Incube ← AI Governance
AI Governance · Product

The ISO/IEC 42001 Readiness Pack

The complete document set for an AI management system. Twenty-seven documents written to Clauses 4 to 10 and all 38 Annex A controls of ISO/IEC 42001, with filled specimens drawn from a worked insurance case, so you can see what a completed record looks like before you write your own.

27 documents 38 controls · one Statement of Applicability Filled specimens included Free: the 40-question readiness assessment ↓
Why this exists

The question your customers now ask

Enterprise procurement teams have started asking their AI suppliers a direct question: how is your AI governed, and can you evidence it? ISO/IEC 42001, published by ISO and IEC in December 2023, is becoming the recognised way to answer. It is a serious standard, and the certification bodies auditing against it are booked months ahead.

What most organisations need first is the document layer: the scope statement, the AI policy, the risk register, the Statement of Applicability, the impact assessments, the audit and review records. Building that from a blank page takes a consulting engagement. This pack gives you the full set, professionally written, mapped clause by clause, ready to adopt and adapt.

Every Annex A control family carries a document

The Statement of Applicability at the centre of the pack addresses all 38 controls. Each family below is served by named documents in the set.

A.2
Policies for AI
3 controls
A.3
Internal organisation
2 controls
A.4
Resources for AI systems
5 controls
A.5
Impact assessment
4 controls
A.6
AI system life cycle
9 controls
A.7
Data for AI systems
5 controls
A.8
Information for interested parties
4 controls
A.9
Use of AI systems
3 controls
A.10
Third parties and customers
3 controls
38 / 38 controls addressed in the Statement of Applicability
What’s inside

Three parts, one management system

The spine

10 documents · Clauses 4 to 10
  • AIMS scope statement and manual
  • Signable AI Policy
  • Roles and responsibilities with RACI
  • Risk methodology, register and treatment plan
  • Statement of Applicability, all 38 controls
  • AI objectives register

The controls

17 documents · Annex A
  • AI system impact assessment procedure
  • Competence and AI literacy record
  • Lifecycle procedure and event log specification
  • Data management procedure
  • Internal audit programme and management review pack
  • Supplier and customer responsibility matrix

The specimens

Filled examples · worked insurance case
  • A completed risk register
  • A completed Statement of Applicability
  • A completed impact assessment
  • A completed internal audit report
  • A completed supplier matrix
  • Five AI systems, each owned by a named role
The specimen difference

Templates tell you the shape. Specimens show you the answer.

Every document in the pack arrives twice: once as a template with guidance notes, and once completed for Meridian Mutual, a fictional mid-sized insurer running five AI systems, from a claims triage assistant to a recruitment screener. Each system has an accountable owner, a risk profile and a paper trail. When your team sits down to write, they are copying a worked answer into their own context rather than interpreting a heading.

The same case runs through the Governance Operating System book series and the AI Delivery Gate Pack, so the reasoning behind every completed record is available in long form if you want it. If you already run ISO/IEC 27001, the fit is closer still: 42001 follows the same Annex SL structure, and this pack is written to extend an existing management system rather than duplicate one.

Free instrument

How ready are you? Score yourself now.

The full forty-question readiness assessment from the pack, free and scored on this page. Answer honestly: No scores nothing, Partial scores one, Yes scores two. It takes about ten minutes, and every gap it finds points at the document in this pack that closes it. Nothing you enter is sent anywhere unless you choose to email yourself the result. This is a self-assessment, not an audit and not a conformity assessment.

Licence tiers

Three ways to buy

Core

£495
One organisation · plus VAT where applicable
  • All 27 template documents
  • Clause-by-clause mapping to ISO/IEC 42001
  • Statement of Applicability covering all 38 controls
  • Guidance notes in every document
Buy Core
Most chosen

Professional

£1,295
One organisation · plus VAT where applicable
  • Everything in Core
  • The interactive Readiness Toolkit, a single file that opens in your browser: an intake wizard generating your pack pre-filled, a Statement of Applicability builder, and an operating dashboard for registers, authorisations and renewal dates
  • The AI Defensibility Index readiness self-assessment, scored on screen with a downloadable report
  • The full set of filled Meridian specimens
  • Priority email support for sixty days
Buy Professional

Assured

£4,950
One organisation · plus VAT where applicable
  • Everything in Professional
  • A personally delivered gap review of your completed documents
  • Written findings note with prioritised fixes
  • One remote working session with your team
Enquire about Assured
Straight answers

What this pack is, and what it is not

What is the Readiness Toolkit?
A single HTML file included with the Professional and Assured tiers, delivered with your pack. It opens in any modern browser and runs entirely on your machine: the intake wizard writes your organisation, roles, appetite and applicability decisions into all 27 documents and generates your pack as Word files, the readiness assessment scores on screen, and the operating view tracks authorisations, audit dates and reviews. Nothing you enter ever leaves the file, and your work saves as a workspace file you keep.
Does this make us ISO/IEC 42001 certified?
No. Certification is issued by an accredited certification body after audit. This pack gives you the documented management system those audits examine, which is the largest part of the preparation work.
Do we still need to buy the standard itself?
Yes. The pack references clause and control numbers and reproduces none of the standard’s text. You will need a licensed copy of ISO/IEC 42001:2023 from ISO or your national standards body, and we recommend reading it alongside the pack.
How does this relate to the EU AI Act?
They are complementary. The Act’s high-risk obligations now apply from December 2027 for standalone systems, while its AI literacy duty is already in force; the pack’s competence record is written to serve both. A well-run AI management system also produces most of the evidence the Act’s technical documentation expects.
How is it delivered?
Personally, by email, within two working days of purchase. Your documents are prepared and sent by Incube directly, and the files live only with us and with you.
What if we want the implementation done for us?
That is an advisory engagement rather than a product. Write to us with a short description of your systems and timeline and we will propose a scope.