Gap against a named framework
AI Compliance Gap Assessment
Find out where you are short of NIST AI RMF, ISO/IEC 42001 or the EU AI Act, and which gap to close first where a control is short.
NIST AI RMF and ISO/IEC 42001 are voluntary standards; the EU AI Act is law. This assessment measures alignment; it does not determine whether a framework applies to you.
An AI compliance gap assessment compares how you run AI today against what a named framework asks for, and returns the distance between the two. This one asks 24 questions across eleven control domains, weights them for the framework you pick, and returns a score out of 100 with one of three verdicts.
Two things can hold that verdict down whatever the score. A control nobody owns fails the assessment outright, because an auditor asks who owns it before asking anything else. And a top verdict cannot sit on a control that reads zero, because a weighted average would otherwise fill the hole in for you. Neither gate can ever improve a verdict. The whole method is published, weights and bands included, so you can recompute the number by hand.
Nothing is fetched from your systems and nothing you type is stored by us: your answers ride inside your own result link. Opening or sharing that link sends the address, and so the answers, to our host the way any URL does, where it appears in ordinary server logs. Nothing in it names you or your company. It is a self-assessment, not an audit, not a certification, not a conformity assessment and not legal advice.
Which framework are you measuring against?
They ask for different things, so the assessment weights the same controls differently and drops the ones your framework does not ask for. Pick the one somebody is going to hold you to.
Results are subject to the Terms, which cover how a result may be described to somebody else. Nothing you answer is stored or sent to us.
Common questions
- What is an AI compliance gap assessment?
- It is a comparison between how an organization runs AI today and what a named framework asks for, expressed as the distance between the two. It is not an audit and produces no certificate: an audit is performed by someone independent against evidence they inspect, while a gap assessment is a self-declared picture of where you stand before anyone inspects anything.
- Is this an audit or a certification?
- No. It is a self-assessment scored against answers you supply, and it cannot verify any of them. Accredited certification against ISO/IEC 42001 is issued by an accredited certification body after an audit, and a certificate from anyone else is an attestation from whoever issued it. The NIST AI Risk Management Framework is voluntary and confers no certification at all. Nothing here is a conformity assessment under the EU AI Act, and nothing here is legal advice.
- Why can a control with no owner fail the whole assessment?
- Because ownership is one of the first things an audit tests, and a control with strong evidence but nobody's name on it has no one who can attest to it. This tool reuses the gate from RedHub's shipped 90-day audit readiness triage: any in-scope control without a named person fails regardless of the score. The worked example in that product scores 92 out of 100 and still fails, on one ownerless row.
- Why does a score of 82 not always come back AUDIT-READY AS DESCRIBED?
- A second gate holds a top verdict at PATCHABLE when any in-scope control reads zero. Without it, a weighted average quietly fills the hole in: a control you have done nothing about gets averaged away by the ones you have. Dogfooding an earlier RedHub scorecard found nearly half its top-band verdicts sitting on a completely absent surface, which is what this gate exists to stop.
- Which framework should I pick?
- Pick the one somebody is going to hold you to. ISO/IEC 42001 is the one you can be certified against, so it is the answer when a customer or a tender has asked for a certificate. The NIST AI RMF is voluntary and the lightest to adopt, which suits a defensible risk story with no certificate attached. The EU AI Act applies by role and by how a system classifies, so it is the one to measure against if you place AI systems on the EU market or use them there.
- What happens to my answers?
- Nothing you type is stored by us and no answer goes into a database. The answers ride inside the result link itself rather than in a record we keep, which is why the page works for someone you send it to and why there is nothing here tying a verdict to a person. It does mean that opening or sharing a result sends that address to our host the way any URL does, where it appears in ordinary server logs. Nothing in it names you, your company or your systems.
The three frameworks, briefly
NIST AI Risk Management Framework 1.0. A voluntary US framework organized into four functions (GOVERN, MAP, MEASURE and MANAGE) for identifying and managing risk across an AI system's life cycle.
ISO/IEC 42001:2023. An international management-system standard for artificial intelligence: a documented AI management system, with an Annex A set of controls, that an accredited body can certify.
EU AI Act (Regulation (EU) 2024/1689). An EU regulation that assigns obligations by the role you play (provider, deployer, importer, distributor) and by the risk category a system falls into, including prohibited practices, high-risk systems, transparency duties for certain systems and content, and a separate set of duties for general-purpose AI models.