Add-on service · ISO/IEC 42001
AI Risk Assessment & Statement of Applicability (SoA) Support
An auditor will not just ask which controls you have — they will ask why you excluded the ones you did. We run structured AI risk and impact assessments and produce a Statement of Applicability with defensible justification for every inclusion and exclusion.
AI Risk Assessment & SoA Support pricing
Choose the coverage that fits your organisation. Starter is a £249 single-tool risk assessment; Pro is a £699 multi-tool assessment plus full SoA creation. An annual SoA update is available as a £129 add-on. These are service options, separate from the Trestano Starter and Pro software plans.
Best for: Organisations needing defensible documentation for regulators, insurers or customers, and anyone preparing for ISO/IEC 42001 audit scrutiny.
AI Risk Assessment & Statement of Applicability (SoA) Support includes
- Structured AI risk and impact assessments for the systems in scope
- A compliant Statement of Applicability aligned to ISO/IEC 42001 Annex A controls
- Clear, written justification for every included and excluded control
- Risk treatment decisions recorded with owners and review dates
- Documentation formatted for regulators, insurers and customer due diligence
Choose your coverage
Both options produce documented assessments. The difference is how many tools go through the risk process and whether the full Statement of Applicability is built.
- Starter — £249: single-tool risk assessment, covering one AI system end to end.
- Pro — £699: multi-tool assessment plus full SoA creation, with justification for included and excluded controls.
- Annual SoA update — £129 add-on: refresh the Statement of Applicability as your systems and risks change.
Why the SoA is where audits get hard
The most common ISO/IEC 42001 audit finding is not a missing control — it is an unjustified one. Excluding a control without a documented reason reads as narrowing the scope to avoid scrutiny. We record the reasoning for each decision, so the exclusions are as defensible as the inclusions.
What you receive
Risk and impact assessments written against your actual systems, and a Statement of Applicability you can hand to an auditor, insurer or enterprise customer — each risk mapped to a treatment, each control decision justified and dated.
Common questions
Is the service Pro option the same as a Pro software subscription?
No. Starter and Pro here describe the coverage of this one-off service, not your Trestano software plan. You can enquire about either option on any plan.
Does this certify us to ISO/IEC 42001?
No. The risk assessments and SoA are core evidence for an AI Management System aligned to ISO/IEC 42001, but certification comes only from an accredited certification body. This work prepares you for that conversation.
What does the annual update cover?
The £129 add-on revisits the Statement of Applicability to reflect new tools, changed risks and revised control decisions over the previous year. It does not replace a full re-assessment.
How does this connect to the scope mapping service?
They pair naturally: scope definition establishes what systems are governed, and risk assessment establishes how those systems are treated. If you are building a full AI Management System, we recommend running scope mapping first.
Not sure which you need?
Run the free AI register first — it takes about ten minutes and usually makes the answer obvious. Or tell us what you're dealing with and we'll point you at the right thing.
Not legal advice. Trestano provides governance tooling, documentation and practical guidance. It isn't a substitute for advice from a qualified solicitor or your own compliance team.