ISO 42001 certification process: ISO/IEC 42001 certification, step by step

Who does what in ISO/IEC 42001 certification

Four parties take part. Your organisation owns the AI management system (AIMS): it decides which AI systems are governed, runs the assessments and operates the controls. A consultancy such as Sterling helps you design and prepare that system; it never audits it for certification and never issues the certificate. The certification body, independent of any adviser you use, audits the AIMS against ISO/IEC 42001:2023 and decides whether to certify. An accreditation body, in turn, assesses the certification body, and its recognition is what lets a customer or a regulator rely on the certificate.

Three documents set the rules. ISO/IEC 42001 holds the requirements for your system. ISO/IEC 17021-1 governs how any management system certification body works: an initial audit in two stages, competent auditors, a decision separated from the audit team, yearly surveillance and a three-year cycle. ISO/IEC 42006, published in July 2025, adds the requirements specific to bodies that audit and certify AI management systems, supplementing ISO/IEC 17021-1.

Steps 1 to 5: preparing the AIMS for audit

Step 1: decide the scope and the reason for it

Start with an inventory. The scope then names the AI systems covered, whether you develop, provide or use each one, and the sites, functions and suppliers involved; clause 4.3 requires it to be available as documented information, and its wording ends up on the certificate. Our scope guide covers the choices and the traps in detail.

Step 2: gap analysis

Sterling's gap analysis compares your current policies, practice and records with clauses 4 to 10 and the 38 Annex A controls. It records what already works, including anything an ISO/IEC 27001 system provides, and turns the rest into an action plan with owners and target dates. It is not the certification body's Stage 1, which comes months later, and it is deeper than the free online readiness check.

Step 3: build the system

This is where most of the effort sits. Top management approves an AI policy and objectives; you set risk criteria and assess AI risks so that repeated assessments give consistent, comparable results (clause 6.1.2); you select controls, compare them with Annex A and record the result, with justification, in a Statement of Applicability and an approved treatment plan (6.1.3); and you assess each system's potential consequences for individuals, groups and society, feeding the result back into the risk assessment (6.1.4). Our guides to the AI system impact assessment and to Annex A explain those two pieces.

Step 4: operate the controls and let records accumulate

An auditor tests a system that runs, not one that has just been written. Life-cycle, data, supplier, log and incident records need time to build up. Clause 8 also expects risk and impact assessments to be repeated at planned intervals or when a significant change occurs, so a model update during this period is useful evidence, not a problem.

Step 5: internal audit and management review

Before Stage 2, complete at least one internal audit covering the clauses and the applicable Annex A controls, performed by people who did not build the parts they audit, and a management review that takes decisions on AI risks, resources and improvement.

Step 6: choose and contract the certification body

Ask which accreditation body has accredited the certification body for ISO/IEC 42001 specifically, against ISO/IEC 17021-1 and ISO/IEC 42006, and check the answer on that accreditation body's public register. Accreditation bodies are recognised internationally through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA on 1 January 2026. Apply while implementation is still under way: fewer bodies offer this scheme, and the application review is what fixes your audit dates. Our guide to choosing a certification body covers quotations and warning signs.

Step 7: the Stage 1 readiness review

Stage 1 establishes whether the AIMS is ready to be audited in full. Expect the auditor to read the scope and the AI system inventory, the AI policy, the risk method and register, the Statement of Applicability and a sample of impact assessments, and to confirm that the internal audit and management review have been planned and carried out. The report lists areas of concern that could become nonconformities at Stage 2 and fixes the Stage 2 plan.

Step 8: resolve the Stage 1 concerns

Treat each concern as an early warning and close it with evidence. Typical ones for an AIMS are a Statement of Applicability that does not match the risk register, an impact assessment missing for a system in scope, or a supplier model with no agreed responsibilities. Leave time to act, but not so long that parts of Stage 1 must be repeated.

Step 9: the Stage 2 certification audit

Stage 2 tests whether the AIMS is implemented and effective across the whole scope. Auditors interview the people who design, deploy and oversee the AI systems, trace one system from requirement through data, verification, deployment and monitoring, and check that controls marked applicable actually operate. Findings are graded as major or minor nonconformities, with opportunities for improvement noted separately. Our Stage 1 and Stage 2 guide goes through the audit days themselves.

Steps 10 and 11: closing findings and the certification decision

For every nonconformity you provide a correction, the root cause and a corrective action within the period the certification body sets. A major finding must be verified as closed before certification can be granted; for a minor one the body usually accepts your plan and checks it at the next audit. The decision is then taken by people at the certification body who were not on the audit team. The certificate names your organisation, the scope as agreed, the standard and edition, and its validity dates. It covers the management system, not a product, so calling a model "ISO 42001 certified" misuses it. Our nonconformities guide explains how findings are written and closed.

Step 12: surveillance, recertification and overall timing

The certificate runs for three years. Surveillance audits take place at least once a year, the first within twelve months of the decision, and a recertification audit before expiry starts a new cycle. AI systems change faster than most processes, so each surveillance visit will look at reassessments after change, new systems added to the inventory and incidents handled. Our surveillance and recertification guide covers that cycle.

Across all twelve steps, a first certificate typically takes four to eight months; organisations extending an existing ISO/IEC 27001 system sit at the shorter end. The timeline guide breaks that range down stage by stage.

ISO/IEC 42001 certification process: questions buyers ask