ISO/IEC 42001:2023 Annex A defines 38 controls across nine control objectives. Like ISO 27001, the organization selects the controls that apply through a Statement of Applicability. This checker asks plain-language questions grouped by objective — plus a separate group on AI risk assessment and treatment, which the standard places in clauses 6.1, 8.2 and 8.3 — and reports a coverage percentage, not a pass/fail verdict.
| Ref | Objective | Controls | Questions |
|---|---|---|---|
| A.2 | Policies related to AI | 3 | 3 |
| A.3 | Internal organization | 2 | 4 |
| A.4 | Resources for AI systems | 5 | 3 |
| A.5 | Assessing impacts of AI systems | 4 | 3 |
| A.6 | AI system life cycle | 9 | 7 |
| A.7 | Data for AI systems | 5 | 4 |
| A.8 | Information for interested parties of AI systems | 4 | 6 |
| A.9 | Use of AI systems | 3 | 4 |
| A.10 | Third-party and customer relationships | 3 | 3 |
| 6.1 · 8.2 · 8.3 | AI risk assessment and treatment (clauses)Clause requirements, not an Annex A objective | — | 3 |
Full context on each objective and what evidence an auditor expects: The ISO 42001 Annex A controls, in plain language →
No. This is a self-reported coverage indicator, not a certification determination. ISO 42001 certification requires an accredited external auditor to review your Statement of Applicability and test whether your selected controls are implemented and evidenced. Annex A is normative, but it is not a checklist every organization implements in full: clause 6.1.3 requires you to determine which controls are necessary, compare them against Annex A, and justify inclusions and exclusions in your Statement of Applicability.
They follow ISO/IEC 42001:2023 Annex A — nine control objectives (A.2 to A.10) and 38 controls — the same table published at /blog/iso-42001-annex-a-controls. The questions are plain-language prompts grouped by objective, not the standard's control text, so the number of questions per objective differs from its control count. 3 further questions cover AI risk assessment and treatment, which the standard sets out in clauses 6.1, 8.2 and 8.3 rather than in Annex A; they are scored as a separate group.
Each group's score is the percentage of its questions answered "yes." The overall score is the percentage of all 40 questions answered "yes" across every group. There is no weighting between groups — a gap in A.6 (AI system life cycle, 7 questions) affects the overall score more than a gap in A.2 (Policies related to AI, 3 questions), simply because it has more questions.
No. Everything runs in your browser — there's no server, no account, and no database. The "copy results" button copies your scorecard as plain text; the URL itself encodes your answers so a saved or shared link reproduces your exact result without Drel ever seeing it.
This tool is published by Drel and runs entirely in your browser — no data is sent to Drel or anyone else. It is a self-assessment coverage indicator, not a certification determination; ISO 42001 conformance is decided by an accredited auditor against your organization's own Statement of Applicability.