ISO 42001 timeline: how long ISO/IEC 42001 certification takes, stage by stage

How long ISO/IEC 42001 certification takes

Four to eight months covers most first certifications of an AI management system, from the first day of the gap analysis to the certification decision. A certified information security system, a clear AI inventory and a handful of systems in scope put you near four. Discovering which AI tools teams use, writing a risk method from nothing or governing several in-house models puts you near eight, sometimes beyond.

Three things fix the calendar, and extra consulting hours move none of them: risk and impact assessments approved before controls are chosen, controls operating long enough to leave records an auditor can sample, and a certification body able to fit two audit stages and a decision into its diary.

Stage by stage: durations and what moves them

The stages follow the hub's phases for an organisation with a few AI systems. They overlap, so the ranges do not add up.

What stretches or shortens an AIMS project

Five situations usually explain the difference between a four-month and an eight-month plan.

• An unknown AI estate. The first weeks go on finding the AI in use, including tools departments bought themselves; the scope waits for that list.
• Impact assessments started late. Impact assessment results feed the risk assessment, so leaving them until later delays the Statement of Applicability. AI system impact assessment, with ISO/IEC 42005 explains the method.
• Third-party models. Responsibilities and information must be agreed with the model's supplier, and contract changes often take longer than any internal task.
• Frequent change. Assessments are repeated at planned intervals and on significant change; a team shipping updates every fortnight needs that trigger working early.
• An existing ISMS. Document control, internal audit, management review and corrective action already operate, so the build concentrates on AI. ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS sets out what carries over.

The operating period before Stage 2

The certification rules test readiness rather than counting weeks. At Stage 1 the certification body evaluates whether you are prepared for Stage 2 and whether internal audits and management reviews are planned and being carried out; at Stage 2 it looks for an AI management system that is implemented and effective. Only records answer those questions: approved assessments, a Statement of Applicability that matches the risk register, data provenance and quality checks, validation results, event logs and agreed supplier responsibilities.

Plan on about three months of operation, rarely fewer than two. A model retrained twice a year may not complete a cycle before the audit; show the trigger, the procedure and the latest instance instead. Assessments written after the event are easy to recognise and cost more credibility than a short history.

What runs in parallel, and what has to wait

Weeks are saved by overlapping independent work:

• Records start as each control is agreed.
• The certification body is quoted, checked and contracted during the build, so its booking lead time runs beside your preparation.
• Training runs alongside, with internal auditors trained before the audit programme begins. ISO/IEC 42001 training: who needs what, and the competence evidence covers the detail.

The rest is a chain. Controls depend on the approved treatment plan, the internal audit needs operating records, the management review needs the audit results, and the certification body's audits need both. ISO/IEC 42001 implementation plan: phases, owners and deliverables turns the chain into phases with owners.

The certification body's lead times

Checking and quoting. Accredited ISO/IEC 42001 certification is newer than for the established standards: bodies are accredited against ISO/IEC 17021-1 with ISO/IEC 42006, published in July 2025. Before comparing quotes, confirm who accredited each body for this standard and check that accreditation body's public register. Choosing an ISO/IEC 42001 certification body: accreditation and ISO/IEC 42006 explains the checks.

Booking. Allow six to ten weeks from contract to the first Stage 1 date, and more where your sector, language or location narrows the pool of AIMS auditors.

Between and after the stages. Three to six weeks between Stage 1 and Stage 2 leaves time to close Stage 1 concerns. After Stage 2, allow two to six weeks for responses and a decision by people outside the audit team. If closure of a major nonconformity cannot be verified within six months of the last day of Stage 2, ISO/IEC 17021-1 requires another Stage 2. ISO/IEC 42001 Stage 1 and Stage 2 audits: what auditors check covers the audits themselves.

A worked calendar: three AI systems and an existing ISMS

The example: a 150-person software company certified to ISO/IEC 27001, with three AI systems in scope (a recommendation feature on its own model, a support assistant on a supplier's model and a bought-in recruitment screening tool) and an AIMS lead with two days a week. Weeks count from kick-off.

The decision lands about six months after kick-off. Without the ISMS the build would run longer, and a late Stage 1 date, a major nonconformity or slow supplier answers would move it too. Drive™, where our consultants carry the agreed consulting and documentation work, can compress weeks 3 to 10; it cannot compress the operating period.

ISO/IEC 42001 timeline: questions buyers ask