ISO 42001 certification body: how to choose one, check its accreditation and read ISO/IEC 42006

What does accreditation prove about an ISO 42001 certification body?

Accreditation is the check on the checker. An accreditation body examines a certification body's impartiality, the competence of its auditors and decision-makers, and the way it plans audits and reaches decisions, then keeps examining it for as long as the accreditation runs. The baseline for every management system standard is ISO/IEC 17021-1; for AI a second document now sits on top.

ISO/IEC 42006:2025, published by ISO and IEC in July 2025, sets out the additional requirements for bodies that audit and certify an AIMS against ISO/IEC 42001. It supplements ISO/IEC 17021-1 rather than replacing it, and it is written for two readers: the certification bodies that audit AI management systems and the accreditation bodies that assess those certification bodies.

Recognition between accreditation bodies now runs through Global Accreditation Cooperation Incorporated (Global ACI), which took over from IAF and ILAC on 1 January 2026. Certificates under a recognised body's accreditation are meant to be accepted across borders, though a regulator or customer can add conditions.

Why accredited ISO/IEC 42001 certification needs extra care

ISO/IEC 42001 was published in December 2023 and ISO/IEC 42006 only in July 2025, so accredited AIMS certification is far newer. Accreditation bodies ran pilot programmes, the first AIMS accreditations were announced from September 2025 onwards, and at least one was first granted against the draft of ISO/IEC 42006 and then moved to the final edition.

Three consequences follow for a buyer:

• Fewer accredited options. In some countries the AIMS shortlist is short, and auditor availability can set your Stage 1 date.
• Pending accreditation. Some bodies are still being assessed. Ask whether the certificate you receive will carry an accreditation mark on the day it is issued, and what happens if it will not.
• Unaccredited AI certificates. Documents titled "AI certified", "responsible AI compliant" or "ISO 42001 aligned", issued without accredited AIMS certification behind them, cost little and fail the first time a customer checks them.

Our guide to the ISO/IEC 42001 certification process sets out where the choice of body sits in the full sequence.

How to check an ISO 42001 certification body's accreditation

Check from sources the certification body does not control.

1. Ask for three facts in writing. The legal entity that will issue your certificate, the accreditation body that accredited it for ISO/IEC 42001, and the accreditation number.
2. Confirm the accreditation body is recognised. Look it up on Global ACI's published list of recognised accreditation bodies and read the scopes shown on its profile. A body that is absent from the list offers no internationally recognised accreditation.
3. Read the scope of accreditation. On the accreditation body's own register, check that the certification body's entry names ISO/IEC 42001, refers to ISO/IEC 42006, and shows the accreditation as current rather than suspended or withdrawn.
4. Search IAF CertSearch. The global database of accredited management system certifications has kept its IAF name. Look for AIMS certificates the body has already issued; a body with none yet is not disqualified, but you would be among its first clients.

Checking a supplier's or competitor's certificate is a related but separate task, covered in our guide on how to verify an ISO/IEC 42001 certificate.

Auditor competence for AI management systems

ISO/IEC 17021-1 requires an audit team with the competence your scope demands, and ISO/IEC 42006 adds requirements specific to bodies auditing an AIMS. In practice the auditor must follow your AI risk assessment, judge whether an impact assessment for a recruitment model is real, and test the justifications in your Statement of Applicability without being led.

Ask each shortlisted body about the people, not the brand:

• Who would lead the Stage 1 and Stage 2 audits, and how many ISO/IEC 42001 audits have they led?
• What experience does the team have with your kind of AI system and your role for it, whether you develop, provide or use it?
• How will the auditor examine evidence held by a third-party model provider or a cloud platform?

If you already hold ISO/IEC 27001 certification, ask whether the body can audit both systems together. ISO/IEC 17021-1 counts a combined audit among the factors in audit time; the extension route itself is explained in our guide on extending an ISMS into an AIMS.

What an ISO 42001 certification quote should state, and three compared

ISO/IEC 17021-1 requires the certification body to record the audit duration and its justification. A quote you can rely on therefore shows the certifying entity and its AIMS accreditation, the AI systems, roles, sites and headcount it was priced on, auditor days for Stage 1, Stage 2, each annual surveillance audit and recertification, the travel basis, every other fee, and what a follow-up visit for a major nonconformity would involve. Our guide to ISO/IEC 42001 certification cost explains how each of those lines moves the fee.

The three quotes below are illustrative composites for one organisation with four AI systems in scope and an existing ISMS. They are not real bodies or real offers.

Quote A is the one to negotiate from because every line can be checked. Quote C is cheap because the audit, the accreditation and the cycle have been left out.

Warning signs when choosing an AIMS certification body

• A certificate promised in advance. The certification decision is taken after the audit, by people who were not on the audit team; nobody can promise its outcome.
• No Stage 1. ISO/IEC 17021-1 requires every initial certification audit to run in two stages. What happens in each is covered in our guide to Stage 1 and Stage 2 audits.
• An offer to write your AI policy and then certify it. A certification body may not provide management system consultancy; one that does has a conflict of interest.
• No surveillance. Accredited certificates are maintained through audits in every calendar year of the three-year cycle, not through a renewal invoice.
• Accreditation you cannot find on Global ACI's list, on the accreditation body's register or in IAF CertSearch, or an accreditation that covers other standards but not ISO/IEC 42001.

Where Sterling stands in the choice

Sterling does not certify. The accredited certification body you select audits your AIMS and decides on certification, and that choice remains yours. Our role is to make it an informed one.

Choosing an ISO 42001 certification body: questions buyers ask