How to use this workbook
Ten worksheets that take an organisation from “we use AI” to a documented, auditable start on an ISO/IEC 42001:2023 AI management system. Everything you type stays in this browser.
Using the workbook
- Pick a worksheet from the list on the left. They run in the order a project usually needs them, but you can fill them in any order. The percentage next to each one shows how much you’ve completed.
- Fill in the form. Type straight into fields and table cells. Use Add row under a table when you need more lines. Scores, risk levels and audit counts are calculated for you.
- Check the examples. Each section has an Example line showing the kind of entry an auditor expects. Use Show all examples in the toolbar to open them all at once.
- Your work saves itself in this browser as you type. Clearing your browser data deletes it, so export regularly.
- Export XML saves the worksheet as a file you can back up, share or version-control. Import XML loads one back, on this or another computer.
- Save as PDF downloads a clean, paper-ready PDF of the worksheet, ready for your audit evidence pack.
Nothing is sent to a server. The workbook is a static page, and your entries never leave your device unless you export them.
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the first international standard for an AI management system (AIMS). It sets out how an organisation that develops, provides or uses AI should govern it: the policies, roles, risk and impact processes, controls and records that show AI is managed responsibly. It follows the same clause structure as ISO 27001 and ISO 9001 (Clauses 4 to 10), adds 38 AI-specific controls in Annex A, and can be independently certified.
What the standard touches on
- AI governance and leadership
- Transparency around who’s accountable and how risk is monitored in your organisation.
- Risk and impact assessments
- Not only technical risks, but social and ethical ones too.
- Data management
- Clarity on the data being fed to your AI systems, and whether it’s clean and fair.
- Transparency and explainability
- Ideally, even non-technical people should understand your outputs.
- Human oversight
- Humans should still be in the loop where it matters.
What the worksheets help you achieve
Together they produce the core documented information a certification body asks for at Stage 1. Each one feeds the next: context shapes scope and risks, risks drive the controls in the SoA, and the gap analysis, audit and readiness checklists prove the system works.
The full implementation, step by step
These worksheets cover the initiation. Here is the whole road to certification.
-
Step 1
Gap analysis
Measure where you stand against every clause and Annex A control. A typical gap analysis reviews AI risk management, impact assessments, data governance, human oversight, transparency and incident response.
-
Step 2
AIMS scope definition
Formally define which parts of your business the certification applies to.
-
Step 3
AIMS design
Build processes for:
- Governance, roles and responsibilities
- AI risk management and impact assessment
- Data handling policies (quality, sourcing, retention)
- Transparency and communication protocols
- Human oversight and escalation paths
- Monitoring and continual improvement
-
Step 4
Team role-based training
- Create a training calendar
- Develop role-based training modules
- Build a practical compliance playbook
-
Step 5
Implementation of operation
- Transition to live operations
- Begin running all relevant AI systems under your AIMS policies, so that development, deployment and monitoring follow your documented procedures.
- Track and log activity
- Keep detailed records of decisions, model updates, oversight points and system changes to build a transparent, auditable trail.
- Monitor outcomes in real time
- Observe model performance and outputs, flag anomalies or ethical concerns, and document any corrective actions taken.
- Document incidents and reviews
- For each issue or deviation, capture what happened, how it was addressed and what changed to prevent it happening again.
- Gather team feedback and lessons learned
- Talk to the people who use the system day to day and identify the pain points or gaps that need adjusting.
-
Step 6
Internal audit and management review
Audit the AIMS against every clause and the selected Annex A controls, then hold a management review of the results, nonconformities and improvement actions.
-
Step 7
Certification readiness
The certification audit runs in two stages:
- Stage 1
- Prepare for the document review.
- Stage 2
- Demonstrate the system in action.
-
Step 8
Continuous surveillance
After certification, surveillance audits check every year that the AIMS keeps working and improving, ahead of recertification in year three.
Your data
Entries are stored in this browser’s local storage, one record per worksheet. To start over, open a worksheet and use Clear, or erase everything here.
About this project
This is a personal project built for learning purposes. This web app was made using Claude Code. The texts in this webapp have been generated by a human through online research and some texts have been enhanced and reworked by Claude. Although it was made to replicate how an Auditor would tackle a project, it is not fully made for enterprise use. The user bares the responsibility if used in an enterprise environment.