ISO 42001 surveillance audit and recertification: the ISO/IEC 42001 three-year cycle, year by year

How does the ISO 42001 surveillance cycle work?

ISO/IEC 42001 sets requirements for your AI management system; it says nothing about how often an auditor returns. That rule comes from ISO/IEC 17021-1, which accredited certification bodies follow, supplemented for AIMS by ISO/IEC 42006 (July 2025). Under it, a certificate lives in a three-year cycle: surveillance at least once a calendar year in years one and two, then a recertification audit in year three, finished before the certificate expires. The first surveillance visit may come no later than 12 months after the certification decision.

The printed expiry date holds only while each audit takes place on time and its findings are closed. Sterling does not certify: your independent, accredited certification body plans the audit programme, carries out the visits and decides whether certification continues.

What each year of the cycle asks of an AIMS

Visit length is set by the certification body under its accreditation rules for AIMS; ask for every visit's planned days in the quote.

What an ISO 42001 surveillance audit examines

Surveillance does not need to cover the whole system each time. ISO/IEC 17021-1 does, however, name a core that no visit may leave out:

• internal audits and management review;
• action taken on nonconformities from the previous audit;
• the handling of complaints;
• how well the system is achieving your objectives and intended results;
• progress of planned continual improvement;
• continuing operational control;
• changes since the last visit;
• use of marks and other references to certification.

For an AIMS, "changes since the last visit" carries unusual weight: models are retrained, data sources swapped and vendor versions released, and ISO/IEC 42001 requires the AI risk assessment (8.2) and the AI system impact assessment (8.4) to be repeated at planned intervals or when significant changes are proposed or occur. Auditors therefore tend to follow one changed system: was the change recognised, the impact assessment revisited and the risk assessment, treatment plan and Statement of Applicability updated? Where a treatment was put in place, clause 8.3 expects evidence that it worked.

The rest of the sample rotates across systems, Annex A groups and sites so that the programme reaches every requirement over the cycle. Findings are graded as at Stage 2. A major nonconformity must be corrected and verified within the period the body sets, or certification may be suspended; a minor one is normally followed up at the next visit. ISO/IEC 42001 nonconformities: major, minor and how to close them explains the response.

What recertification re-examines

Recertification looks back over the full cycle and then audits the entire AIMS on site. The body reviews the surveillance reports and asks whether the system still conforms and remains effective in the light of internal and external change, whether top management is still committed to maintaining and improving it, and whether it continues to deliver its objectives. Significant change to the AI estate can add a Stage 1.

The deadline is firm. The audit, and the correction and verification of any major nonconformity, must be complete before the expiry date, or the certificate is not extended. The body can restore certification within six months once the outstanding recertification activities are done; beyond that it requires at least a Stage 2 audit. Agree the dates at the second surveillance visit.

Changes to report to your certification body

Your certification agreement requires you to notify the body without delay of changes that could affect the system's ability to keep meeting the standard. ISO/IEC 17021-1 lists the categories; the AIMS examples in the table are ours.

Adding systems or sites to the certificate is a scope extension: the body reviews the request and decides how to verify it, sometimes during a surveillance visit, and the extension counts only once the certificate shows it. ISO/IEC 42001 scope: which AI systems and roles are in, and the mistakes that cost you covers how the wording is built.

Keeping the AIMS alive between audits

Twelve months of records show when a system only moves before a visit: every reassessment dated the same fortnight, or an inventory missing the chatbot marketing launched in spring. Five routines keep the evidence continuous.

• An inventory kept current. New AI tools, internal models and supplier features are added when adopted, with an owner and a role, not discovered at audit.
• Change triggers written down. A retrain, a new data source, user group or jurisdiction starts reassessment without debate.
• Internal audits spread across the year, covering clauses and Annex A controls over the cycle, by people who do not audit their own work. See ISO/IEC 42001 internal audit: auditing an AI management system.
• A management review that decides, on risks, resources and improvement, with owners and dates. See ISO/IEC 42001 management review: inputs, outputs and the record.
• Incidents and concerns traced to cause, with corrective action closed only when the measures show it held.

Editions and accreditation during the cycle

ISO/IEC 42001:2023 is the first edition, and as at September 2026 ISO lists no amendment or revision in progress, so no transition audit needs to be planned into the current cycle.

Accredited ISO/IEC 42001 certification is newer than for the established standards, so before recertification confirm that your certification body holds accreditation for this standard, against ISO/IEC 17021-1 and ISO/IEC 42006, on its accreditation body's public register. How to verify an ISO/IEC 42001 certificate, and spot a fake one shows where to look.

How Sterling's Sustain™ supports the cycle

Sustain™, the Sterling OS™ phase after certification, covers the work below as confirmed in your proposal.

ISO 42001 surveillance audit: questions buyers ask