ISO/IEC 42001 certification is a third-party audit of your organizationâs AI management system (AIMS) against ISO/IEC 42001:2023 on iso.org, carried out by a certification body, not by ISO. The route has two halves: you build and run the AIMS, then an accredited certification body audits it in two stages and keeps checking it over a three-year cycle.
Most companies spend most of their effort before the auditor arrives. The certification audit tests whether the system you built is documented, running and effective for the scope you chose. The table below follows a company from first decision to certificate.
| Stage | Who does it | ISO/IEC 42001 clauses in play | What is checked | Output |
| 1. Scope and AI roles | Your AIMS lead and leadership | 4.1, 4.2, 4.3 | Which AI systems, sites and roles are in scope | Scope statement, AI system inventory |
| 2. Gap analysis | Your team or an adviser | 4 to 10, Annex A | Current practice against each requirement and control | Gap list and project plan |
| 3. Build the AIMS | Your team | 5.2, 5.3, 6.1.2 to 6.1.4, 6.2, 7.5 | Policy, roles, risk and impact methods, objectives, document control | AI policy, risk and impact methods, Statement of Applicability |
| 4. Operate it | System owners | 8.1 to 8.4, 9.1 | Assessments performed on real systems, monitoring running | Completed assessments, treatment records, monitoring logs |
| 5. Check it yourself | Internal auditors, top management | 9.2, 9.3, 10.2 | Internal audit and management review done, nonconformities handled | Audit report, review minutes, corrective actions |
| 6. Stage 1 audit | Certification body | Mainly 4 to 7, plus evidence of 9.2 and 9.3 | Readiness, scope, documented information | Stage 1 findings, Stage 2 plan |
| 7. Stage 2 audit | Certification body | 4 to 10 and the SoA | Implementation and effectiveness | Audit report, graded findings, recommendation |
| 8. Close findings | Your team, verified by the certification body | 10.2 | Corrections and corrective actions | Accepted action evidence |
| 9. Certification decision | Certification body, separate decision function | n/a | Audit report and closure evidence | Certificate with scope and expiry |
| 10. Surveillance and recertification | Certification body | All, sampled | The AIMS still works and improves | Continued certificate, new cycle |
Sources: ISO/IEC 42001:2023 official preview (clause titles); ISO/IEC 42006 (FDIS preview, table of contents and Table 1); ISO/IEC 17021-1 as quoted by European Accreditation; IAF MD 5.
Readiness Starts With Scope, AI Roles and a Gap Analysis
Readiness means deciding what the AIMS covers and measuring how far your current practice sits from the standard. Clause 4.3 requires the scope to be âavailable as documented informationâ, and clause 4.1 asks you to determine your roles with respect to the AI systems you develop, provide or use (official preview).
Those roles change the work. ISO/IEC 42001 lists AI providers, AI producers, AI customers and users, AI partners, AI subjects and relevant authorities, and notes that your roles âcan determine the applicabilityâ of its requirements and controls. A company that builds a model and sells it as a service holds different duties from one that buys an AI tool for its help desk.
Start the scope from an inventory, not an org chart. Listing every AI system in scope gives you the boundary the auditor will test, and it shows which systems you have left out and why. A narrow first scope, such as one product line, is legitimate if the scope statement says so plainly.
Then run the gap analysis: compare current practice with each requirement in clauses 4 to 10 and each Annex A control, and estimate the time, people and money needed to close each gap. The result is your project plan.
Building the AIMS From AI Policy to Statement of Applicability
Building the AIMS means creating the documents the standard requires and then producing records by using them. A certification body will look for both.
The core build sequence follows the clause numbers:
- Clause 5.2, AI policy. Top management approves the AI policy, the document every other AIMS record answers to.
- Clause 5.3, roles. Name who owns the AIMS, who approves risk acceptance and who reports on performance.
- Clauses 6.1.2 to 6.1.4, planning. Define your AI risk assessment, AI risk treatment and AI system impact assessment methods.
- Statement of Applicability. List every Annex A control, say whether it applies, and justify each inclusion or exclusion. Definition 3.26 of the standard calls this âdocumentation of all necessary controlsâ with justification.
- Clause 6.2, AI objectives. Set AI objectives, measurable where practicable, and plans to achieve them.
- Clauses 8.2 to 8.4, operation. Perform the risk assessments, risk treatment and impact assessments on real systems. Clause 6 plans the methods; clause 8 requires you to run them, and auditors ask for the completed records.
