How does the ISO 42001 certification process work from start to certificate?
An accredited or recognized certification body, not ISO and not DeployOpen, runs the certification audit and issues the certificate. The organization owns its AI management system, its scope, its risk decisions and its evidence. Your customer questionnaire, contract clause or regulator is asking for proof that a third party has examined that system, so the first step is to confirm which certification body you will use and whether its certificate is accredited. ISO does not certify organizations, and accreditation of certification bodies is voluntary, so the certificate's standing depends on the body behind it.
The path from first decision to certificate is shaped by three variables. The first is AI scope: clause 4.3 requires you to determine which parts of the organization and which AI activities the AI management system covers, and that boundary sets what the audit examines. The second is the number of AI systems in scope, since each system brings its own impact assessment, life cycle records and third-party relationships to evidence. The third is how much evidence already exists. An organization with a documented AI policy, a maintained AI system inventory, completed risk assessments and running internal audits starts far ahead of one that has only informal practices. Before you sign with a body, ask it to explain how it will plan stage 1 and stage 2 for your scope, and what documents it will expect before stage 1.
Your reader's next action is to write down the scope, count the AI systems and list the evidence you already hold against the clauses 4 to 10 requirements. Then ask each candidate certification body to confirm its accreditation status, its approach to the ISO/IEC 42006:2025 requirements for AI management system audits, and how it will schedule the three-year cycle from the initial certificate. The Global ACI recognition arrangement does not yet list ISO/IEC 42001 as an endorsed sub-scope, so confirm the body's accreditation position directly rather than assuming it. DeployOpen can help prepare the systems and evidence, but the audit itself stays with the independent body.
Which phases take an organization from scoping to a certificate?
The certification path runs from defining what the AI management system covers, through documenting controls and proving the system operates, to two audit stages by an external certification body. Each phase closes with a record that the next phase depends on.
Define the AI management system scope
The organization sets the boundary of its AI management system under clause 4.3, naming which products, services, AI systems, business units, locations and third parties fall inside it. Leadership and the people who build, provide or use the AI systems in scope should agree the boundary, because the certification audit can only cover what the scope statement includes. The output is a written scope statement, approved by top management and available as documented information. The step is done when every in-scope AI system can be traced to the scope statement and each exclusion has a stated reason.
Assess AI risks and impacts for the scope
Using the AI risk assessment in clauses 6.1.2 and 8.2 and the AI system impact assessment in clauses 6.1.4 and 8.4, the organization identifies the risks and potential impacts of each in-scope AI system. Risk owners review the results and decide which treatments are needed. The output is a risk assessment record and an impact assessment record for each system, with the risk treatment decisions that feed the next step. The step is complete when each identified risk has an owner and a recorded treatment decision.
Write the statement of applicability
Under clause 6.1.3, the organization produces a statement of applicability that lists the Annex A controls it needs, and states for each one whether it is included or excluded and why. Controls are linked to the risk treatment decisions and to the evidence that will show them operating. Because ISO/IEC 42001 does not require every Annex A control, exclusions must be justified, not simply stated. The output is the approved statement of applicability. The step is done when every one of the 38 Annex A controls has a documented include or exclude decision and a justification, and each included control names an owner and evidence source.
Operate the performance evaluation clauses
Before the certification audit, the management system must run in practice. The organization monitors and measures AI management system performance under clause 9.1, and an internal audit under clause 9.2 checks conformity with the standard and the organization's own requirements. Top management then holds a management review under clause 9.3, covering the status of actions, results and opportunities for improvement. Nonconformities found along the way are logged and handled under clause 10.2, with corrective actions and records of their effectiveness. The outputs are monitoring records, an internal audit report, management review minutes and a corrective action log. The step is complete when at least one full cycle of these records exists and each nonconformity has a closed or tracked corrective action.
Select a certification body and agree the audit plan
The organization selects an external certification body and agrees the engagement in writing. The body must work to ISO/IEC 42006:2025 in addition to ISO/IEC 17021-1, and the organization should confirm whether the certificate will be accredited. The certification body then prepares an audit plan for the two stages. European Accreditation FAQ 32.4 notes that both stages need an audit plan, though the stage 1 plan may be informal. The output is a signed contract and a stage 1 audit plan. The step is done when the organization can name the scope, the stages and the auditor team dates in writing.
