How does ISO 42001 certification work?
ISO 42001 certification follows a defined process, starting with a gap analysis and ending with certificate issuance. The certification stages check different parts of your AI management system, and the requirements continue throughout the three-year certification cycle.
Key points at a glance
- Certification starts with Stage 1, which checks whether your organisation is ready. Stage 2 then assesses the management system against ISO 42001. The stages usually take place several weeks apart, giving you time to address gaps identified during Stage 1.
- Initial certification commonly takes six to twelve months from a standing start. Existing ISO 27001 controls, management systems and audit routines can shorten the preparation period.
- Quoted audit days include more than time spent interviewing staff and checking evidence. Auditors carry out about three quarters of the work, with the remaining time covering planning, reporting and certification administration.
- A certificate follows a three-year cycle. Surveillance audits take place in years two and three, followed by recertification. The process then begins again for the next cycle.
- The certification body must hold accreditation specifically for ISO 42001. ISO 27001 accreditation, or accreditation for another standard, does not cover ISO 42001. Accreditation bodies assess certification bodies against ISO/IEC 42006, which defines accreditation requirements for ISO 42001 certification.
What happens between the audit stages
Your management system needs to be working before the certification body carries out its full assessment. An independent auditor first checks whether you are ready, then examines how the system operates in practice.
Organisations often underestimate the work needed for Stage 2. The auditor will expect your internal audit cycle to be complete, your management review to have taken place and your AI system impact assessment to reflect the systems you actually operate.
Last-minute document drafting will not be enough. Documents support the assessment, but they do not create a functioning management system. Certification generally takes months, and rarely takes only a few weeks.
Successful organisations receive a certificate that remains valid for three years. The certification body then carries out surveillance visits during years two and three to check that the management system continues to work effectively.
The six steps to ISO 42001 certification
Optional, but generally useful. A consultant or prospective certification body compares your existing arrangements with ISO/IEC 42001, including your scope, risk assessment, AI system impact assessment, internal audit and management review. The firm that prepares you cannot later audit its own work, so keep consultancy separate from certification.
The certification body reviews your documented management system and checks whether you are ready for the full audit. It examines the scope, risk assessment, AI system impact assessment, internal audit and management review. Stage 1 is also the point at which the body checks that the system is ready to be assessed in practice.
Stage 2 is the full certification audit and usually follows Stage 1 by several weeks. Auditors interview personnel, examine evidence and test how the management system operates. They compare the documented system with actual practice and raise findings where the two do not meet ISO/IEC 42001. You can correct findings between the stages, but blocking nonconformities must be closed before certification.
The certification body issues the certificate after you close any blocking nonconformities. A valid certificate names ISO/IEC 42001 and identifies the accreditation body. The normal certificate period is three years.
The certification body conducts shorter surveillance audits during years two and three. These visits check that the management system continues to work effectively. Annual surveillance pricing varies with scope. Tempo Audits is the only body in this study with published prices, listing £1,600 to £9,000 a year.
After three years, you apply for recertification. The certification body repeats the full audit and already understands your system history. Recertification usually costs less than initial certification when the management system is established.
How long does ISO 42001 certification take?
-
Months 1-4
Build the management system
Define the certification scope, develop the policy and carry out your AI risk and impact assessments. You then choose the applicable controls and document the management system. This is the system-building phase. Rushing it can leave gaps that take longer to correct later.
-
Months 4-6
Run the system and gather evidence
Operate the management system long enough to produce practical evidence that it works as intended. Complete an internal audit and hold a management review.
-
Months 6-9
Complete the certification assessment
Your certification body begins its assessment with Stage 1. It reviews your documented processes and checks whether you are ready for the full certification audit. Stage 2 follows several weeks later. The auditors interview people, examine documented evidence and carry out audit activities. Together, Stage 1 and Stage 2 form the certification assessment.
-
Months 9-12
Resolve findings and receive the certificate
Use this stage to resolve any nonconformities raised during the assessment. Once the certification body has verified the required corrections, it issues your ISO 42001 certificate.
What happens if the auditor finds a problem?
Auditors raise nonconformities when your management system does not meet a requirement of ISO/IEC 42001.
A minor nonconformity means the system has not achieved its intended operation in a specific area. The certification body usually gives you time to correct it. You send evidence of the correction, and a return visit is not usually required.
A major nonconformity means a requirement remains unmet. At Stage 2, this delays certification until you take corrective action and the certification body verifies that you have resolved the issue. It does not necessarily mean the assessment has failed permanently, although resolution can take several weeks.
That delay may affect a customer commitment or regulatory deadline. Ask prospective certification bodies how they handle major findings, how they verify corrections and whether follow-up work carries an additional day rate. Their procedures can differ more than their prices.
Questions about ISO 42001 certification
Can the same company prepare us for ISO 42001 and certify us?
+
Use separate providers for preparation and certification. Accreditation rules prohibit a certification body from auditing work it prepared itself, so a consultancy that helps you build your management system cannot certify that same work. You can use a consultancy or a certification body for readiness support, then appoint a different certification body for the independent audit.
What happens if we fail Stage 2?
+
A major nonconformity during Stage 2 means certification is suspended until you correct the issue and the certification body verifies the correction. You must complete corrective action and provide evidence. Resolution usually takes several weeks, but Stage 2 does not normally restart from the beginning.
How many audit days will ISO 42001 certification require?
+
Audit days depend on your employee count, number of sites and the AI systems within the certification scope. Ask each certification body for the total number of audit days, its daily audit rate and the amount of that time spent directly with the auditor. Those figures make quotes easier to compare.
Can we certify one product rather than the whole organisation?
+
You define the certification scope with the certification body. It can cover a single product or a wider part of the organisation. A narrower scope may reduce the audit time and cost, provided it accurately describes the AI management system you want certified. Check that the scope also satisfies the customers asking for certification.
Do enterprise customers require ISO 42001 certification?
+
Enterprise customers do not generally require suppliers to hold ISO 42001 certification, but enterprise buyers increasingly ask about it during supplier due diligence. A certificate gives you a clear response when a buyer asks how you govern AI. It may also reduce the need for additional buyer meetings about your AI management system.
Compare the bodies before requesting quotes
We assess their accreditation, pricing, audit timing and approach to scoping the work, then apply the published weights for the buyer type. Use the results to create a shortlist. Request quotes from those bodies afterwards, with the same scope and organisation details each time so the proposals are easier to compare.