How long does ISO 42001 certification take?
No supplied source gives a fixed number of weeks or months for ISO 42001 certification. The overall timeline is set by your organization's starting point, meaning how much AI governance already operates, and by the certification body's audit schedule. What is fixed is the sequence and a set of rules that the certification body applies. Before the certification audit, your management system must be running. Performance evaluation clauses 9.1 (monitoring, measurement, analysis and evaluation), 9.2 (internal audit) and 9.3 (management review) need records that show they operate, and 10.2 needs a working nonconformity and corrective action process. An auditor cannot test a system that has existed only on paper for a week, so the operating period is usually the longest part of the work and the part you control most directly.
The certification body decides how long the gap between stage 1 and stage 2 must be. ISO/IEC 17021-1 requires an interval so the client can resolve concerns raised in stage 1, but European Accreditation FAQ 49.3 sets no maximum. The certification body must judge whether the stage 1 result is still valid, especially after significant changes to the AI systems or scope. Ask each certification body how it schedules that interval and what it expects you to have closed before stage 2. Once stage 2 ends, any major nonconformity must be verified as corrected within 6 months after the last day of stage 2, or the certification body must repeat stage 2 before it can recommend certification. Plan corrective action work around that deadline.
The certificate then runs on a three-year cycle. European Accreditation FAQ 51.7 states that the certificate must show the expiry or recertification due date, and FAQ 37.12 requires at least one audit in every calendar year, either surveillance or recertification. Your annual audit schedule therefore runs from the initial certification decision, not from the day you finished preparing. The organization owns its AI controls and the evidence behind them. An implementation partner, if you hire one, prepares systems, records and evidence, but cannot issue the certificate. Only the accredited certification body issues it. Ask each certification body for a written audit plan, audit days and their notice periods before you commit to a start date.
The phases from scoping to certificate and what each produces
The sequence runs from scoping and gap work through a management system that operates long enough to generate records, two audit stages with a set interval between them, closure of major nonconformities, a certification decision and the first annual audit. Each phase closes with a defined output that the next phase depends on.
Scope the system and close the gap
The organization defines the scope of its AI management system, the AI systems and business units it covers, and compares its current practice against clauses 4 to 10 and the Annex A controls. Owners of the organization, not the consultant, decide scope and the statement of applicability, which must list each Annex A control with a justification for including or excluding it. The output is a scoped gap register, a draft statement of applicability and a remediation plan with named owners. The step is done when leadership has approved the scope in writing.
Operate the management system until it produces records
Before a certification audit, the system must be running, not just documented. The organization carries out the performance evaluation clauses in practice: monitoring, measurement, analysis and evaluation under 9.1, internal audit under 9.2, and management review under 9.3, with nonconformity and corrective action under 10.2 in place. An implementation partner can help set up these processes and tools, but the internal owners must perform them. The output is a body of dated records, such as internal audit reports, management review minutes and corrective action logs. Ask the certification body in writing how much operating history it expects before stage 1.
Complete the stage 1 document review
The certification body reviews the documented AI management system, typically the policy, scope, statement of applicability, risk and impact assessment method, and evidence of internal audit and management review. Stage 1 checks whether the system is designed to meet the standard and whether the organization is ready for a detailed test. The auditor reports the findings in writing, including any concerns that must be resolved before stage 2. The output is the stage 1 report, which lists areas of concern and readiness for stage 2. Confirm with the certification body how it will deliver this report and what it expects the organization to fix.
Resolve concerns during the stage 1 to stage 2 interval
ISO/IEC 17021-1 requires an interval between stage 1 and stage 2 so the client can resolve concerns found in stage 1. European Accreditation guidance sets no maximum length, and the certification body decides whether the stage 1 result is still valid, particularly after significant changes to the system or scope. The organization closes each stage 1 concern with corrected documents, new records or a changed control, and keeps the evidence of each fix. The output is a documented response to every stage 1 finding. Ask the certification body in its quotation and plan how the interval will be scheduled and what counts as a significant change.