Pass the stage 1 documentation review
In the stage 1 audit, the certification body reviews the documented management system, including the scope statement, AI policy, statement of applicability, risk and impact assessments, and internal audit and management review records. The auditor checks readiness for the stage 2 test and, where ISO/IEC 42001 is audited with another standard, confirms the level of integration as Global ACI-TECH-3-008 requires. The output is a stage 1 audit report listing findings and any gaps the organization must close before stage 2. The step is complete when the auditor records that the organization is ready for stage 2, or when open gaps have been resolved on a timetable the certification body accepts.
Demonstrate implementation in the stage 2 audit
The stage 2 audit tests whether the AI management system is implemented and effective in practice. The auditor samples AI systems in scope, traces controls from the statement of applicability to live evidence such as logs, impact assessment records, supplier reviews and corrective action files, and interviews staff in roles such as AI owners and developers. The output is a stage 2 audit report with findings classified as nonconformities or observations. Nonconformities must be corrected through the process in clause 10.2 and verified before a decision is made. The step is complete when the certification body issues its certification decision based on the findings and the closure of any nonconformities.
Maintain and verify the certificate
Once certified, the organization runs surveillance audits and a recertification audit within the three-year certification cycle. European Accreditation FAQ 37.12 states that at least one audit must take place each calendar year, and a delayed audit cannot push the next year's audit back. European Accreditation FAQ 51.7 requires the certificate to show its expiry or recertification due date. Third parties can verify status through IAF CertSearch, by contacting the certification body or by contacting the accreditation body. The outputs are surveillance audit reports and a current, verifiable certificate. The step is done when the organization can show the certificate status to a customer and each annual audit has been completed on schedule.
What must be operating before the stage 2 audit?
The stage 2 audit tests whether the AI management system works in practice, not only whether documents exist. The six checks below cover the scope, the controls, the policy, the risk work, the internal oversight and the corrective action trail that an assessor will sample. Each one should have run for long enough to produce records before the certification body arrives.
A defined AI scope
Clause 4.3 requires the organization to determine the scope of its AI management system, and the certification audit covers exactly that boundary. Check that the scope names the AI systems, business units, locations and products included, and that any exclusion is stated with a reason. Ask whether every in-scope AI system appears in the inventory. Evidence an assessor will request: the scope statement, the AI system inventory and the minutes where the scope was approved.
A justified statement of applicability
Clause 6.1.3 requires a statement of applicability that lists the Annex A controls the organization needs and justifies including or excluding each of the 38 reference controls. Check that every exclusion has a documented reason tied to the scope, not a blank field. Confirm that each included control points to an owner and to the place where its implementation is recorded. Evidence an assessor will request: the signed statement of applicability and the control owner list.
An AI policy and assigned roles
The AI policy sets management direction, and the roles under the internal organization controls show who acts on it. Check that the policy has been approved by top management, communicated to the people who build and operate AI, and reviewed on a set schedule. Confirm that named individuals hold responsibility for AI risk, impact assessment and concerns about AI systems. Evidence an assessor will request: the approved policy, the role descriptions, the communication records and the reporting line for raising concerns.
AI risk and impact assessments on real systems
Clauses 6.1.2, 6.1.4, 8.2 and 8.4 require AI risk assessment and AI system impact assessment to be carried out, not only designed. Check that at least one assessment has been run on a live or pilot AI system in scope, with the risks, the treatment decisions and the residual risk recorded. Confirm that the assessment was repeated or updated when the system or its data changed. Evidence an assessor will request: completed assessment records, risk treatment plans and the dates of each update.
An internal audit and a management review
Clauses 9.2 and 9.3 require an internal audit of the management system and a management review by top management. Check that the internal audit was performed by someone independent of the area audited, and that findings were recorded. Confirm that the management review considered the results of monitoring, audits, risk changes and improvement opportunities, with decisions minuted. Evidence an assessor will request: the internal audit plan, the audit report with findings, and the management review minutes.
A corrective action log
Clause 10.2 requires the organization to react to nonconformities, correct them and address their causes. Check that every nonconformity from internal audits, monitoring or incidents has a log entry, a root cause, an action, an owner and a closure date. Confirm that open items are reviewed in management review and that effectiveness was checked after closure. Evidence an assessor will request: the corrective action register with traceable links to the audit or incident that raised each item.
What do stage 1 and stage 2 audits each test?
