ISO/IEC 42006:2025, published by ISO and IEC in July 2025, sets the additional requirements for bodies that audit and certify AI management systems against ISO/IEC 42001. It builds on ISO/IEC 17021-1, the general standard for management system certification bodies. Organizations do not certify to it; accreditation bodies such as ANAB and UKAS assess certification bodies against it.
So ISO/IEC 42006 is the rulebook for the auditor, not for you. If your company is seeking ISO/IEC 42001 certification, it tells you what your certification body should already be doing: who sits on the audit team, how long the audit runs and what the certificate shows.
| Attribute | ISO/IEC 42006:2025 |
| Full title | Information technology, Artificial intelligence, Requirements for bodies providing audit and certification of artificial intelligence management systems |
| Published | 7 July 2025, edition 1 |
| Length and price | 31 pages; CHF 159 on iso.org as of October 2026 |
| Committee | ISO/IEC JTC 1/SC 42, artificial intelligence |
| Builds on | ISO/IEC 17021-1 (management system certification bodies) |
| Can also be used with | ISO/IEC 17065 schemes for AI products, processes or services |
| Normative references | ISO/IEC 17000, ISO/IEC 17021-1, ISO/IEC 42001, ISO/IEC 22989 (final draft text) |
| Used by | Certification bodies; accreditation bodies and peer assessors as criteria |
Sources: iso.org record for ISO/IEC 42006; ISO/IEC FDIS 42006 preview (iTeh Standards).
How ISO/IEC 42006 Extends ISO/IEC 17021-1
ISO/IEC 42006 follows the clause layout of ISO/IEC 17021-1 and adds AI-specific requirements inside it. In the final draft text, its scope opens with one line: “This document specifies additional requirements to ISO/IEC 17021-1.” The base standard, ISO/IEC 17021-1:2015, sets principles for the competence, consistency and impartiality of certification bodies.
The structure below comes from the final draft (FDIS) preview, published before the 2025 standard. Clause titles are very likely unchanged, but treat the wording as draft text.
| 42006 clause | Area (same as ISO/IEC 17021-1) | What the AIMS version adds |
| 5 | General requirements | Impartiality, conflicts of interest, liability |
| 6 | Structural requirements | Follows the base standard |
| 7 | Resource requirements | 7.1.2 generic and 7.1.3 specific AI technical competence; 7.2.2 demonstration of auditor knowledge and experience |
| 8 | Information requirements | 8.2.2 AIMS certification documents; 8.4.2 access to the client’s documentation |
| 9 | Process requirements | 9.1.4 audit time; 9.1.5 multi-site sampling; 9.1.6 multiple management systems; 9.2.4 remote audit; 9.6 surveillance and re-certification |
| 10 | Management system requirements for certification bodies | Option A (general) or Option B (in line with ISO 9001) |
| Annex A (normative) | Audit time | Rules for calculating audit days |
| Annex B (informative) | Examples for audit time calculations | Worked examples |
| Annex C (informative) | Template for a certification document | What an AIMS certificate shows |
Source: ISO/IEC FDIS 42006 table of contents and clause 1 (iTeh Standards preview). Body text after clause 9.3 is not in the preview.
The introduction explains why AI needed its own rulebook. An AIMS touches risk management, data protection, data quality, security, ethics, and verification and validation of algorithms, so auditors need knowledge a general management system auditor may lack. The ANAB ISO/IEC 42001 accreditation program lists ISO/IEC 42006:2025 among its program documents, next to ISO/IEC 42001:2023 and ANAB Accreditation Rule 59.
What ISO/IEC 42006 Requires of AIMS Auditors
ISO/IEC 42006 requires a certification body to define competence for each certification function, building on Annex A of ISO/IEC 17021-1. Clause 7.1.2 covers generic technical competence and 7.1.3 the specific competence for a client’s AI systems. Table 1 of the final draft lists six knowledge areas across three functions.
| Knowledge area (Table 1 row) | What it means for your audit (our reading) |
| General requirements for AIMS | The auditor knows how a management system works, clauses 4 to 10 |
| Artificial intelligence management system standards/normative documents/certification schemes | The auditor knows ISO/IEC 42001 and its Annex A and B |
| AI and AIMS related legal obligations | The team can ask about laws that apply to your AI use |
| Artificial intelligence and AIMS specific terminology, principles, practices, tools, methods and techniques | The team understands models, data, testing and AI life cycle records |
| Client business sector | Someone on the team knows your industry |
| Client products, processes and organization | The team understands what your AI systems actually do |
Source: row headings of Table 1 in ISO/IEC FDIS 42006 (iTeh Standards preview); the three function columns are application review, audit team selection and audit time; reviewing audit reports and making certification decisions; and auditing and leading the audit team. The right column is an AI Training Skool reading, not ISO text.
One requirement stands out. The audit team must collectively “be competent in tracing and identifying indications of incidents” with serious negative effects back to the client’s AIMS. That means an auditor should be able to follow a harmful AI outcome back to a missing control or a skipped impact assessment. If you want to work on the certification side, the route is laid out in becoming a certified ISO 42001 auditor.
How Audit Time and the Certificate Are Set
ISO/IEC 42006 sets AIMS audit time through clause 9.1.4 and normative Annex A, with worked examples in informative Annex B. The figures are not in the public preview, so no page can quote them without the purchased standard. Audit days are the main driver of your fee, which is why what ISO 42001 certification costs a company starts from them.
