ISO/IEC 42001 Certification Process: What It Actually Involves, Step by Step
Last updated: 27 October 2026
Key takeaways
- ISO does not certify companies. Certificates are issued by certification bodies, and their value depends on accreditation by a national accreditation body.
- The certification audit has two stages: Stage 1 checks readiness, Stage 2 checks whether the AI management system actually works.
- Before the audit, the company should complete at least one internal audit and one management review.
- The AI system impact assessment is what sets ISO/IEC 42001 apart from security standards such as ISO/IEC 27001.
- The certificate covers a three-year cycle, with surveillance audits at least once a calendar year.
- An ISO/IEC 42001 certificate is not proof of compliance with the EU AI Act.
Once a company decides that it needs ISO/IEC 42001, the next question is practical: what happens between “we want the certificate” and “we have it”? The standard itself only describes the AI management system. The audit is governed by two other documents that few people outside certification bodies read: ISO/IEC 17021-1, the general rulebook for management system audits, and ISO/IEC 42006, published in July 2025 specifically for AI. Knowing how they work tells you what auditors will actually look for.
Step 1: Choose an accredited certification body
ISO does not certify companies and does not accredit certifiers. Certificates are issued by certification bodies, and their value depends on whether a national accreditation body has checked them. A certificate from an unaccredited body may look the same but carries little weight with clients and regulators.
For ISO/IEC 42001, accreditation is still new. In the UK, the first certification body received accreditation for AI management systems in January 2026. In the UAE, the Emirates International Accreditation Centre (EIAC) has opened a scheme for ISO/IEC 42001 certification bodies based on ISO/IEC 42006. Before signing a contract, ask the certification body for its accreditation certificate and check that it covers ISO/IEC 42001 specifically, not only ISO/IEC 27001.
Step 2: Define the scope
ISO/IEC 42001 applies to any organisation that provides or uses products or services that rely on AI systems. The scope decides which AI systems, business units and locations the audit will cover, and in what role: developer, provider or user. A narrow scope makes the first audit easier, but clients will read the scope on the certificate. A certificate that covers only an internal HR tool says nothing about the AI product you sell.
Step 3: Build the management system
This is the longest stage, and it is where most of the work lies. The standard expects, at a minimum:
- an AI policy and measurable AI objectives, with clear roles and responsibilities;
- an AI risk assessment and a risk treatment plan;
- an AI system impact assessment, which looks at the possible consequences of AI systems for individuals, groups and society;
- a Statement of Applicability, which explains which Annex A controls you apply and why you exclude others.
The impact assessment is what sets ISO/IEC 42001 apart from security standards such as ISO/IEC 27001. A company can have excellent cybersecurity and still fail here if it has never asked how its AI affects the people it makes decisions about. Annex A controls cover areas such as data quality, the AI system life cycle, information for users and relationships with third-party suppliers.
Step 4: Run it and check yourself
A management system that exists only on paper will not pass. Before the certification audit, the company should complete at least one internal audit and one management review. This is not a formality: one of the purposes of the first audit stage under ISO/IEC 17021-1 is to evaluate whether internal audits and management reviews are planned and performed. In practice, this means the system has to run for some time before the auditors arrive.
Step 5: Stage 1 audit
The certification audit takes place in two stages. Stage 1 checks whether the company is ready: the auditors review the documentation, the scope, the risk and impact assessments and the results of the internal audit. The result is a report that lists issues which could become nonconformities in Stage 2. This is the cheapest moment to find problems, so it is worth taking the report seriously.
Step 6: Stage 2 audit
Stage 2 checks whether the system actually works. Auditors interview staff, review records and look at how specific AI systems were assessed, tested and monitored. Findings are classified as major or minor nonconformities. A major nonconformity blocks certification until the company has corrected it and the certification body has verified the correction. If this does not happen within six months of the last day of Stage 2, the certification body must repeat Stage 2. For a minor nonconformity, an accepted action plan is usually enough.
Step 7: Certification, surveillance and renewal
The certification decision is made by the certification body, not by the auditors themselves. The certificate covers a three-year cycle. Surveillance audits take place at least once a calendar year, and the first must happen no later than 12 months after the certification decision. Before the certificate expires, the company goes through a recertification audit. In other words, certification is not a one-off project but an annual commitment.
What ISO/IEC 42006 changes
Until 2025, certification bodies audited AI management systems under the general rules alone. ISO/IEC 42006 now adds requirements specific to AI: stricter competence requirements for auditors and other personnel, rules for calculating audit time, and rules on the certification body’s access to the client’s documentation. The Canadian accreditation body, for example, made it mandatory for new applications immediately after publication. For clients, this means auditors should understand AI, not only management systems, and audit time depends on the size and complexity of the AI scope.
If you already have ISO/IEC 27001
Companies certified to ISO/IEC 27001 can combine the two audits. Under the international rules for integrated audits, audit time is calculated for each standard and then added up, and it may be reduced by up to 20%, for example where auditors are competent in both standards. The shared management system structure also means that policies, internal audits and management reviews can be run once for both.
What certification does not give you
An ISO/IEC 42001 certificate is not proof of compliance with the EU AI Act. The European Commission has said that, although the standard helps to set up an AI management system, its goals and definitions are not aligned with the quality management system required under the AI Act. The certificate is good evidence of responsible AI governance, but it should not be presented as legal compliance.
What we recommend
- Choose the scope with your clients in mind: certify the AI systems they actually care about.
- Run the system long enough to complete at least one internal audit and one management review before Stage 2.
- Pay particular attention to the AI system impact assessment: it is the part most companies have never done before.
- Check the certification body’s accreditation for ISO/IEC 42001 before signing.
The bottom line
ISO/IEC 42001 certification is a cycle, not a single audit. The hard part is not passing Stage 2 but building a system that genuinely works and keeps working between surveillance audits. If you are planning certification, AMLzone can help you define the scope, build the AI management system and prepare for each stage of the audit.
Sources
1. ISO, “How to verify an accredited certification”. https://help.iso.org/en/articles/424922-how-to-verify-an-accredited-certification
2. UKAS, “UKAS grants first AIMS accreditation”, January 2026. https://www.ukas.com/resources/latest-news/ukas-grants-first-aims-accreditation/
3. Emirates International Accreditation Centre (EIAC), Certification Bodies. https://eiac.gov.ae/services/certification-bodies/
4. ISO, ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system. https://www.iso.org/standard/42001
5. ISO, ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system. https://www.iso.org/standard/42001
6. ISO/IEC 17021-1:2015 Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1, clause 9.3. https://www.iso.org/standard/61651.html
7. ISO/IEC 17021-1:2015 Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1, clause 9.3. https://www.iso.org/standard/61651.html
8. ISO/IEC 17021-1:2015, clauses 9.4–9.5. https://www.iso.org/standard/61651.html
9. ISO/IEC 17021-1:2015, clauses 9.1.3 and 9.6. https://www.iso.org/standard/61651.html
10. ISO, ISO/IEC 42006:2025; Standards Council of Canada, Bulletin 2025-21 “Transition to ISO/IEC 42006:2025”, 28 August 2025. https://scc-ccn.ca/accreditation/bulletins/transition-isoiec-420062025-bodies-providing-audit-and-certification
11. IAF MD 11:2023, Application of ISO/IEC 17021-1 for Audits of Integrated Management Systems, Issue 3. https://iaf.nu/iaf_system/uploads/documents/IAF_MD_11_Issue_3_12092023.pdf
12. European Commission, “Understanding standardisation in the AI Act”, Q&A. https://digital-strategy.ec.europa.eu/en/faqs/understanding-standardisation-ai-act
27.10.2026