The initial certification audit for ISO/IEC 42001 is one audit delivered in two stages under ISO/IEC 17021-1, and the two stages test different things. Stage 1 tests readiness on paper and in design: the certification body reviews whether your AI management system documentation exists, whether the scope under clause 4.3 is defined, whether the statement of applicability under clause 6.1.3 justifies every included and excluded Annex A control, and whether the performance evaluation clauses (9.1 monitoring, 9.2 internal audit, 9.3 management review) and 10.2 corrective action are actually running. Both stages need an audit plan. European Accreditation FAQ 32.4 notes that the stage 1 plan may be informal, but you should still ask your certification body in writing what it will review and which staff it expects to interview.
Stage 2 tests whether the system operates as documented. The auditor samples real records: AI impact assessments under clauses 6.1.4 and 8.4, risk treatment decisions, competence records, internal audit reports, management review minutes and corrective actions for nonconformities. Ask the certification body how it selects samples and how many AI systems it will look at, because that choice determines how much of your inventory is examined. Gaps that surface at stage 1 are usually resolved before stage 2 is scheduled, so treat the stage 1 report as your last low-cost opportunity to fix documentation.
If you also run ISO/IEC 27001, raise integration at the start. Global ACI-TECH-3-008 requires the stage 1 audit to confirm the level of integration between the two management systems. Reports may be integrated or separate, but every finding must trace to the standard it relates to, so a shared access control record should be assessed against both the 27001 and 42001 requirements it serves. Confirm with the certification body, before stage 1, whether it will issue one report or two and who will be on the audit team.
What happens after the certificate is issued?
A certificate issued under ISO/IEC 17021-1 runs on a three-year cycle, and the certification body must audit the AI management system at least once in every calendar year of that cycle. These are surveillance audits in years two and three, and they are sampling checks of whether the system still operates as it did at certification. Auditors do not repeat the full initial assessment. They pick a sample of AI systems, risk and impact assessments, Annex A decisions in the statement of applicability, internal audit reports, management review minutes and nonconformity records, then test whether the records match what the organization actually does.
- Calendar-year obligation: European Accreditation FAQ 37.12 states that one audit must happen every calendar year, and a delayed audit cannot be used to push the next year's audit back. Plan dates early.
- Sampling of AI systems: Keep an inventory of AI systems in scope with owners, purposes and current impact assessment status, since auditors often start there.
- Internal audit and management review: Keep dated records showing clauses 9.2 and 9.3 ran on schedule and that findings led to action.
- Corrective actions: Track nonconformities under clause 10.2 to closure, with root cause and evidence of effectiveness.
- Statement of applicability: Update it whenever a control decision changes, with the justification.
Before the first surveillance date, confirm with the certification body which records it will sample and how far in advance it wants them.
At the end of the three-year cycle, the certificate expires unless the organization completes a recertification audit. European Accreditation FAQ 51.7 (March 2026) states that the certificate must show the expiry or recertification due date that completes the cycle, so the date is visible to anyone who verifies the certificate. Recertification is broader than surveillance. The auditor reviews the whole management system over the cycle, including how the AI policy, objectives, risk treatment and impact assessments have changed, and whether the system has improved as clause 10 requires.
- Whole-cycle review: Assemble a cycle history covering changes to AI systems, policies, roles, suppliers and risk decisions.
- Effectiveness evidence: Show objectives that were measured, targets that were met or missed, and the actions taken after each result.
- Changes in standards and guidance: Record how the organization considered newer ISO/IEC AI guidance, such as ISO/IEC 42005:2025 on impact assessment, in its updates.
- Timing: Schedule the recertification audit early enough that a decision on the certificate is made before the expiry date. Ask the certification body for its planning lead time in writing.
- Fees and effort: Recertification effort usually depends on how much the system changed during the cycle. Ask the certification body to explain its audit time calculation.
Confirm with the certification body which documents it expects for recertification, because requirements can differ between bodies.
The scope of the AI management system, determined under clause 4.3, sets what the certificate covers. When the organization adds a new AI system, a new product line, a new site or a new business unit, the scope may change. Some changes are routine internal updates, while others must be reported to the certification body and assessed before the certificate reflects them. Changes that take AI systems outside the certified scope, or that add operations the audit never sampled, create a gap between the certificate and reality. The certification body decides how to handle each change, usually by reviewing documentation or running an additional audit.