- Clause 7.5, documented information. Control versions, approvals and retention so that every record is current and traceable.
The step-by-step build belongs to implementation and is a project of its own. For certification, the test is simpler: can you show the auditor a method, a completed record that used it, and someone who owns it?
Internal Audit and Management Review Come Before Stage 1
Run at least one internal audit (clause 9.2) and one management review (clause 9.3) before your Stage 1 audit. ISO/IEC 17021-1 requires every initial certification audit to run in two stages. Guidance on that two-stage audit from the ISO 9001 Auditing Practices Group (ISO and IAF, 2016), written for quality systems but describing the same model, lists evaluating âif internal audits and management reviews are being planned and performedâ as part of Stage 1.
Across the audit program, internal audits should cover the whole AIMS scope, run by auditors chosen to be objective and impartial. Its findings go into clause 10.2 corrective action, and its results go into the management review. For the audit program itself, see how an ISO 42001 internal audit is planned and reported.
Management review closes the loop. Top management looks at AIMS performance, audit results and changes in context such as new AI laws (clause 9.3.2 covers the inputs), then records its decisions (9.3.3). A Stage 1 auditor who finds an internal audit report and signed review minutes knows the system has run through at least one full check cycle.
Choosing an Accredited Certification Body
Choose a certification body that is accredited for ISO/IEC 42001 by a recognized accreditation body. Accreditation means the auditor has itself been assessed for competence and impartiality.
Accredited AIMS certification bodies work to two standards. ISO/IEC 17021-1 sets requirements for every body that audits and certifies management systems. ISO/IEC 42006:2025, published in July 2025, âsets out the additional requirementsâ for bodies that audit and certify AIMS and builds on ISO/IEC 17021-1. Its competence table separates three functions: application review, audit report review and certification decisions, and auditing and leading the audit team. More on those rules in ISO/IEC 42006 and the bodies that certify AIMS.
In the US, ANAB has accredited AIMS certification bodies under a program it launched in January 2024, according to its ANAB AIMS accreditation program post. In the UK, UKAS announced its first ISO/IEC 42001 accreditation on 15 January 2026. International recognition between accreditation bodies now runs through Global Accreditation Cooperation Incorporated, which took over the work of the IAF and ILAC on 1 January 2026.
Before you sign, ask each candidate body four questions:
- Is ISO/IEC 42001 on your accreditation scope, and with which accreditation body? Check the answer in the accreditation bodyâs directory.
- Do your auditors have competence in our sector and our kind of AI systems?
- How will you calculate audit time, and will any of it run remotely?
- Can you audit ISO/IEC 42001 together with our existing ISO/IEC 27001 or ISO 9001 certificate?
The FDIS preview of ISO/IEC 42006 has subclauses behind each answer: audit time (9.1.4), remote audits (9.2.4) and multiple management systems (9.1.6).
Accreditation is what separates one certificate from another:
| Attribute | Accredited certificate | Unaccredited certificate |
| Who checks the certification body | An accreditation body such as ANAB or UKAS, against ISO/IEC 17021-1 and ISO/IEC 42006 | Nobody independent |
| Where you can verify it | The accreditation bodyâs directory, and IAF CertSearch, a database of accredited certificates | Only the issuerâs own records |
| Buyer acceptance | Meets contracts and tenders that ask for accredited certification | Can be rejected wherever accredited certification is specified |
| Audit rules | Audit time, competence and the three-year cycle follow ISO/IEC 17021-1 and ISO/IEC 42006 | Set by the issuer |
Sources: ISO/IEC 42006 on iso.org; IAF CertSearch; ANAB and UKAS program pages. The table is an AI Training Skool summary.
Stage 1 and Stage 2 Audits Compared
The certification audit runs in two stages. Stage 1 checks whether you are ready and plans Stage 2. Stage 2 checks whether the AIMS is implemented and effective across the scope.