Pass the stage 2 implementation audit
Stage 2 tests whether the management system is implemented and effective in practice, on site or remotely as the certification body plans. Auditors sample AI systems, risk and impact assessments, verification and validation results, deployment approvals, event logs and supplier records, and interview the people who run them. Findings are classified as major or minor nonconformities. The output is the stage 2 audit report with a recommendation, and a list of any nonconformities that must be closed before a decision can be made. Review the opening and closing meeting arrangements in the audit plan so the findings are clear before the report is issued.
Close major nonconformities within six months
If the certification body cannot verify corrections and corrective actions for every major nonconformity within six months after the last day of stage 2, it must conduct another stage 2 before it can recommend certification. The organization submits root cause analysis, the corrective action taken and objective evidence that it works, such as updated records or a repeated test that passes. The output is accepted evidence for each major nonconformity, verified by the certification body. Minor nonconformities follow the timing the certification body sets. Plan this window before stage 2 ends, because the clock starts from the last day of the audit.
Receive the certification decision and certificate
After the audit file and corrective action evidence are reviewed, an impartial decision-maker at the certification body decides whether to certify. A certificate shows the scope, the certification body's name and the expiry or recertification due date that completes the three-year cycle, as set out in European Accreditation guidance on certification documents. The output is the certificate and the final audit report. The organization owns its controls throughout; the certificate is issued only by the independent certification body. Check the certificate with the issuing body before publishing it to customers.
Complete the first annual audit
Certification does not end the cycle. At least one audit must take place in every calendar year of the three-year cycle, either a surveillance audit or a recertification audit, and a delayed audit cannot be used to push the following year's audit back. The first surveillance audit tests whether the system keeps operating after certification, including corrective actions, internal audits and management review. The output is a surveillance audit report and any new findings with their closure dates. Build the audit calendar into the management review schedule from the start, and confirm the exact dates in the certification body's written plan.
What makes ISO 42001 certification faster or slower
Six factors decide how quickly an organization moves from the first stage 1 conversation to a certificate. Most of them sit inside the organization's own control, and several interact, so a gap in one area often stretches the path in another.
Scope of the AI management system
The boundary sets how much work the certification body must sample and how many AI systems, business units and processes need documented controls. A narrow boundary covering one product with a few models is quicker to prepare and audit than one covering every team that buys or builds AI. Before stage 1, fix the list of AI systems in scope and the reasons for excluding any Annex A control in the statement of applicability. Ask the certification body how it will sample across the boundary and what changes to scope would require a new stage 1 review.
Existing AI governance maturity
An organization with a documented AI policy, an AI system inventory, owned risk assessments and recorded decisions on deployments needs far less time to show that clauses 4 to 10 operate. Organizations starting from informal practice must first write the policy, define roles and run a full cycle of risk and impact assessment before an auditor can see results. Check whether the gap analysis identified missing records or missing practice, because a missing practice takes time to run before it produces evidence.
Existing ISO 27001 or other management system
A certified ISO/IEC 27001 system shares the harmonized structure with ISO 42001, so document control, internal audit, management review and corrective action can often be reused. This tends to shorten preparation, and a combined audit can change how stage 1 is run. Confirm with the certification body how it will handle a combined or integrated audit, since the rules for integrated audits are set by its own accreditation and procedures, not by ISO 42001 alone.
Locations and third parties
Each additional site, cloud region or subcontracted AI supplier adds processes that must be documented, sampled and tested. Third parties that build, host or supply models or data fall under the supplier and customer controls in Annex A, which requires the organization to show how it allocates responsibilities and manages those relationships. Map every location and material supplier early, and collect their contract clauses and evidence before the audit window opens so the auditor is not waiting on external responses.
Availability of key staff
Stage 1 and stage 2 both involve interviews with the people who own AI policy, risk decisions, model deployment and internal audit. If those people are unavailable or the same few individuals hold several roles, interviews slip and sign-offs stall. Name a primary and backup for each role, block calendar time for interviews and approvals, and agree who signs the statement of applicability and management review minutes. Delays in these approvals often cost more time than any technical gap.
