How is a gap assessment different from a readiness assessment?

The terms are used interchangeably in practice. Where a distinction is drawn, a gap assessment measures against a specific framework's requirements and a readiness assessment asks whether you could survive a particular event, such as a customer audit. The useful question is which framework or event is named, because an assessment against nothing in particular measures nothing in particular.

How long should one take?

An honest self-assessment across two dozen controls takes an afternoon if the answers are known and several weeks if they are not. The time is not spent scoring. It is spent finding out who owns things, which is usually the finding, not the delay.

Can a gap assessment be used as evidence?

It is evidence that the exercise was done and evidence of what was known on the date it was done, which has some value in showing a good-faith process. It is not evidence that the controls it describes operate, because nothing was inspected.

What is an AI compliance gap assessment?

An AI compliance gap assessment compares how an organization runs AI today against the requirements of a named framework, and reports the distance between the two. It covers what exists, who owns it, and what evidence could be produced on request. It is self-declared, not inspected, and that is what separates it from an audit and from certification.

What it measures

A gap assessment is only meaningful against a named target. NIST AI RMF, ISO/IEC 42001 and the EU AI Act ask for overlapping but materially different things, so a generic AI readiness score with no framework attached measures the assessor's opinion, not a gap.

The unit of measurement is a control: one thing an organization either does or does not do, stated specifically enough that somebody could be asked to produce evidence of it. A written inventory of AI systems is a control. Taking AI seriously is not.

Each control carries two separate questions, and conflating them is the most common way these exercises go wrong. The first is how much evidence exists. The second is whether a named person owns it. An organization can have a well-written policy that nobody is responsible for, and that is a different failure from having no policy.

Why ownership is scored separately from evidence

Ownership is one of the first things an audit tests. A control with strong documentation and no named owner has nobody who can answer for it, explain the exceptions, or be asked what changed since last quarter. Evidence without an owner is a document, not a control.

This is why the assessment on this site treats an unowned in-scope control as a failure regardless of score. An organization can sit above 90 on weighted evidence and still fail on one unowned row, which is uncomfortable and correct.

What it is not

It is not an audit. An audit is performed by someone independent, against evidence they inspect. A gap assessment reports what you told it.

It is not certification. Accredited certification against ISO/IEC 42001 is issued by an accredited certification body after an audit, and a certificate from anyone else is an attestation from whoever issued it. The NIST AI RMF is voluntary and confers no certification of any kind.

It is not a conformity assessment under the EU AI Act, and it does not determine how a system classifies or which role you play. Those determinations drive which obligations attach, and they turn on facts a questionnaire cannot see.

It is not legal advice, and a good result is not evidence of compliance with anything.

When it is worth doing

Before a customer questionnaire lands, so the answers are already written. After a first questionnaire is what most organizations do, and it is expensive, because the deadline sets the scope.

Before a certification attempt, to find out how far the ground is. A certification body's gap analysis is a paid engagement, and arriving at it having already found the obvious holes is cheaper than discovering them there.

After any month in which somebody adopted an AI tool nobody logged. A gap assessment is a snapshot, and the thing it measures moves.

Common questions

How is a gap assessment different from a readiness assessment?: The terms are used interchangeably in practice. Where a distinction is drawn, a gap assessment measures against a specific framework's requirements and a readiness assessment asks whether you could survive a particular event, such as a customer audit. The useful question is which framework or event is named, because an assessment against nothing in particular measures nothing in particular.
How long should one take?: An honest self-assessment across two dozen controls takes an afternoon if the answers are known and several weeks if they are not. The time is not spent scoring. It is spent finding out who owns things, which is usually the finding, not the delay.
Can a gap assessment be used as evidence?: It is evidence that the exercise was done and evidence of what was known on the date it was done, which has some value in showing a good-faith process. It is not evidence that the controls it describes operate, because nothing was inspected.

Find out where you stand

The assessment on this site asks 24 questions against the framework you pick and returns a score, a verdict and, where a control is short, the one thing to fix first. It runs in your browser and takes about ten minutes.

It is a self-assessment, not an audit, not a certification, not a conformity assessment and not legal advice.

Run the assessment