within the EU.
Do you know how AI is being used, controlled, and governed within your organisation?
With the ISO/IEC 42001 GAP Assessment, you gain the insights and roadmap needed to deploy AI responsibly, in a controlled manner, and in compliance with relevant requirements.
DOWNLOAD OUR ONE-PAGER FOR THE GAP ASSESSMENT HERE
With our GAP Assessment, you gain a clear understanding of where your organisation stands in terms of AI and receive a concrete roadmap toward responsible, controlled, and compliant AI use.
Get in TouchIn short
The problem: The AI Act sets concrete requirements and you do not know exactly where your organisation stands.
The result: After the GAP Assessment you have a score per domain, the biggest gaps and a roadmap with priorities, measured against ISO/IEC 42001.
The first step: Start with the free AI Readiness Assessment, or book a call straight away.
Not sure yet where your organisation stands?
Take the free Sovereign AI Readiness Assessment. In 5 to 10 minutes you see your score across six domains and your three priorities, with a management report as a PDF in your inbox. Free, no account needed.
Prefer to go straight to the route for your organisation? See what this means for municipalities and government or SMEs and corporates.
Frequently Asked Questions
Why should I start a GAP Assessment now?
The EU AI Act has placed increasingly specific requirements on organisations that use or develop AI since 2 August 2026, and the obligations for high-risk systems follow on 2 December 2027 and 2 August 2028. A GAP Assessment helps you work systematically toward responsible and compliant AI use, before regulators or customers start asking for proof.
Is a gap analysis mandatory under the AI Act?
No. The AI Act does not prescribe a gap analysis. You do need to know which obligations apply to each AI system, such as the prohibited practices, the transparency duty or the high-risk requirements, and be able to demonstrate this. A gap analysis against ISO/IEC 42001 is a structured way to do that. For providers of high-risk systems, an AI management system also aligns with the requirements for risk management and quality management (Articles 9 and 17).
What is the ISO/IEC 42001 GAP Assessment?
A practical maturity assessment that evaluates your current AI readiness against the requirements of ISO/IEC 42001, including a risk assessment and a concrete roadmap toward compliant AI use.
What does a GAP Assessment deliver in concrete terms?
A practical report showing your current maturity against ISO/IEC 42001, a concrete gap analysis, the key AI risks facing your organisation, and a prioritized roadmap with recommendations.
How do you approach the assessment?
We assess your current practices against the requirements of an AI Management System through interviews with key stakeholders, document analysis, and a review of existing measures across the entire AI lifecycle.
What exactly do you assess?
This includes AI governance alignment, risk management, data quality, transparency, awareness, and human oversight.
Do we need to be ISO/IEC 42001 certified already to get started?
No. It is specifically a maturity assessment designed to show where you stand today and which steps are needed next. You don’t need to have anything in place yet to get started.
How does ISO 42001 differ from ISO 27001?
ISO/IEC 27001 is about information security: the confidentiality, integrity and availability of information. ISO/IEC 42001 is about developing and using AI responsibly: the risks and impact of AI systems, data quality, transparency and human oversight. Both standards share the same high-level structure (clauses 4 to 10), so if you already have an ISMS you can reuse a lot of it. ASE is certified to both.
Who conducts the assessment?
We conduct the assessment ourselves with our own specialists, drawing on practical experience from our own AI platform, which is certified against four ISO standards. You don’t receive a theoretical report, but a practical blueprint you can apply directly.
Do you also provide support after the GAP Assessment?
Yes. The assessment results in a concrete roadmap. We can support you with prioritization and implementation, or provide you with the documentation so you can take the next steps internally or with another provider.
How much time will this take internally?
A full assessment typically takes 40 to 60 hours, depending on your organisation’s size and complexity. We handle most of the work: from your team, we mainly need time for the interviews and for providing existing documentation. This keeps the workload for your team to a minimum.
About the Author
Alain van Zwol
Founder of ASE Cloud Services
Alain van Zwol is the founder of ASE Cloud Services and works daily on European, GDPR-compliant cloud and AI solutions. Through ASE, he supports organisations in transitioning to a sovereign workplace without dependence on American tech giants. Learn more about Alain and the team on the About Us page.
Sebastiaan Hoogeveen
Co-founder of ASE Cloud Services
Sebastiaan Hoogeveen is co-founder of ASE Cloud Services and combines his background as a mechanical engineer with a specialisation in AI engineering. His experience with C++ during his studies provides a strong technical foundation for his work as an AI engineer. Calm, punctual and composed, he likes to keep an overview, and as a team player and connector, he translates complex technology into practical AI solutions. Learn more about Sebastiaan and the team on the About Us page.