An ISO 42001 certificate is only as strong as the body behind it.

1. 1
   International Accreditation Forum (IAF)Runs a multilateral recognition arrangement (MLA). Member accreditation bodies evaluate each other, so an accreditation granted in one signatory country is accepted in the rest.
2. 2
   National accreditation bodyUsually one per country, such as NABCB in India or UKAS in the United Kingdom. It assesses certification bodies and grants each one a defined scope of standards.
3. 3
   Certification bodyPlans and runs your audits and takes the certification decision. It works to ISO/IEC 17021-1 and, for AI management systems, to ISO/IEC 42006.
4. 4
   Your certificateNames the standard, your scope, the dates and the issuer. Its value comes from every link above it.

Break any link and the paper looks the same. A body with no accreditation answers only to itself. A body accredited for ISO 27001 but not for AIMS is outside its approved scope when it signs an ISO 42001 certificate. Neither problem shows on the face of the document.

ISO/IEC 17021-1 is the rulebook for any body certifying a management system: impartiality, the three-year cycle, complaints, and how the decision is made. It says nothing about models or training data. ISO/IEC 42006 fills that gap for AI.

Competence in AI

Audit teams need working knowledge of the AI life cycle, data handling and the risks models create, not only of management system auditing.

Audit time

The days planned must reflect how many AI systems are in scope and how complex they are.

Matching auditors to clients

The body has to place each client's AI activity in a technical area and staff the audit with people competent in it.

Competent decision-makers

Whoever signs off the certificate must understand AI well enough to judge what the audit team found.

• No accreditation mark, or one from a body you cannot find. Look up the accreditation body. If it is not an IAF MLA signatory, recognition stops at its own border.
• Issued before the certifier held an AIMS scope. Ask the certifier when its ISO 42001 accreditation was granted, then compare that with the issue date on the certificate.
• A scope that names the company but no AI. A vague scope may leave out the very product you are buying.
• Absent from every register. Many certificates appear on IAF CertSearch or the issuer's own register. A missing entry is a reason to ask, not proof of forgery.
• Certified with no second-stage audit. Accredited initial certification runs in two stages. A process that skips one is unlikely to be accredited.

ISO/IEC 42001 came out in December 2023. Its companion for certifiers, ISO/IEC 42006, followed in 2025. Accreditation bodies began granting AIMS scopes at different times, some through pilot programmes before 42006 existed. So a certificate from 2024 may be perfectly sound, or it may predate any oversight of its issuer. The date the certifier's scope was granted settles it.

Certification under ISO/IEC 17021-1 is valid for three years, kept alive by yearly surveillance visits and renewed through a recertification audit before the end date. A certificate past its end date, or one whose surveillance was missed, may have been suspended. The issuer's register shows the current status.

• Proof of scope. Ask for the accreditation certificate and the schedule that lists ISO/IEC 42001 by name.
• The people. Ask who will lead your audit and what AI background they bring.
• The plan. Ask how the number and type of your AI systems change the audit days.
• Joint visits. If the same body holds your ISO 27001, ask whether the audits can run together.
• Separation. Ask how they keep consulting away from certification. An accredited body may not certify a system it helped design.

Sources: ISO/IEC 17021-1:2015, requirements for bodies certifying management systems; ISO/IEC 42006:2025 public summary; ISO/IEC 42001:2023 publication details; IAF public information on the MLA and IAF CertSearch; NABCB public information on accreditation in India.