ISO 42006 accreditation and requirements: the test behind every AI management system certificate.

What it is

What is ISO 42006 and what is it used for?

ISO/IEC 42006 is the international standard that lays down additional requirements for bodies that audit and certify artificial intelligence management systems, the AIMS defined by ISO/IEC 42001. It does not stand alone. Every management system certification body already works to ISO/IEC 17021-1; ISO/IEC 42006 adds the rules specific to AI, because auditing how an organisation governs data quality, risk, transparency and ethics in its AI systems needs knowledge that a general management system auditor may not have.

Its users are certification bodies that want to issue ISO/IEC 42001 certificates, and the accreditation bodies that decide whether those certification bodies qualify. For an organisation seeking certification, its value is indirect but real: it tells you what a competent AIMS audit should look like, which people should be doing it, how the audit duration should be worked out and what the certificate should state. A body that cannot show it meets ISO/IEC 42006 gives you a document, not assurance.

Current edition. ISO/IEC 42006:2025, published in July 2025 by ISO and IEC through their joint committee on artificial intelligence, is the first edition. No amendment has been published. Accreditation bodies have been bringing it into their AIMS accreditation programmes alongside ISO/IEC 17021-1; ask any body you shortlist whether its accreditation for ISO/IEC 42001 already covers the 2025 edition of ISO/IEC 42006.

Who it is for

Who needs to care about ISO/IEC 42006?

Certification bodies must meet it. Everyone who pays for, relies on or is asked for an ISO/IEC 42001 certificate has a reason to understand it. Organisations raise ISO/IEC 42006 with Sterling from four starting points:

• A customer wants an accredited AI management system certificate. Enterprise buyers may ask suppliers how their AI is governed. If the request says "accredited", the body you choose must hold accreditation for ISO/IEC 42001, assessed against ISO/IEC 42006.
• A tender or procurement questionnaire tests the certificate. Evaluators check the issuing body, the accreditation mark and the scope wording. A certificate from a body outside the accredited route can cost you the bid after the money is spent.
• Regulators and boards are asking how AI risk is overseen. A certificate issued under ISO/IEC 42006 is easier to defend, because the audit behind it was run to a common international benchmark for competence and audit method.
• Group companies need one approach across countries. Subsidiaries in different markets may be quoted by different bodies. ISO/IEC 42006 gives the group one yardstick to compare them and to agree one route for every entity.

Understanding ISO/IEC 42006 does not replace the work of building your AI management system. It makes sure the audit at the end of that work is one your stakeholders will accept.

Requirements

What are the main ISO 42006 requirements?

ISO/IEC 42006 follows the clause structure of ISO/IEC 17021-1, so a certification body reads the two side by side. After the scope, references and terms, the requirements sit in clauses 4 to 10, with three annexes. The summary below is at title level; the obligations fall on the certification body, not on you.

• Clause 4 Principles: the principles that underpin credible third-party certification, applied to AI management systems.
• Clause 5 General requirements: legal and contractual matters, management of impartiality including conflicts of interest, and liability and financing.
• Clause 6 Structural requirements: how the certification body is organised to deliver AIMS certification.
• Clause 7 Resource requirements: competence of personnel, with generic and specific technical competence requirements; demonstration of knowledge and experience; use of external auditors and technical experts; personnel records; outsourcing.
• Clause 8 Information requirements: public information, AIMS certification documents, reference to certification and use of marks, confidentiality including access to the client's documentation, and information exchange with clients.
• Clause 9 Process requirements: the certification process, from pre-certification activities through to client records.
• Clause 10 Management system requirements for certification bodies: the certification body's own management system.
• Annexes: Annex A on audit time, which is normative; Annex B with worked examples of audit time calculations; Annex C with a template for a certification document.

Certification process

How does ISO/IEC 42006 shape your ISO/IEC 42001 certification?

Two separate assessments stand behind an accredited AIMS certificate. The accreditation body assesses the certification body; the certification body audits you. ISO/IEC 42006 connects the two, and Sterling stays on your side of that line throughout.

1. 01
   The certification body seeks accreditation for AIMS.It applies to an accreditation body for ISO/IEC 42001 within its scope and builds its competence rules, audit time method and certificate format to ISO/IEC 42006.
2. 02
   The accreditation body assesses and decides.Its assessors test the body against ISO/IEC 17021-1 with ISO/IEC 42006, then grant accreditation for a defined scope and keep it under surveillance.
3. 03
   You build your AIMS and choose the body.Implement ISO/IEC 42001 in practice, then shortlist bodies whose accreditation covers it and compare their audit time, audit team and scope wording.
4. 04
   The certification body audits your AI management system.A Stage 1 readiness review, then the Stage 2 audit of implementation and effectiveness, planned and staffed to ISO/IEC 42006; the body alone decides.
5. 05
   The certificate is issued and maintained.The certification document follows the standard's rules for AIMS certificates, with surveillance at least once each calendar year and recertification in a three-year cycle.

Check the route before you sign. Ask which accreditation body has accredited the certification body for ISO/IEC 42001, then look it up yourself on that accreditation body's public register and confirm the scope. Recognition across borders runs through the Global ACI arrangement, which lists the recognised accreditation bodies. Treat "AI certified in two weeks" offers with caution. The certification buyer's checklist

Cost

What drives the cost of an ISO/IEC 42001 certification audited to ISO/IEC 42006?

ISO/IEC 42006 has a direct effect on cost: it governs how much audit time a certification body plans and who it sends. A lower quote that skips either is not a saving. Every component in a Sterling proposal is visible and nothing is added later.

Timeline

How long does ISO/IEC 42001 certification take with an accredited body?

As an estimate, four to eight months from the first workshop to the certification decision. The AI management system has to run long enough to produce evidence, and accredited AIMS certification is still new, so the certification body's audit dates can set the pace.

Book the certification body early. Checking its accreditation and audit time up front avoids a late switch that resets the calendar.

Your engagement

What your ISO/IEC 42001 engagement includes

Sterling OS™ runs every engagement. Sterling does not certify or accredit, and is not a certification body: the accredited certification body audits your AI management system and makes the decision. Our part is a system that works and a clear view of which body can credibly audit it.

• Design™: guided support

  Your team writes the AI policy, assessments and procedures; a Sterling consultant sets the method, reviews every output and coaches the owners.

• Drive™: managed support

  The alternative to Design™ when time is short: Sterling drafts the system with your people and runs the programme through to certification.

• Certification body due diligence

  Accreditation, scope, audit time and audit team of each shortlisted body checked against ISO/IEC 42006 with you before you sign.

• Sustain™: after certification

  Reassessments as AI systems change, internal audits and surveillance preparation.

• Automate™: Effivity

  Your AI management system runs in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Certification decisions remain with the independent certification body.

Often combined with

Standards organisations pair with ISO/IEC 42006

• CAP accreditationCAP accreditation readiness for laboratories: checklist gap analysis, method records, self-inspection and peer inspection support.
• EU AI ActEU AI Act compliance consulting: classify each AI system, document high-risk requirements and transparency duties, and prepare conformity assessment evidence.
• ISO 10012ISO 10012 Measurement Management certification consulting: measurement processes and equipment controlled for valid results, ready for a certification audit.
• ISO 14065ISO 14065 accreditation and requirements for bodies verifying environmental information: GHG statements, footprints, the route, cost and timing factors.
• ISO 15189ISO 15189 accreditation consulting for medical laboratories: quality and competence for reliable, timely results, prepared for the accreditation assessment.
• ISO 15190ISO 15190 laboratory safety for medical labs: gap and risk assessment, procedures, training and internal audit alongside ISO 15189.