ISO 42001 certification
An ISO 42001 certificate is someone else's decision. Here is how to earn it.
You build and run the AI management system (AIMS). An accredited certification body examines it, grades what it finds and decides whether to certify. This page follows the handoffs between those two sides, from the day you apply to the third year of the certificate.
Back to ISO 42001 services01 · Before you apply
What should already be true when you call a certification body
The audit examines a running system, so each item needs some history behind it.
- A boundary you can draw on one page. Which AI systems, products, sites and teams sit inside the AIMS, which sit outside, and why.
- An inventory that matches reality. Bought AI features, internal tools and models still in development, each with an owner. Auditors cross-check it against purchase records and cloud accounts.
- Dated assessments. For every in-scope system, a dated risk assessment under clause 6.1.2 and a dated impact assessment under clause 6.1.4, each approved by a person with the authority to accept the outcome.
- A Statement of Applicability. Each Annex A control marked in or out, every decision tied back to an assessed reason.
- One complete internal audit. Covering the whole scope, run by people who did not build what they examine (clause 9.2).
- A management review on record. Top management looked at how the AIMS is performing and took decisions (clause 9.3). Minutes with actions, not a slide deck.
None of this has to look polished. Each item has to show that a process ran, produced an output, and that a named person acted on it.
02 · Who does what
The handoffs, in the order they happen
Your team supplies the evidence. The certification body forms the opinions and takes the decision.
| Moment | Your side | Certification body's side | What comes out |
|---|---|---|---|
| Application | Describe the scope, locations, headcount and AI systems | Sizes the audit and picks a team with AI competence | An audit programme for the cycle |
| Stage 1 | Hand over the AIMS documents and walk the auditor through the scope | Judges whether the system is ready for a full examination | A report listing areas of concern |
| Between stages | Fix what Stage 1 raised | Plans Stage 2 around what it saw | Updated records and a Stage 2 plan |
| Stage 2 | Owners demonstrate their controls; staff answer questions | Samples records, interviews people, watches work happen | Findings graded major, minor or improvement |
| Decision | Submit evidence of corrections and corrective actions | A reviewer outside the audit team examines the file and decides | A certificate, or a refusal |
| Surveillance | Keep the AIMS running and its records current | Visits part of the scope each year | A surveillance report |
| Recertification | Show the whole system again, now with years of history | Re-examines the full scope before expiry | A renewed certificate |
03 · Stage 1 and 2
Stage 1 reads the design. Stage 2 tests the operation.
Two different questions, answered with two different kinds of evidence.
Stage 1
Can this system be audited?
- Does the scope fit the AI you actually run?
- Do both assessments exist, and do they follow a stated method?
- Does the SoA trace back to them?
- Have the internal audit and management review taken place?
Stage 2
Does it behave as written?
- Follow one AI system from its requirements to its monitoring
- Ask an operator to show a human override that was really used
- Trace a training dataset back to its source and its terms
- Check that a concern someone raised reached a person who acted
A Stage 1 report is the cheapest feedback the AIMS will ever get. Read every concern in it as a Stage 2 finding that has not happened yet.
04 · How findings land
How an auditor grades what it finds
The grade sets what must happen before a certificate can be issued.
- Major nonconformity
- A requirement missing altogether, or a failure serious enough to doubt that the AIMS can deliver its intended results. No certificate until the body has checked your fix.
- Minor nonconformity
- A lapse that leaves the system working as a whole. The body usually wants an accepted plan to correct it, and looks at the result on its next visit.
- Opportunity for improvement
- An observation with no obligation attached. Worth reading: ignored, it often returns a year later as a minor finding.
In AIMS audits, findings gather wherever a written promise meets daily work. These five patterns are worth hunting for yourself before Stage 2.
- Inventory drift. A team switched on a vendor's summarisation feature last quarter and nobody told the AIMS owner.
- Impact records with no people in them. The template is complete, yet it names no affected group, no harm and no mitigation.
- Oversight claimed, not shown. The procedure promises human review of high-stakes outputs; the system keeps no trace that anyone looked.
- Thin exclusions. An Annex A control ruled out with a one-word note such as N/A.
- Datasets without a paper trail. Nothing records where the data came from, on what terms, or how it was cleaned.
05 · After the certificate
Keeping the certificate alive
Certification opens a three-year cycle; it is not a finish line.
- First year. A surveillance visit falls within twelve months of the certification decision. It samples part of the scope and checks that earlier findings stayed closed.
- Second year. Another sampled visit, often aimed at whatever moved: a new model, a new supplier, a new market.
- Third year. Recertification re-examines the full scope before the certificate expires. Let it lapse and you start again from Stage 1.
- Whenever scope shifts. Adding a high-stakes AI system or a new site is worth telling the body about; it may schedule an extra visit.
Who may not audit you
The firm that helped design your AIMS cannot also certify it. Certification bodies work under impartiality rules in ISO/IEC 17021-1, and ISO/IEC 42006 adds requirements for bodies that certify AI management systems. Auditify prepares and assesses; an accredited certification body issues the certificate.
Sources: ISO/IEC 42001:2023 clause numbers and titles as publicly listed (6.1.2, 6.1.4, 9.2, 9.3); ISO/IEC 17021-1:2015 on audit stages, the certification cycle, certification decisions and nonconformities; ISO's public description of ISO/IEC 42006:2025. All descriptions are our own.
Questions teams ask before booking the audit
Can strong documents let us skip straight to Stage 2?
No. Stage 1 is part of every initial certification.
The body first has to judge readiness and then plan Stage 2 from what it saw. Some bodies schedule the two stages close together, but both take place, and the Stage 2 plan depends on the Stage 1 result.
Does every AI system we run have to be in scope?
No, but the boundary must be defensible.
You may certify part of the organisation, such as one product line. The auditor will test whether that boundary is honest. Leaving out the riskiest system without a reason invites hard questions and weakens what the certificate says to a buyer.
Who actually decides whether we pass?
A reviewer at the certification body, not the lead auditor alone.
The audit team makes a recommendation. A separate person at the body reviews the audit file and takes the certification decision. That split is one of the safeguards accredited certification relies on.
Does holding ISO 27001 make this quicker?
It can cut effort; it removes no steps.
Shared clause structure means policy control, internal audit and management review can run as one programme, and some bodies offer combined audits. The AI-specific parts, above all the impact assessments and the AI Annex A, are still examined on their own terms.
Find out what an auditor would find, first.
An ISO 42001 readiness assessment tests the six entry conditions against your real evidence and lists what to close before you apply.