Getting ISO 42001 certified and keeping it: readiness and gap analysis, the evidence auditors ask for, stage 1 and stage 2, timelines, surveillance and recertification, and accreditation of ISO 42001 certification bodies.
How an ISO 42001 gap analysis works: comparing current AI governance with clauses 4 to 10 and the Annex A controls, reusing NIST AI RMF or ISO 27001 work, who can perform it, and why a certification body's pre-audit has limits.
The evidence an ISO 42001 certification audit looks for: statement of applicability, AI risk and impact assessment records, verification and validation results, deployment approvals, event logs, monitoring, internal audit and management review records.
How the two stages of the ISO 42001 initial certification audit work: what stage 1 checks and reports, the interval before stage 2, what stage 2 tests, closing major nonconformities, and how a combined audit with ISO 27001 changes stage 1.
How long ISO 42001 certification takes and what sets the pace: running the management system before stage 1, the gap between stage 1 and stage 2, the 6-month limit for closing major nonconformities, and annual audits across the three-year cycle.
What happens after an ISO 42001 certificate is issued: an audit every calendar year, what surveillance must cover, recertification before the cycle ends, restoring a lapsed certificate, and transferring to another certification body.
Where accreditation for ISO 42001 certification stands: ISO/IEC 42006 rules for certification bodies, the Global ACI arrangement that does not yet list ISO 42001 as an endorsed sub-scope, ANAB-accredited certifiers, verifying certificates and counterfeit risk.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.