Certification body audit calendar
Certification bodies schedule audit teams around their own capacity, and the gap between stage 1 and stage 2 must be long enough for the client to resolve concerns. The ISO/IEC 17021-1 rule that major nonconformities must be verified within 6 months after the last day of stage 2 also limits how late corrective work can run. Ask for the earliest stage 1 date, the proposed stage 2 window and the schedule for surveillance audits before signing, and check how the body plans to audit the three-year cycle so the calendar fits your release and budget plans.
Why the management system must run before stage 1
Before a certification body schedules stage 1, the organization's AI management system should already be operating, not just documented. The point is that the performance evaluation clauses must have produced records: monitoring, measurement, analysis and evaluation under clause 9.1, internal audit under clause 9.2, and management review under clause 9.3, with nonconformity and corrective action under clause 10.2 covering whatever those activities find. An auditor cannot judge whether the system works from a policy document alone, so a system that has only been written down is likely to produce findings at stage 1 or stage 2 that could have been caught internally.
In practice, this means the organization should be able to show a completed internal audit cycle, covering the scope of the AI management system and conducted by people with defined responsibility for independence. It also means dated management review minutes that record the inputs considered, such as AI risk and impact assessment results, nonconformities, and performance of the controls selected in the statement of applicability, plus the decisions taken. A corrective action log should show each finding, its root cause, the action owner and whether the action was verified as effective. Ask the certification body which records it expects to sample, and confirm in writing how many cycles of each activity it will accept as evidence.
The standard does not fix how long the system must run before stage 1, and no supplied fact gives a duration. The honest answer depends on the starting point: an organization that already runs mature ISO 27001 or risk processes may generate usable records faster than one building AI governance from scratch. What matters is whether the records are genuine and reflect real operation. An implementation partner can design the monitoring metrics, set up the internal audit and management review templates, and configure the corrective action tracking, but the organization must own those processes and sign off on their outputs.
How the timeline changes by starting point
An organization with no documented AI governance has to build the management system from the clauses up before any audit is scheduled. Clauses 4 to 10 set the scope, policy, roles, AI risk and impact assessment, objectives, competence, documented information, internal audit and management review. Most of the time goes into producing records that show these clauses operating, not into writing the policy itself.
- New work: the AI scope, the AI policy, an inventory of AI systems, risk and impact assessment method and records, and the statement of applicability.
- Reusable work: little beyond general management practice such as document control, meeting cadence and corrective action logs.
- Likely to take longer: the management system must run long enough to produce internal audit and management review records before stage 1, which usually makes operation the critical path.
- Likely to take longer: the Annex A controls for AI system life cycle and data, where engineering teams must produce verification and validation evidence.
Before committing to dates, ask the certification body how much operating history it expects before stage 1 and how it will treat a management system that has only run for a short period.
An organization with a mature ISO/IEC 27001 management system already has document control, internal audit, management review, corrective action and risk assessment in place. ISO/IEC 42001 uses the same harmonized structure for clauses 4 to 10, so much of that machinery can be extended to cover AI rather than built again. The new work concentrates on AI-specific content that ISO/IEC 27001 does not contain.
- New work: AI impact assessment on individuals, groups and society, AI system life cycle controls, data provenance and quality for AI, and third-party AI supplier records.
- Reusable work: management review, internal audit programme, competence records, supplier management processes and the risk methodology, if the risk criteria are extended to AI harms.
- Likely to take longer: the impact assessment cycle, because it is a new discipline for most security teams and needs input from product, legal and affected business owners.
- Likely to take longer: agreeing with the certification body whether a combined audit changes stage 1, since that affects how documents are presented and sampled.
Confirm in the scoping conversation whether the certification body will accept existing ISO 27001 records as evidence for shared clauses, and which records it will still sample separately.
An organization that already maintains NIST AI RMF governance records, or a similar framework such as internal model risk governance, has an inventory of AI systems, risk tracking and some measurement evidence. These records map well to clauses 6 and 8 and to several Annex A objectives, but the framework is voluntary and its records are not written to the ISO/IEC 42001 management system clauses. Gap analysis is where most of the reuse is tested.
- New work: the formal AI management system clauses, including the AI policy, documented roles, internal audit of the AI management system and management review with defined inputs and outputs.