Annex C gives a template for the certification document. Read any certificate for its scope statement, not only the company name: the scope says which AI systems and sites are covered. Real examples are collected in ISO 42001 certificates and their scopes.
The ISO 42001 Trust Chain, From Global Accreditation Cooperation to Your Certificate
An accredited ISO/IEC 42001 certificate rests on four layers and each layer is checked by the one above it. ISO writes the standards but certifies no one.
| Layer | Who | Assessed against | Where to check |
| International recognition | Global Accreditation Cooperation Incorporated (successor to IAF and ILAC from 1 January 2026) | Its own recognition arrangement (MRA), which covers the scopes of the former IAF MLA and ILAC MRA | The accreditation body’s stated recognition status |
| Accreditation body | ANAB (US), UKAS (UK) | ISO/IEC 17011 and peer evaluation | Accreditation body directory |
| Certification body | An accredited AIMS certification body | ISO/IEC 17021-1 plus ISO/IEC 42006:2025 | Accreditation scope naming ISO/IEC 42001 |
| Organization | Your company | ISO/IEC 42001:2023 | The certificate and IAF CertSearch |
Sources: IAF and ANAB notices on Global Accreditation Cooperation; ANAB and UKAS program pages; iso.org. The table is an AI Training Skool summary.
The top layer changed this year. The IAF announcement of Global Accreditation Cooperation says the new body “has commenced full operations as of 1 January 2026”, replacing the IAF and ILAC with one recognition arrangement. In the UK, UKAS granted its first AIMS accreditation on 15 January 2026, after a pilot.
How to Check That a Certification Body Is Accredited for ISO 42001
Confirm that ISO/IEC 42001 appears on the certification body’s scope in the ANAB or UKAS directory, then look up the certificate itself in IAF CertSearch, which still runs under the IAF name. The directory steps, scope checks and red flags are set out in what accredited means for ISO 42001 certificates.
What ISO/IEC 42006 Does Not Cover
ISO/IEC 42006 is not a standard your organization certifies against, and it does not certify people. Companies certify to ISO/IEC 42001, whose requirements are set out in the ISO 42001 standard in plain English. The Stage 1, Stage 2 and surveillance route is covered in organizational ISO 42001 certification.
People are certified under a different standard. Personnel certification bodies work to ISO/IEC 17024, whose third edition ISO published on 31 March 2026. A Lead Implementer or Lead Auditor credential is a personal credential, so ISO/IEC 42006 says nothing about it.
Which ISO standard applies to an auditor depends on who the auditor works for:
| Auditor | Standard | What it covers |
| Your own internal auditor (ISO/IEC 42001 clause 9.2) | ISO 19011:2026, fourth edition | Guidelines for audit programs, conducting audits and auditor competence; it does not itself lead to certification |
| Auditor at an AIMS certification body | ISO/IEC 17021-1:2015 plus ISO/IEC 42006:2025 | Requirements for the certification body, including auditor competence and audit time |
| Auditor at an ISMS certification body | ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024 | The same model for ISO/IEC 27001 certification |
| A person holding an auditor credential | ISO/IEC 17024:2026, third edition | Requirements for the body that certifies the person, not for the audit itself |
Sources: iso.org records for ISO 19011, ISO/IEC 17021-1, 42006, 27006-1 and 17024. The table is an AI Training Skool summary.
ISO/IEC 42006 is not a law either. A certificate from a 42006-compliant body shows a credible audit of your AIMS; it does not show compliance with a statute. For the US side, where the voluntary NIST AI RMF and Texas TRAIGA meet the standard, see how US AI rules relate to ISO 42001 and NIST.
Frequently Asked Questions
What Is ISO 42006?
ISO/IEC 42006:2025 is the international standard that sets additional requirements for bodies that audit and certify AI management systems against ISO/IEC 42001. Published in July 2025 by ISO and IEC, it runs to 31 pages and builds on ISO/IEC 17021-1. It covers auditor competence, audit time, multi-site sampling and the content of certification documents.
Can a Company Get ISO 42006 Certified?
No. ISO/IEC 42006:2025 applies to certification bodies, not to the organizations they audit. A company gets certified to ISO/IEC 42001:2023 by a certification body, and an accreditation body such as ANAB or UKAS assesses that certification body against ISO/IEC 17021-1 and ISO/IEC 42006. Ask your certifier for its accreditation scope.
What Is the Difference Between ISO 42001 and ISO 42006?
ISO/IEC 42001:2023 sets requirements for an organization’s AI management system. ISO/IEC 42006:2025 sets requirements for the bodies that audit and certify those systems: auditor competence, audit time, certificates and the certification cycle. One is the standard you are audited against; the other governs who audits you and how.
Is There a Free ISO 42006 PDF?
ISO sells ISO/IEC 42006:2025 for CHF 159 on iso.org as of October 2026, and national standards bodies sell licensed copies. The free material online is a preview of the final draft (FDIS), which shows the table of contents, scope and competence table but not the audit time rules. Full copies posted for free download are unlicensed.
Does ISO 42006 Apply to ISO 42001 Lead Auditor Courses?
No. ISO/IEC 42006 covers certification bodies that audit organizations. Personal credentials such as Lead Auditor or Lead Implementer are issued by personnel certification bodies, which can be accredited under ISO/IEC 17024. ISO/IEC 42006 does set competence rules for auditors employed by AIMS certification bodies.
