ISO/IEC 42001 Certification: How the Audit Process Works

ISO/IEC 42001 certification gets described as if it were a single audit with a pass or fail result. It is closer to a three-year relationship with a certification body, and the structure of that relationship determines how you should prepare. Understanding the sequence before you start is the cheapest way to avoid a failed audit.

Who certifies you

Certification is carried out by an accredited certification body, not by ISO. Accreditation for AI management system certification is relatively new, and commentary indicates that the first accreditations arrived across 2025 and 2026, so check that any body you consider is accredited for ISO/IEC 42001 specifically, rather than only for other management-system standards. ISO/IEC 42006, which sets requirements for bodies that audit AI management systems, is the relevant reference. Sources differ on its publication status, so confirm it with the standards body or your accreditation authority.

Stage 1: the readiness review

Stage 1 is largely a documentation and readiness check. The auditor looks at your defined scope, your AI policy, how you assess AI risks and impacts, your statement of applicability for the Annex A controls, and whether the management system is mature enough to audit. It frequently ends with findings that you must close before Stage 2. Stage 1 is also where scope problems surface: drawing the boundary too narrowly so it excludes your real AI systems, or too broadly so it commits you to controls you cannot evidence.

Stage 2: does the system actually run

Stage 2 tests whether what you documented operates in practice. The auditor samples evidence: records of risk and impact assessments, how AI systems moved from design to deployment, internal audit results, management review minutes, competence and training records, and corrective actions. The common failure here is a management system that exists on paper but has no history, such as no internal audit completed and no management review held before the audit. Both are required inputs, so schedule them before Stage 2, not after.

Commentary puts the gap between Stages 1 and 2 at roughly four to twelve weeks, with a long gap forcing a repeat of Stage 1. Treat those numbers as typical rather than fixed, and confirm timing with your chosen body.

After certification: surveillance and recertification

A certificate is typically valid for three years. During that period the certification body returns for surveillance audits, commonly annually, which look at a sample of the system and at how you closed previous findings. At the end of the cycle, a recertification audit covers the whole system again. The practical consequence: certification is not a project that ends. The internal audits, management reviews and corrective actions need to keep running, or the next surveillance audit will find a system that has stopped.

How to prepare

1. Run a gap assessment first. Compare yourself against both the clause 4 to 10 management-system requirements and the Annex A controls. See how to run one.
2. Reuse what you have. If you already hold ISO 27001 or similar, document control, internal audit, management review and corrective action processes largely transfer.
3. Complete an internal audit and a management review before Stage 2, and keep the records.
4. Choose scope deliberately. Include the AI systems you actually build or deploy, and be able to explain any exclusion.
5. Keep evidence of operation, not just policies: assessment records, approvals, monitoring results.

What certification does and does not do

ISO/IEC 42001 is a voluntary standard, and certification does not by itself establish compliance with any law. It can help evidence the governance and risk-management processes that regulation increasingly expects. See our overview of ISO/IEC 42001 for what the standard covers, and how it compares with the NIST AI RMF. We have not covered costs or specific audit durations here, because published figures vary widely by scope and certification body; ask the body for a quote against your own scope.