- Reusable work: the AI system inventory, risk identification and measurement records, and any monitoring data already collected.
- Likely to take longer: translating informal governance notes into controlled documented information with owners, versions and approvals.
- Likely to take longer: showing the statement of applicability and the impact assessment records, which auditors check against the Annex A controls one by one.
Ask the certification body which of the existing records it will treat as evidence, and whether it expects a documented mapping from the framework to the clauses and controls before stage 1.
Standalone or combined audit: how each affects the schedule
This table compares a standalone ISO 42001 audit with an audit combined with ISO 27001, showing how each changes the stage 1 work and the schedule. Read it as a question list for the certification body, since the final format and its schedule effect are set in that body's audit plan.
| Option | What it covers | Effect on stage 1 work | Effect on the schedule |
|---|---|---|---|
| Standalone ISO 42001 audit | Assesses the AI management system against clauses 4 to 10 and the Annex A controls in the statement of applicability, with no ISO 27001 scope. | Stage 1 reviews only the AI management system documentation, AI risk and impact records, and readiness for stage 2. | Runs on its own audit plan. Confirm the stage 1 to stage 2 interval and audit dates with the certification body. |
| Combined ISO 42001 and ISO 27001 audit | Covers both management systems in one audit, following the integrated audit guidance in the Global ACI technical document. | Stage 1 also reviews the shared management system elements and the ISO 27001 scope, so the document review is broader. | May reduce duplicated audit effort, but only if the certification body accepts the combined approach. Request the schedule effect in writing. |
| Whether a combined approach is offered | The certification body decides if integrated auditing is available for the client's scope and accreditation. | Depends on the body's acceptance of the combined scope before stage 1 begins. | Ask the body to confirm availability early, since a refusal may force a separate audit plan. |
| Schedule effect in the certification body's plan | The audit plan states the stages, dates, interval and any combined audit days. | Stage 1 findings feed the plan for stage 2 and any follow-up. | Request the schedule effect in the written plan, not as a verbal estimate. Audit days follow each body's quotation. |
What must be in place before the certification audit
A certification body will not book stage 1 until the AI management system is written down and running. The cards below cover the items it looks for first, and what you should check yourself before you request a quote or a date.
Documented scope and statement of applicability
The scope defines which AI systems, products, services and sites fall inside the management system. The statement of applicability, required by clause 6.1.3, lists the Annex A controls you need and justifies including or excluding each one. Check that every exclusion has a reason an assessor can test, and that the scope matches what you actually operate. Auditors will read the statement of applicability first, so an unclear scope usually delays stage 1.
AI risk and impact assessment records
Auditors expect dated risk and impact assessment records for the AI systems in scope, showing how risks were identified, rated, treated and reviewed. Check that each in-scope system has a record, that the owner signed off, and that the records link to the controls in your statement of applicability. Records that were written once and never updated after a model or data change are a common finding at this step.
Completed internal audit and management review
The management system must have run its performance evaluation clauses before certification: monitoring and measurement under 9.1, internal audit under 9.2 and management review under 9.3. Check that at least one internal audit has been completed against the scope, that findings were recorded, and that top management reviewed results and made decisions. A certification body will ask for the audit plan, the audit report and the minutes of the management review.
Corrective action records
Clause 10.2 requires you to react to nonconformities, correct them and address their causes. Check that internal audit findings and any incidents or monitoring exceptions have a logged root cause, an action, an owner and a closure date. Certification bodies test whether corrective actions are effective, not just recorded, so ask for evidence that a closed action actually changed the process.
AI policy and assigned roles
The AI policy sets management direction, and named roles and responsibilities show who owns each part of the system. Check that the policy is approved by top management, communicated to the people it affects, and reviewed on a set cycle. Confirm that each role in the documented responsibilities has a named person who accepts the duty, since assessors ask staff to explain their roles during the audit.
Evidence that controls operate
A control on paper is not enough. Each Annex A control you claim should leave records from normal operation, such as approvals, test results, access reviews, event logs and monitoring reports, covering a period long enough to show the process runs. Check each applicable control against a sample of real records before stage 1, and ask the certification body which evidence it expects for each area. Gaps found here are easier to fix before the audit than during it.