- New AI systems: Add the system to the inventory, run AI risk and impact assessments under clauses 6.1.2, 6.1.4 and 8.2 to 8.4, and update the statement of applicability.
- New sites: Confirm whether the site operates AI systems within scope, and document its roles, resources and controls.
- Outsourced AI services: Record supplier responsibilities under the A.10 controls, since a new supplier can change how the system operates.
- Notification: Report material scope changes to the certification body as its rules require, and keep the notification record.
- Decision record: Keep documented reasons for excluding any AI system from scope, with a justification that an auditor can trace.
If you expect a significant change, ask the certification body in writing how it would treat that change before you make it.
An organization may move its accredited certificate from one certification body to another. Global ACI-TECH-3-002 (M), issued 10 July 2026, is the mandatory document that governs this transfer for accredited management system certification. The transfer does not reset the certification cycle or replace the need for evidence. The receiving body reviews the existing certificate, the most recent audit reports, open nonconformities and the reasons for the change before it decides how to continue. Transfers are not a way to avoid an open finding, and a body may require additional work before it accepts the certificate.
- Current status: Confirm the certificate is valid and the cycle dates are clear, using IAF CertSearch or the current body.
- Open nonconformities: Close or document every open finding from the previous audits before you request a transfer.
- Audit reports: Gather the most recent surveillance or recertification reports and any corrective action records.
- Accreditation status: Check that the receiving body holds accreditation for ISO/IEC 42001 (the accreditation scope matters, so ask for it in writing).
- Timing and cost: Ask the receiving body what review it will do, how long that takes and what it charges for the transfer review.
Before you start, ask both bodies to confirm the transfer steps in writing and to state whether they will rely on the previous audit evidence.
How do customers verify an ISO 42001 certificate?
A certificate is only useful if the reader can confirm who issued it, under which accreditation, and whether it is still current today. The cards below cover the lookup routes ISO points to, the governing rules for certifiers, and the checks a customer should make before relying on a certificate in a contract or procurement file.
Search IAF CertSearch
Start with IAF CertSearch, the public database ISO points to for verifying certificate status. You can search one certificate at a time, run bulk checks across a supplier list, or query the database through its API. Record the certificate number, the certification body named on the certificate, the scope statement and the status on the date you checked. A certificate that appears suspended, withdrawn or absent should be treated as unverified until the supplier explains the gap in writing.
Confirm the scope statement
Read the scope on the certificate against the AI systems and business units you are buying from. The scope defines what the certification audit covered under the AI management system determined in clause 4.3 of ISO/IEC 42001. A certificate for one product line or one site does not cover the whole organization. Ask the supplier which AI systems fall inside that scope and which sit outside it.
Contact the certification body
When a database entry is unclear or missing, contact the certification body named on the certificate and ask it to confirm the certificate status, validity dates and scope in writing. A certification body can also confirm whether the certificate was issued after a stage 2 audit and whether surveillance audits are on schedule. Ask who signed the confirmation so you know the answer came from the body itself rather than from the supplier.
Check the accreditation body
Accreditation of certification bodies is voluntary, so a valid certificate may come from a body that is not accredited for ISO/IEC 42001. Ask the certification body which accreditation body granted its accreditation and whether that accreditation covers ISO/IEC 42001. Then contact the accreditation body directly to confirm the scope. Do not assume that accreditation covers AI management systems just because the body is accredited for other management system standards.
Apply ISO/IEC 42006 requirements
ISO/IEC 42006:2025, published 7 July 2025, sets the additional requirements, on top of ISO/IEC 17021-1, that certification bodies must meet when they audit and certify AI management systems. When you assess a certificate, ask whether the certifier's audit team and processes were assessed against those additional requirements. A certificate issued without them may still exist, but it is harder to defend in a due diligence review.
Confirm the three-year cycle
Verification is not a one-time event. An ISO/IEC 17021-1 certification cycle runs three years, and the certificate must show the expiry or recertification due date that completes the cycle. Surveillance audits are required in the years between, so a certificate that is current today may still lapse if surveillance audits are missed. Set a recheck date for each supplier and ask them to send the next audit date when you renew their due diligence file.
What do buyers ask about the ISO 42001 certification process?
How long does ISO 42001 certification take from start to finish?
