How to verify an ISO/IEC 42001 certificate, and spot a fake or misleading one

Where to verify an ISO/IEC 42001 certificate

A certificate image is the easiest part of an AI governance claim to fake. Treat the PDF as a pointer and confirm it at four sources you open yourself, never through a link or QR code printed on it.

1. IAF CertSearch

IAF CertSearch kept its name after Global ACI took over the international accreditation arrangements. Search it by organisation name or certificate number, and set alerts for suspension, withdrawal or expiry. Its records come from certification and accreditation bodies, so a missing ISO/IEC 42001 entry is a question for the issuer, not yet a verdict.

2. The certification body's register

The body that issued the certificate is the authority on its status. Use its register, or write through contact details from its own website, to confirm status, legal entity and scope.

3. The accreditation body's directory

An accredited certificate carries the accreditation body's symbol and the certification body's accreditation number. Look that number up in the accreditation body's public directory and read the scope of accreditation: it should list ISO/IEC 42001 under ISO/IEC 17021-1, with ISO/IEC 42006 as the additional requirements for AIMS certification.

4. Global ACI's recognised accreditation bodies

Accreditation bodies are recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA on 1 January 2026. Global ACI does not accredit certification bodies itself. Confirm that the accreditation body behind the certificate appears on its list; an accreditation body that does not gives the certificate no internationally recognised standing.

Why accreditation deserves a second look for ISO/IEC 42001

A well-known certification body is not necessarily accredited for this standard. ISO/IEC 42001 was published in December 2023, and ISO/IEC 42006, which sets the extra rules for bodies auditing and certifying AI management systems, followed in July 2025. Accreditation programmes have been opening since.

A genuine certificate from a reputable body may therefore sit outside its accreditation; accreditation for ISO 9001 or ISO/IEC 27001 does not extend to an AIMS certificate. Ask the certification body:

• Which accreditation body has accredited you for ISO/IEC 42001, and under what accreditation number?
• Does that accreditation apply ISO/IEC 42006?
• Was this particular certificate issued under that accreditation, and does it carry the accreditation symbol?

A certificate issued without accreditation is not automatically a forgery, but it rests only on the issuer's own word. Our guide to choosing an ISO/IEC 42001 certification body covers accreditation from the buyer's side of the table.

What a genuine ISO/IEC 42001 certificate shows

Accredited certificates follow ISO/IEC 17021-1. Expect to find:

• The issuer: the certification body's name and address.
• The accreditation symbol and number: traceable to an accreditation body's directory.
• The certified organisation: its legal name and location, or a site schedule for several sites.
• The standard and edition: ISO/IEC 42001:2023, the first and only edition; there is no amendment and no later version.
• A scope statement: the AI systems, activities and sites inside the AIMS, written clearly enough to test against the service you receive.
• Identifiers and dates: a unique certificate number, the issue date and an expiry that fits a three-year cycle.

Annual surveillance audits keep a certificate valid; our guide to ISO/IEC 42001 surveillance and recertification explains that cycle.

Reading the scope: which AI systems, and which role

An AIMS is drawn around chosen AI systems and around what the organisation does with each: develops it, provides it to customers or uses it internally. One valid certificate may cover a product's AI features, another only staff use of a chatbot. Check:

• Is the AI product or service you receive named in the scope, or clearly included by a general description?
• Is the supplier's role stated, and does it match what the supplier does for you, for example developing and providing the model rather than only using it?
• Are the teams, sites and hosting environments that run that system inside the boundary?
• If the supplier builds on a third-party model, does its AIMS show how that supplier is controlled? Annex A group A.10 covers third-party and customer relationships, and clause 8 requires control of externally provided processes, products and services.

The Statement of Applicability justifies which of the 38 Annex A controls apply; a summary is a fair customer request. Our ISO/IEC 42001 scope guide explains how scope should be written in the first place.

Signs of a fake or misleading ISO/IEC 42001 certificate

Problem certificates are forged, unaccredited, or genuine but narrower than the holder's marketing. Watch for:

• An edition that does not exist: "ISO 42001:2024" or any year other than 2023.
• Accreditation that cannot be traced: no symbol, a number the accreditation body does not recognise, or a claim of accreditation "by ISO", "by IAF" or "by Global ACI".
• An issuer accredited for something else: ISO 9001 or ISO/IEC 27001 accreditation used to lend weight to an AIMS certificate.
• A product or model called certified: ISO/IEC 42001 certifies an organisation's management system, not an algorithm, a dataset or an app.
• Regulatory claims on the certificate: wording such as "EU AI Act certified" or "AI Act compliant"; our guide to ISO/IEC 42001 and the EU AI Act explains why the certificate does not give that.
• The wrong entity or a thin scope: a parent company, an affiliate or a trading name, or a scope limited to internal productivity tools.
• A consultant as certifier: a certificate issued by the firm that built the AIMS; accredited certification bodies do not consult on the systems they certify.
• An impossible calendar: certification in days or a couple of weeks, no Stage 1 readiness review, no Stage 2 audit and a guaranteed outcome.

The calendar test is the most reliable: risk and impact assessments, operating controls, an internal audit and a management review take months to produce evidence an auditor can sample. A certificate obtained without that work leaves the gaps open.

ISO/IEC 42001 certificate verification checklist

Keep a dated record of each check and its source in the supplier file, and repeat the status checks every year.

What to do when a certificate fails a check

A single mismatch is not proof of fraud: certificates are renumbered, transferred between bodies and reach registers late.

1. Ask the supplier first for the current certificate and the certification body's name.
2. Contact the certification body directly, using details you looked up yourself, and ask for written confirmation of validity, entity and scope. Audit reports are confidential, so do not expect a copy.
3. Report a forgery, meaning a certificate the named body never issued or one altered after issue, to that body and to the accreditation body whose symbol appears on it. Keep the evidence and take legal advice.
4. Treat an unaccredited, expired or out-of-scope certificate as a risk decision: added safeguards, your own assessment, a dated commitment to accredited certification, or another supplier.

Verifying ISO/IEC 42001 certificates: questions buyers ask