Anastasia Lidia Scotto

Approach

Assessments

About

Contact

Discuss an Assessment

AI GOVERNANCE · ISO/IEC 42001 · PRODUCT

Make AI governance actionable.

Make AI governance actionable.

Product Leader and ISO/IEC 42001 Lead Implementer, I help organizations assess their AI governance against ISO/IEC 42001, identify governance and risk gaps, and turn them into practical remediation roadmaps that Product and Technology teams can actually implement.

Discuss an Assessment

View Assessments

ISO/IEC 42001 Lead Implementer · Product Leader · PhD

Evidence before checklists. Action before paperwork.

Evidence before checklists. Action before paperwork.

An AI governance assessment should do more than identify missing documentation. I look at how the AI system actually works, what evidence already exists, where material governance gaps remain and what should happen next.

01

Understand the AI system

Scope, intended use, stakeholders, architecture and lifecycle.

02

Review evidence

Policies, processes, risk documentation, product practices and technical evidence.

03

Assess readiness

Evaluate applicable ISO/IEC 42001 requirements and controls.

04

Identify material gaps

Separate missing documentation from genuine governance and operational weaknesses.

05

Build the roadmap

Prioritize remediation actions, ownership and evidence needed to close the gaps.

SELECTED WORK

Selected AI Governance Assessments

Practical examples of how I assess different types of AI systems against ISO/IEC 42001, examining intended use, stakeholders and impacts, risk management, lifecycle evidence, monitoring and operational controls, and translate findings into actionable remediation.

CASE STUDY 01 · ANONYMIZED

User-Facing Conversational GenUI System

European B2B SaaS company

ISO/IEC 42001 – Gap Analysis: Target vs Current Maturity

Target — required maturity level (5)

Current — assessed maturity level

Scale: 0 (Nonexistent) to 5 (Optimized)

5.02.65.01.25.01.65.02.35.02.15.01.95.02.25.01.85.02.05.01.5ISO/IEC 42001requirements(clauses 4–10)A.2 Policies relatedto AIA.3 InternalorganizationA.4 Resources for AIsystemsA.5 Assessingimpacts of AIsystemsA.6 AI system lifecycleA.7 Data for AIsystemsA.8 Information forinterested partiesof AI systemsA.9 Use of AIsystemsA.10 Third-party andcustomerrelationships

PRIORITY ACTIONS

Top remediation priorities

1

Define AIMS scope

Define and document the AIMS scope, including organizational, technological and operational boundaries and applicability.

Priority

Critical

Effort

Medium

2

Formalize AIMS roles & authorities

Define, assign, document and communicate AIMS roles, responsibilities and authorities, including responsibility for ISO 42001 conformity and AIMS performance reporting.

Priority

High

Effort

Medium

3

Establish SoA process

Establish a formal AI control-selection and Statement of Applicability process, including Annex A comparison, additional controls and inclusion/exclusion justifications.

Priority

High

Effort

Medium

01 / 02

CASE STUDY 01 · ANONYMIZED

User-Facing Conversational GenUI System

European B2B SaaS company

ISO/IEC 42001 – Gap Analysis: Target vs Current Maturity

Target — required maturity level (5)

Current — assessed maturity level

Scale: 0 (Nonexistent) to 5 (Optimized)

5.02.65.01.25.01.65.02.35.02.15.01.95.02.25.01.85.02.05.01.5ISO/IEC 42001requirements(clauses 4–10)A.2 Policies relatedto AIA.3 InternalorganizationA.4 Resources for AIsystemsA.5 Assessingimpacts of AIsystemsA.6 AI system lifecycleA.7 Data for AIsystemsA.8 Information forinterested partiesof AI systemsA.9 Use of AIsystemsA.10 Third-party andcustomerrelationships

PRIORITY ACTIONS

Top remediation priorities

1

Define AIMS scope

Define and document the AIMS scope, including organizational, technological and operational boundaries and applicability.

Priority

Critical

Effort

Medium

2

Formalize AIMS roles & authorities

Define, assign, document and communicate AIMS roles, responsibilities and authorities, including responsibility for ISO 42001 conformity and AIMS performance reporting.

Priority

High

Effort

Medium

3

Establish SoA process

Establish a formal AI control-selection and Statement of Applicability process, including Annex A comparison, additional controls and inclusion/exclusion justifications.

Priority

High

Effort

Medium

01 / 02

ABOUT

AI governance with a Product mindset

AI governance with a Product mindset

I’m Anastasia Lidia Scotto, a Product Leader and ISO/IEC 42001 Lead Implementer with more than a decade of experience building and delivering digital products across AI, SaaS, education and e-commerce.

My background in Product means I approach AI governance from the perspective of how systems are actually designed, developed, measured and operated, not only how requirements are documented.

Before moving into Product, I trained as a scientist and completed a PhD. That combination of scientific thinking, product execution and AI governance shapes the way I assess AI systems: evidence-driven, structured and focused on practical outcomes.

LET’S TALK

Want to understand how ready your AI governance really is?

Want to understand how ready your AI governance really is?

Want to understand how ready your AI governance really is?

I work with organizations that want a practical view of where they stand, which gaps matter most and what to address next.

I work with organizations that want a practical view of where they stand, which gaps matter most and what to address next.

Based in Italy · Working with European organizations

Anastasia Lidia Scotto

AI Governance · ISO/IEC 42001 · Product

LinkedIn

anastasia.scotto@gmail.com

© 2026 Anastasia Lidia Scotto. All rights reserved.