The supplied facts do not give a typical duration, so request a written timeline from each certification body you are considering. The timeline depends on how much of the management system already operates, how many AI systems fall inside the scope, and whether the audit is run alone or alongside ISO/IEC 27001. The initial certification is one audit in two stages, and both stages need an audit plan, although the stage 1 plan may be informal. Ask the body to show the gap between stage 1 and stage 2, what evidence it expects before stage 2, and how it schedules the audit around your management review and internal audit cycle.
What does ISO 42001 certification require from our internal staff?
Internal staff must run the management system day to day, and the certification body audits what they do, not what a consultant wrote. Expect the work to involve several roles:
- Senior leadership, who sets the AI policy, assigns roles and attends the management review under clause 9.3
- A system owner for AI governance, who maintains the AI risk and impact assessments and the statement of applicability
- Engineering and data owners, who keep the AI system records, data and life cycle evidence current
- An internal auditor, who must audit the management system before the certification audit under clause 9.2
Identify these people early and confirm their time allocation before the project starts.
Can our organization get ISO 42001 certified without outside help?
Yes, an organization can prepare for and pass certification with its own staff, because the standard does not require a consultant. The organization owns its controls and evidence, and only the certification body issues the certificate. Outside help is optional and usually covers gap analysis, drafting documentation, configuring tooling or training internal auditors. Before you decide, weigh whether your team has the time to read the standard, build the statement of applicability and run an internal audit. If you engage a partner, confirm that it will not also act as your certification body, and agree the scope and deliverables in writing first.
Can we certify only one AI product under ISO 42001?
The scope is set by your organization under clause 4.3, and it defines what the certification audit covers. A narrower scope, such as a single AI product or business unit, can be valid if it is clearly bounded and the management system still meets the requirements that apply to it. Confirm with the certification body how it treats excluded products, shared AI infrastructure, suppliers and AI features used internally. Customers may ask whether the scope covers the product they buy, so check the wording of the scope statement and the certificate before you sign any contract that refers to it.
What happens if stage 2 finds nonconformities in our ISO 42001 audit?
Nonconformities found in stage 2 must be addressed through corrective action under clause 10.2 before the certification decision, and the certification body decides what evidence it needs to verify the fix. Ask the body in advance how it classifies findings, how long you have to respond, whether it will re-visit the site or review documents remotely, and what happens if the correction is not accepted. Keep records of the root cause analysis and the corrective action, because auditors will check that the problem was fixed and that the fix works over time. Your own team owns the corrective action, and any partner can only help prepare the evidence.
How do we confirm an ISO 42001 certificate is genuine?
Check the certificate's status in IAF CertSearch, which lets anyone verify status one certificate at a time, in bulk or through an API. You can also contact the certification body or its accreditation body directly. Compare the scope, the standard edition and the expiry or recertification date on the certificate with what the body tells you. A valid certificate must show the expiry or recertification due date that completes the three-year cycle. Ask the certifier whether it is accredited, because accreditation of certification bodies for ISO/IEC 42001 is voluntary, and an unaccredited certificate may carry less weight with your customers.
How does DeployOpen prepare systems and evidence for the audit?
DeployOpen works as an implementation partner. Under a fixed-scope written agreement, it plans and builds the systems and records that an ISO/IEC 42001 AI management system depends on, inside your own cloud accounts, data centers or air-gapped networks. The work typically covers the scope statement under clause 4.3, the statement of applicability under clause 6.1.3, the AI risk and impact assessment records, and the operating evidence for the performance evaluation clauses 9.1 to 9.3 and corrective action under 10.2. Scope, deliverables and timelines are agreed in writing before work starts, so you know what is prepared and what is still yours to decide.
The organization keeps ownership of its controls. Your leadership decides the AI policy, the risk acceptance decisions, the justifications for excluding any Annex A control, and who signs off the management review. DeployOpen does not make those decisions for you. It hands over documentation and evidence packs that show how each in-scope control is operating, along with the records an auditor will ask to sample. Before you sign, confirm with the partner which evidence formats they deliver, where the packs are stored, and who keeps access once the engagement ends.
DeployOpen does not issue audit reports, attestations or certificates, and it does not guarantee certification. Only an independent certification body accredited for this work can audit your AI management system and issue a certificate, and ISO does not certify organizations itself. Keep the implementation partner and the certification body separate, so the body can test your system without relying on the people who built it. Ask any partner to put in writing what it will and will not deliver, and confirm the certification body's requirements under ISO/IEC 42006:2025 before the stage 1 audit is booked.
