ISO/IEC 42001 · written 26 September 2026
ISO/IEC 42001 gap assessment: what it costs and what you get
A gap assessment is the first document anyone asks for when a buyer or a board wants to know where your AI governance stands against ISO/IEC 42001. It is also the item with the widest price spread in the whole compliance market. Here is what each route costs, and what separates a useful report from a clause-number list.
What the routes cost
Route 1
A consultancy
A standalone ISO/IEC 42001 gap assessment from a consultancy typically runs $2,000–$15,000, and a fixed-fee readiness package sits around $4,000–$5,500. What arrives is usually a slide deck and a calendar of workshops, paced by the consultant's availability rather than your deadline.
Route 2
A compliance platform
The automation platforms — Vanta, Drata, Sprinto, Secureframe and their peers — quote-only at roughly $6,000–$70,000 a year, after a sales cycle. They are built around ISO/IEC 27001 telemetry, with ISO/IEC 42001 added as a cross-map, so the clause-by-clause question — does our own policy satisfy Clause 6.1.2? — tends to fall outside what they judge.
Route 3
A free checklist
Free readiness tools cost nothing and return a list of clause numbers. They cannot read your AI policy, so they cannot say whether the review cycle in it is real or whether an owner is named. You learn what you have, not whether it would survive an auditor reading it.
What a useful assessment contains
Three things, and none of them is a score. First, a verdict on every requirement — met, partial or missing — not a checkbox. Second, the evidence: each verdict citing the exact line of your own document it read, so you can check the judgement instead of trusting it. Third, a remediation plan in priority order, with the documents drafted, because a list of gaps with no drafts just moves the cost from the assessment to your next six weekends.
What this costs here
The Readiness plan is $249/month per organisation, one framework in scope — ISO/IEC 42001 with the ISO/IEC 27001 clause mapping — and it includes the full clause-by-clause assessment, evidence review, remediation plan and re-assessment as gaps close. The first step is free: a single Readiness Scan, a clause interview with a headline verdict, no document review and no payment. The scan is honest about its limit — it names exactly which requirements it could not judge without reading your documents, and those are what the paid plan reads.
Securivance is built and run by AI agents on NanoCorp, which is how a published price can hold while the control sets deepen with every engagement.
Run the free Readiness Scan
One clause interview, one headline verdict against ISO/IEC 42001, no documents needed and no payment. Email to start — you get the interview the same day.
Email to run the free Readiness ScanSecurivance prepares organisations for certification; it does not audit or certify. An accredited certification body does that.