Who owns each part of the timeline
The organization is the party that is certified, so it owns the AI management system in full. Its leadership sets the scope, approves the AI policy and makes the decisions that the standard expects management to make. Staff run the controls day to day, and the people who sign off AI risk, deployment and third-party decisions must be named inside the company. No outside party can take these over, and an auditor will ask leadership directly how it governs AI.
- Scope and boundaries: Decide which AI systems, business units and locations fall inside the management system, and record the reasons for exclusions.
- AI policy and objectives: Approve the AI policy and the measurable objectives, then review them through management review.
- Risk and impact decisions: Accept or treat AI risks and impacts, and document who made each decision and why.
- Sign-offs and approvals: Authorize deployments and changes to AI systems and keep the approval records.
- Internal audit and corrective action: Run the internal audit programme and close nonconformities with their own owners and dates.
Before engaging any partner, confirm that a named executive and a named AI governance owner will hold these responsibilities after the project ends.
An implementation partner, such as DeployOpen, helps the organization get its management system and evidence into a state an auditor can test. The partner plans the work against the written scope, sets up the systems that generate evidence and documents the processes the organization has chosen. The partner prepares the organization for the audit but does not decide on its behalf, and it never issues a report, certificate or attestation. Its role ends where the independent assessment begins.
- Planning: Build the project plan, milestones and dependencies against the agreed scope, and identify the staff the organization must provide.
- Systems and evidence: Configure the self-hosted open-source tooling that records risk assessments, approvals, logs, monitoring and internal audit results.
- Documentation support: Draft procedures, records and the statement of applicability for the organization to review, adapt and approve.
- Audit preparation: Run mock reviews of the evidence and help staff explain their controls to the auditor.
- Handover: Deliver documentation and runbooks so the organization can operate and maintain the system without the partner.
Check in the written scope that the partner's deliverables stop before the certification audit and that the partner will not sign or certify any part of the organization's compliance.
The certification body is the independent organization that audits the management system and decides whether to certify it. It sets its own audit plan and the interval between stage 1 and stage 2, and it determines the number of audit days from its own quotation. If it finds major nonconformities, it decides whether they are closed in time. The certification body issues the certificate and carries out surveillance and recertification audits across the three-year cycle.
- Audit plan and interval: Schedule stage 1, judge whether the stage 1 result remains valid before stage 2, and set the stage 2 date.
- Audit days: Calculate the audit time from its quotation, which the organization should compare across bodies before signing.
- Nonconformity decisions: Verify that corrections and corrective actions for major nonconformities are complete within the required period.
- Certification decision and certificate: Decide whether to recommend certification and issue the certificate, showing the expiry or recertification due date.
- Annual audits: Conduct at least one audit in every calendar year during the cycle.
Ask each certification body for its written quotation, its audit plan and its accreditation status before you commit, and confirm that its accreditation covers ISO/IEC 42001 certification.
What usually delays ISO 42001 certification
Most delays in ISO 42001 certification trace back to a few decisions made early: where the AI system boundary sits, whether the management system is actually running, and when the certification body is engaged. Each card below names the avoidance step and what to request in writing so the schedule is agreed before money is committed.
Scoping the AI system boundary late
The scope of the AI management system determines which AI systems, teams, suppliers and records the audit samples. If the boundary moves after the gap analysis, risk assessments, impact assessments and the statement of applicability must be redone, and stage 1 findings often follow. Fix the scope in writing early, list every AI system in it, and confirm with the certification body that the scope statement matches the systems you intend to show.
Treating the system as a document project
Clauses 9 and 10 require monitoring, internal audit, management review and corrective action to have actually run before certification. A policy set with no operating history gives an auditor nothing to sample. Start the review cycle, log AI risk decisions and run at least one internal audit and management review before booking stage 1, then confirm with the certification body which records it will sample.
Booking stage 1 before records exist
Stage 1 reviews documentation and readiness, and stage 2 tests whether the system works in practice. Booking stage 1 before the impact assessments, verification results and deployment approvals exist usually produces a stage 1 report full of open items and a second visit. Confirm the evidence list with the certification body before the date is set, and ask whether the stage 1 report will state the readiness conditions for stage 2 in writing.