| Attribute | Stage 1 audit | Stage 2 audit |
| Main question | Is the AIMS ready to be audited, and what will Stage 2 cover? | Is the AIMS implemented and effective? |
| What auditors review | Scope, AI roles, AI policy, risk and impact methods, SoA, evidence that internal audit and management review are planned and performed | Completed risk and impact assessments, treatment records, monitoring, operation of Annex A controls, internal audit and review records, corrective actions |
| How they gather evidence | Mostly document review and interviews | Interviews, observation and sampling across systems and sites |
| Clause emphasis | 4 to 7, with a check on 9.2 and 9.3 | 4 to 10 and the SoA |
| Typical length | Shorter; IAF MD 5 notes Stage 2 normally takes more time than Stage 1 (for QMS, EMS and OH&S) | Longer |
| Result | Concerns raised so you can fix them before Stage 2; Stage 2 plan | Audit report with graded findings and a recommendation |
Sources: ISO 9001 Auditing Practices Group two-stage guidance (ISO and IAF, 2016); IAF MD 5:2023; ISO/IEC 42006 FDIS table of contents. Stage 2 wording reflects common practice under ISO/IEC 17021-1.
The gap between the stages gives you time to fix what Stage 1 found. Plan it, rather than booking the two back to back. For the records auditors sample at each stage, see what counts as audit evidence under ISO 42001.
How Major and Minor Nonconformities Are Closed
Every audit finding that shows a requirement was not met is a nonconformity, graded major or minor. Major findings must be fixed and verified before the certification decision; minor ones need an accepted plan.
ISO/IEC 17021-1 defines a major nonconformity as one âthat affects the capability of the management system to achieve the intended resultsâ, and a minor nonconformity as one that does not. A missing AI system impact assessment process across the scope would likely be major. One out-of-date entry in an otherwise current risk register would likely be minor. The certification body grades each finding.
Before deciding, the certification body must have âreviewed, accepted and verified the correction and corrective actionsâ for any major nonconformity, under clause 9.5.2 of ISO/IEC 17021-1, as quoted in European Accreditationâs FAQ on nonconformity grading. For a minor nonconformity, it must have reviewed and accepted your plan for correction and corrective action; verification usually follows at the next audit.
Treat each finding as a clause 10.2 corrective action: fix the instance, find the root cause, change the process, and keep the evidence.
The Certification Decision and What the Certificate Covers
The certification decision is taken by the certification body after it reviews the audit report and your closure evidence. ISO/IEC 42006 treats report review and decision-making as a separate function from auditing, with its own competence requirements.
The certificate states the scope that was audited. That scope comes from your clause 4.3 statement, as confirmed by the certification body. The FDIS preview of ISO/IEC 42006 also has a clause on AIMS certification documents (8.2.2) and an informative template for one (Annex C). Read a scope before you rely on any certificate, yours or a supplierâs: a certificate for one productâs AI management process says nothing about the rest of the company.
An accredited certificate can be traced back through the certification body to its accreditation body; see accreditation chains behind ISO 42001 certificates. For organizations already certified, see who has ISO 42001 certification so far.
Surveillance Audits and the Three-Year Recertification Cycle
An ISO/IEC 42001 certificate runs on a three-year cycle: surveillance audits in the two years after the initial decision, then a recertification audit before the certificate expires.
The ISO/IEC 42001 certification cycle for an organization: readiness, building the AIMS, internal audit and management review, Stage 1 audit, Stage 2 audit, certification decision, a surveillance audit no more than 12 months after the decision, a second surveillance audit the following calendar year, then recertification before expiry
ISO/IEC 17021-1 clause 9.1.3.3, as quoted by the IAF FAQ, says surveillance audits âshall be conducted at least once a calendar year, except in recertification yearsâ. The first must fall no more than 12 months after the certification decision date. Recertification has a hard edge: European Accreditation quotes clause 9.6.3.2.4, which says recertification shall not be recommended if the audit is not completed, and major nonconformities verified, before the expiry date.
Surveillance and recertification audits recur, so budget for every year of the cycle, not only the first; the company cost of ISO 42001 certification breaks the three years down line by line.
| Year | Certification body activity | What you keep running |
| Year 1 | Stage 1 and Stage 2, decision | Full AIMS operation, first corrective actions |
| Year 2 | Surveillance audit, within 12 months of the decision | Internal audit, management review, assessments for new AI systems |
| Year 3 | Surveillance audit | Same, plus preparation for recertification |
| Before expiry | Recertification audit and decision | Evidence of improvement across the full cycle |
Sources: ISO/IEC 17021-1 clauses 9.1.3.3 and 9.6.3.2.4 as quoted by the IAF FAQ and European Accreditation; IAF MD 5:2023.
How Long Does ISO 42001 Certification Take?
