ISO 42001 Stage 1 and Stage 2 audit: what auditors check, day by day

Why an AIMS audit comes in two stages

ISO/IEC 17021-1, the standard every accredited certification body works to, requires the initial certification audit of any management system to run in two stages. For an artificial intelligence management system, ISO/IEC 42006:2025 adds further requirements on top of it for the bodies that audit and certify against ISO/IEC 42001.

Stage 1 confirms the foundations; Stage 2 tests the building. The wider route, from gap analysis to certificate, is set out in the ISO/IEC 42001 certification process guide, and how to select the body in choosing an ISO/IEC 42001 certification body.

Stage 1: the readiness review of your AIMS

Stage 1 is the certification body's readiness review. It is not Sterling's gap analysis and not the free online readiness check: the auditor records concerns but does not design your fixes. What the auditor asks for follows the Stage 1 objectives in ISO/IEC 17021-1, read against the text of ISO/IEC 42001.

Three points draw most of the auditor's attention. First, does the risk register agree with the Statement of Applicability, so that every control marked applicable answers an identified risk and every exclusion is justified? Second, is there an impact assessment for each system in scope, and have its results been considered in the risk assessment, as clause 6.1.4 requires? Third, has designated management approved the treatment plan and the acceptance of residual AI risk under clause 6.1.3?

The certification body must tell you in advance which Stage 1 activities it will carry out on site. Stage 1 ends with documented conclusions and any areas of concern that could become Stage 2 nonconformities.

The interval before Stage 2

The body sets the gap between the stages with your need to resolve those concerns in mind, and it may change the Stage 2 arrangements because of what it found. Close every concern with evidence rather than a promise. You receive the Stage 2 plan and the audit team's names beforehand.

Stage 2: implementation and effectiveness

Stage 2 evaluates whether the AIMS is implemented and effective across the scope. ISO/IEC 17021-1 requires it to cover conformity with all the requirements of the standard, performance monitoring against key objectives, legal and contractual compliance, operational control, internal audit and management review, and management responsibility for the policies. For ISO/IEC 42001 that means the auditor stops reading method documents and starts following systems.

• Life-cycle trails. One AI system is traced from its requirements and design records through verification and validation, deployment, operation and monitoring, and its event logs.
• Data trails. Where training and test data came from, how its quality and provenance were checked and how it was prepared.
• Reassessment on change. Clauses 8.2 and 8.4 require risk and impact assessments to be repeated at planned intervals or on significant change. A model retrained or replaced since Stage 1 is a natural test.
• Treatment effectiveness. Clause 8.3 asks you to verify that treatments worked; the auditor looks for that verification, not just the action.
• Third parties. For a supplied model or platform, how responsibilities were allocated and the component is controlled.

Effectiveness is the harder test. A completed impact assessment shows implementation. An impact assessment that changed a design decision, a deployment limit or the information given to users shows effectiveness. The questions auditors typically put to each role are gathered in our ISO/IEC 42001 audit questions guide.

A typical Stage 2 for an AIMS, day by day

The certification body sets the audit time from your scope, the AI systems within it, headcount and locations, under its accreditation rules. The table below is an illustration only: three days, one auditor, one office, cloud tooling reviewed on screen. Your audit plan decides the real order.

Leadership usually comes first because the AI policy and objectives frame every later question. The auditor picks samples from lists you supply, so keep the inventory current up to the morning of the audit.

How findings are raised and who decides

A nonconformity is written against a specific requirement of ISO/IEC 42001, with a statement of what is wrong and the objective evidence. The auditor discusses it with you to confirm the facts; that is the moment to produce a record the auditor has not seen. The auditor may not suggest the cause or the remedy, which protects the impartiality of the audit. Findings are graded as major, where the system's capability to achieve its intended results is affected, or minor, where it is not; opportunities for improvement are noted separately where the scheme allows.

At the closing meeting you hear the conclusions and the recommendation, and you are told that the evidence came from a sample, how findings affect certification and the deadline for your correction and corrective action plan. Competent people at the certification body who were not on the audit then decide. Every major nonconformity must be corrected, with its corrective action accepted and verified, before a certificate can be issued; plans for minor ones must be accepted. Grading and closure are covered in our ISO/IEC 42001 nonconformities guide, and the surveillance that follows in the surveillance and recertification guide.

ISO 42001 Stage 1 and Stage 2 audits: questions buyers ask