如何通过5个步骤进行AI治理差距评估

An AI governance gap assessment compares how your organization builds, buys, and uses AI today with a reference framework, usually ISO/IEC 42001, and with the laws that apply to you, such as the EU AI Act. The result is a ranked list of missing policies, roles, controls, and evidence, and a roadmap to close them.

This guide is for founders, operations leaders, and the compliance, security, and data teams of companies that use AI in their products or daily work. It covers what to assess against, the five steps, the typical gaps, and how long the work takes.

What is an AI governance gap assessment?

It is a structured comparison between current practice and a target. The target is a set of requirements: the clauses of an AI management system standard, the controls you decide to apply, and the legal obligations that match your role and your AI use cases. For each requirement you record what exists, what evidence proves it, and what is missing.

A gap assessment is not an audit. Nobody issues a pass or a fail. Its job is to show where you stand and what to do first, so it works best when people describe the real state of things rather than the intended one.

What you get at the end

• An inventory of the AI systems in scope, with owners and risk notes
• A scored list of requirements, each with its evidence or the reason it is missing
• A prioritized list of gaps and a phased roadmap with owners and dates

Why run one now?

Three things make this a good moment to take stock.

• The EU AI Act applies in stages. The bans on prohibited practices and the duty to support the AI literacy of your staff (Article 4) have applied since February 2, 2025, and the obligations for general-purpose AI models since August 2, 2025. The transparency obligations of Article 50, such as telling people when they interact with an AI system, apply from August 2, 2026, with a grace period until December 2, 2026, for the machine-readable marking of content from generative systems already on the market. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the obligations for the high-risk uses listed in Annex III to December 2, 2027, and for AI in regulated products (Annex I) to August 2, 2028.
• Customers ask for evidence. Procurement and security questionnaires now often ask how suppliers govern AI, which data their AI tools use, and who checks the output.
• The standards are in place. ISO/IEC 42001 (2023) sets the requirements for an AI management system. ISO/IEC 42005 (2025) guides AI system impact assessments, and ISO/IEC 42006 (2025) sets the rules for the bodies that certify against ISO/IEC 42001. EN 18286, cited in the EU's Official Journal in October 2026, is the first harmonized standard under the AI Act and covers the quality management system that providers of high-risk AI systems need.

What do you assess against?

Most companies combine three references: the clauses of ISO/IEC 42001, its Annex A controls, and the legal obligations for their role.

ISO/IEC 42001 clauses 4 to 10

These are the management system requirements: context and scope (clause 4), leadership and the AI policy (5), planning, including AI risk assessment, risk treatment, and AI system impact assessment (6), support, including competence, awareness, and documented information (7), operation (8), performance evaluation, including internal audit and management review (9), and improvement (10). If you aim for certification, every one of these clauses applies.

ISO/IEC 42001 Annex A controls

Annex A lists 38 reference controls under nine objectives. You decide which ones apply and record each decision, with its reasons, in a Statement of Applicability.

• A.2 Policies related to AI (3 controls)
• A.3 Internal organization (2)
• A.4 Resources for AI systems (5)
• A.5 Assessing impacts of AI systems (4)
• A.6 AI system life cycle (9)
• A.7 Data for AI systems (5)
• A.8 Information for interested parties of AI systems (4)
• A.9 Use of AI systems (3)
• A.10 Third-party and customer relationships (3)

The legal obligations for your role

Under the EU AI Act, obligations depend on your role and on the risk of each use case. A provider develops an AI system or places it on the market under its own name; a deployer uses an AI system under its own authority. Most companies are deployers of tools such as chat assistants, writing tools, and AI features in their CRM, and some are also providers of AI features in their own products. Give each system in your inventory a role and a first risk class: prohibited, high-risk, subject to transparency obligations, or minimal risk.

The NIST AI Risk Management Framework, with its Govern, Map, Measure, and Manage functions, is a useful cross-check, especially if you also sell in the United States.

Step 1: Set the scope and inventory your AI systems

Decide which business units, products, sites, and AI systems are in scope. A narrow, well-defined scope is easier to assess and, later, to certify. Then build the inventory, because every later step depends on it.

What to record for each AI system

• Name, purpose, and business owner
• Your role: provider, deployer, or both
• Source: built in-house, bought, or an AI feature inside another tool
• Data used, especially personal or confidential data
• People affected and the decisions the output informs
• How much human review happens before the output is used
• A first view of the EU AI Act risk class

Look for shadow AI

Many AI systems are on no list: AI features switched on inside SaaS tools, browser extensions, and personal accounts on chat assistants. Ask each team what it uses, check expense reports and single sign-on logs, and read vendor release notes for new AI features.