There is no fixed duration; timing depends on scope, the number of AI systems, how much of the management system already exists, and the certification bodyâs calendar. We found no primary source that sets a standard timeline, so the plan below is an example, not a benchmark.
Example plan (fictional): a 150-person software company with an ISO/IEC 27001 certificate and six AI systems in scope.
| Month | Activity | Clauses |
| 1 | AI system inventory, scope, roles, gap analysis; request certification body quotes | 4.1 to 4.3 |
| 2 to 3 | AI policy, roles, risk and impact methods, objectives, SoA | 5.2, 5.3, 6.1.2 to 6.1.4, 6.2 |
| 3 to 4 | Run risk and impact assessments on all six systems; start monitoring | 8.2 to 8.4, 9.1 |
| 5 | Internal audit, corrective actions, management review | 9.2, 9.3, 10.2 |
| 6 | Stage 1 audit | 4 to 7, check on 9.2 and 9.3 |
| 7 | Fix Stage 1 concerns; Stage 2 audit | 4 to 10 |
| 8 | Close nonconformities; certification decision | 10.2 |
Example only. Assumes an existing ISO/IEC 27001 document control, internal audit and management review process that the AIMS reuses.
A company with no ISO management system, or with dozens of AI systems, should expect a longer build. Book the certification body early: its availability, not your readiness, often sets the Stage 1 date.
Certifying the Organization vs Certifying the Person Who Leads It
ISO/IEC 42001 certification belongs to the organization and its stated scope. A Lead Implementer credential belongs to a person, and no company becomes certified because an employee holds one.
The two meet in clause 7.2, which requires the people doing AIMS work to be competent. A certification body will ask how your AIMS lead gained that competence, through training, education or experience. A personal credential is one way to show it. For how that works, see how a professional earns the ISO 42001 Lead Implementer title.
Will you run the build, the internal audit and the audit days yourself? ISO 42001 Lead Implementer training for the person who will lead certification covers clauses 4 to 10 and Annex A, with a case study workbook for the core records. The AI Training Skool course is CPD accredited by the CPD Standards Office for its training. It is not an ISO/IEC 17024 personnel certification. If a contract or tender specifically asks for a credential accredited under ISO/IEC 17024, check that requirement before you choose a course.
Frequently Asked Questions
How Do You Get ISO 42001 Certified as a Company?
Build and run an AI management system that meets ISO/IEC 42001 clauses 4 to 10 for a defined scope, complete at least one internal audit and management review, then hire an accredited certification body. It runs a Stage 1 readiness audit and a Stage 2 audit of implementation and effectiveness, verifies fixes for any major nonconformities, and issues a certificate valid for a three-year cycle.
What Is the Difference Between a Stage 1 and a Stage 2 Audit?
A Stage 1 audit checks readiness: the AIMS scope, AI policy, risk and impact methods, Statement of Applicability, and whether internal audits and management reviews are planned and performed. It is used to plan Stage 2. A Stage 2 audit tests whether the AIMS is implemented and effective, by sampling completed assessments, control operation and records across the certified scope.
Who Can Certify a Company to ISO 42001?
A certification body, not ISO. ISO does not certify organizations. For a certificate that buyers trust, choose a body accredited for ISO/IEC 42001 by a national accreditation body such as ANAB in the US or UKAS in the UK. Accredited bodies work to ISO/IEC 17021-1 and ISO/IEC 42006:2025, published in July 2025.
How Often Are ISO 42001 Surveillance Audits?
At least once a calendar year in the two years between the initial certification and recertification. Under ISO/IEC 17021-1, as quoted by the IAF FAQ, the first surveillance audit must take place no more than 12 months after the certification decision date. Recertification must be completed, with major nonconformities verified, before the certificate expires.
What Happens if the Auditor Finds a Major Nonconformity?
The certification body cannot grant certification until it has reviewed, accepted and verified your correction and corrective actions for each major nonconformity, under ISO/IEC 17021-1 clause 9.5.2. A major nonconformity is one that affects the management systemâs ability to achieve its intended results. Minor findings need an accepted action plan, usually verified at the next audit.
Does a Lead Implementer Certificate Make My Company ISO 42001 Certified?
No. A Lead Implementer credential certifies a personâs knowledge, while ISO/IEC 42001 certification covers an organizationâs AI management system for a stated scope, after audits by a certification body. A trained lead helps the company show the competence clause 7.2 requires, but the company still needs its own Stage 1 and Stage 2 audits.
