Work through a control assessment
Read what each control requires, record how you meet it, attach evidence and track honest readiness.
An assessment lists every control that applies to one system. Open a control to see what it requires and the matching EU AI Act, ISO/IEC 42001 and NIST AI RMF references.
Statuses
- Not started: nothing done yet. Note who owns it and when work will start.
- In progress: partly in place. Note what's missing.
- Implemented: in place and evidenced. You can only choose this once evidence is uploaded for the control.
- Not applicable: doesn't apply to this system. Say why. Not-applicable controls are left out of the readiness score.
- Waived (accepted risk): a known gap you've decided to accept for now. It still counts as open, not done. Record who approved it and when it'll be reviewed.
Readiness
Readiness = controls implemented with evidence ÷ controls that apply. Controls marked implemented without evidence are flagged in red and not counted, so the number can't be inflated.
Good notes
Write what someone else needs to verify the control: how it's done, who checks it, and where the proof is. Avoid copy-paste statements such as "fully implemented and verified"; auditors read those as a warning sign.
If the system's classification looks wrong (for example a medical device marked minimal risk), the assessment shows a banner. Fix the classification first, or you'll be assessing the wrong set of controls.