Step 2: Map current practices to the requirements

Go through the requirements one by one. For each, write down what exists today and where the evidence is. Typical evidence includes:

• An AI policy approved by top management (clause 5.2)
• Defined roles and responsibilities for AI, including who approves a new use case (5.3 and A.3)
• An AI risk assessment method and its results (6.1.2)
• Risk treatment decisions and the Statement of Applicability (6.1.3)
• AI system impact assessments for the people and groups affected (6.1.4 and A.5)
• Training and awareness records, which also support AI literacy (7.2 and 7.3)
• Life cycle records for the systems you build: requirements, testing, release approval, and monitoring (A.6)
• Records of data quality, provenance, and preparation (A.7)
• Instructions and information for users and other interested parties (A.8)
• Contracts and due diligence for AI suppliers, including how they use your data (A.10)
• Internal audit reports, management review minutes, and corrective actions (9.2, 9.3, and 10.2)

Then add the legal checks for your role. For a deployer, that usually means AI literacy measures for staff, the transparency notices your use cases need, and, for any high-risk use case, the deployer duties of Article 26, such as human oversight by trained people and keeping the logs the system generates.

Step 3: Score maturity on evidence, not intentions

Rate each requirement on a simple scale and attach the evidence to the score:

• 0, not started: nothing exists.
• 1, ad hoc: it happens sometimes, depending on the person.
• 2, defined: it is documented but not applied consistently.
• 3, implemented: it is applied, and records prove it.
• 4, improving: it is measured, reviewed, and improved.

Be strict: a practice without records scores 1 at most, whatever people say about it. That keeps the assessment honest and shows exactly which evidence an auditor would ask for.

If you cannot show it, an auditor will assume it does not exist.

Step 4: Prioritize gaps by risk and effort

Not every gap matters equally. Give each one two ratings: the risk it leaves open, for the people affected by your AI systems and for the business, and the effort needed to close it. Then raise the priority of the gaps tied to a deadline or a demand you already know about:

• Legal dates, such as the Article 50 transparency obligations, which already apply, or December 2, 2027, for the high-risk uses listed in Annex III
• Customer requirements and security questionnaires
• A target date for certification

Close high-risk, low-effort gaps first, and respect dependencies: an owner and a policy come before procedures, and the inventory comes before risk and impact assessments.

Step 5: Build a phased roadmap

Turn the prioritized gaps into a roadmap with an owner, a deadline, and a definition of done for every item. A typical sequence looks like this.

First 30 days: foundations

• Name an accountable executive and a cross-functional working group.
• Approve an AI policy and a simple process to approve new AI use cases.
• Complete the inventory and the first risk classification.
• Start AI literacy training, and add AI notices where people interact with chatbots or AI-generated content.

Months 2 and 3: risk and controls

• Agree on a risk and impact assessment method, for example based on ISO/IEC 23894 and ISO/IEC 42005, and apply it to the highest-risk systems first.
• Write the Statement of Applicability.
• Update contracts and due diligence for AI suppliers.
• Set data, testing, and monitoring requirements for the systems you build.

Months 4 to 6 and beyond: run and prove

• Operate the controls and keep the records.
• Run an internal audit and a management review.
• Fix nonconformities and track the corrective actions.
• If you want certification, choose an accredited certification body. Certification follows a stage 1 and a stage 2 audit, then yearly surveillance audits.

Review the roadmap every quarter, and whenever a new AI use case, supplier, or law appears.

Typical gaps to look for

• An incomplete inventory. AI features inside existing tools and personal accounts are missing.
• A policy without owners. Principles exist, but nobody approves new use cases or checks that the rules are followed.
• Risk assessments that stop at security. The effects on customers, employees, and other people are not assessed.
• Supplier contracts that are silent on AI. They do not say whether your data trains the vendor's models, how model changes are announced, or how incidents are reported.
• Human oversight only on paper. Nobody records who reviewed an output and when.
• No monitoring after go-live. Accuracy, drift, and complaints are not tracked.

Does ISO/IEC 42001 certification mean you comply with the EU AI Act?

No. ISO/IEC 42001 is a voluntary international standard, and certification against it does not, on its own, give a presumption of conformity with the AI Act. That presumption comes from harmonized European standards cited in the Official Journal; the first, EN 18286, covers the quality management system that Article 17 requires from providers of high-risk AI systems.

The two still fit together. An AI management system built on ISO/IEC 42001 covers much of the groundwork the law expects: a policy, clear roles, risk and impact assessments, supplier controls, training, and records. Build it once and map it to each obligation, rather than running separate programs.

How long does it take, and who should be involved?

A first self-assessment takes about 15 minutes with a structured questionnaire such as our free ISO/IEC 42001 差距评估. A full assessment, with interviews and evidence review, usually takes a few weeks, depending on the scope and the number of AI systems you run.

Make one senior leader accountable, and involve legal and compliance, security, data and engineering, the business owner of each AI system, HR for training, and procurement for suppliers. Their time is the main cost, so prepare the inventory and the evidence requests before the interviews.

If you only do one thing this month, build the inventory. Every other step depends on knowing which AI systems you have, who owns them, and whom they affect. For the data protection side, see our guide to data privacy and cookie consent.