Leaving corrective actions open at stage 2
Major nonconformities found in stage 2 must be verified within a limited window after the last day of the audit. If the certification body cannot verify the corrections for every major nonconformity within that window, it must run another stage 2 before recommending certification. Plan corrective action owners and evidence before stage 2 ends, and ask the certification body in writing for the exact verification deadline and the method it will use.
Waiting for the certification calendar
Certification bodies schedule audit teams by availability, and a late request can push stage 1 and stage 2 into a later quarter than the readiness work requires. Share a target window with two or three certification bodies early, ask for their next available stage 1 dates and audit day estimates, and confirm that the quotation reflects the agreed scope. Dates should be held in writing before internal milestones are fixed.
Assuming ISO 27001 covers AI governance
An ISO/IEC 27001 certificate shows that an information security management system is in place. It does not test the AI-specific controls in Annex A of ISO/IEC 42001, such as AI impact assessment, data provenance or AI system life cycle controls. The two standards share a harmonized structure, which makes integration efficient, but the AI clauses and controls still need their own evidence. Ask the certification body how it will audit the AI-specific parts and whether a combined audit adds days.
Questions buyers ask about the ISO 42001 certification timeline
How long does ISO 42001 certification take?
No fixed duration applies to every organization, so the honest answer is that the certification body sets the plan. The pace depends on how far your AI governance already reaches clauses 4 to 10 and the Annex A controls you include in your statement of applicability, how many AI systems are in scope, and how quickly your staff can produce records. Ask the certification body for a written audit plan with audit days and proposed dates, and ask for the reasoning behind those days, since the ISO summary of ISO/IEC 42006:2025 does not set audit time rules. Compare quotations on the same scope and the same statement of applicability.
How long must the AI management system run before stage 1?
The management system must already be operating before the certification audit, not just documented. Auditors expect evidence that performance evaluation is running: monitoring, measurement, analysis and evaluation under clause 9.1, internal audit under 9.2, and management review under 9.3, with nonconformity and corrective action under 10.2. No minimum operating period is set by ISO/IEC 42001 itself, so ask your certification body how many completed cycles of internal audit and management review it expects to see. A short operating history with real records usually reads better than a long period with gaps.
What happens if the gap between stage 1 and stage 2 is long?
A long gap does not automatically invalidate stage 1. Clause 9.3.1.2.4 of ISO/IEC 17021-1 requires an interval so you can resolve concerns raised in stage 1, and European Accreditation FAQ 49.3 sets no maximum. The certification body must judge whether the stage 1 findings still hold, especially after significant changes such as new AI systems, reorganized teams or a revised statement of applicability. If the judgment is negative, the body may repeat part or all of stage 1. Ask in writing how it will reassess your stage 1 results before stage 2 is scheduled.
What happens if major nonconformities are not closed within 6 months?
If the certification body cannot verify corrections and corrective actions for every major nonconformity within 6 months after the last day of stage 2, it must conduct another stage 2 audit before recommending certification, as set out in European Accreditation FAQ 36.14. Practically, this means a second on-site or remote audit cost and a delayed decision. Plan remediation as soon as stage 2 findings arrive, assign owners, and record evidence of each fix, such as updated procedures, risk assessment revisions or training records. Confirm with your certification body whether any re-audit fees are part of its quotation.
Can our own team do the work needed to shorten the timeline?
Yes, an organization can build and run its own AI management system, and nothing in ISO/IEC 42001 requires an outside consultant. The timeline depends more on internal capacity than on who writes the documents: someone must own AI governance, make decisions on risk and impact assessments, and keep records current. Outside help can prepare systems, controls and evidence, and a gap analysis can show where effort is needed. It cannot issue the certificate, and the organization still owns its controls. Be cautious about any advisor who promises a fixed date, since certification decisions rest with the independent certification body.
What does the work need from our staff over the timeline?
Staff time falls into a few recurring roles: an executive sponsor for policy and management review, a governance owner who runs the management system, system owners who document AI resources, data and life cycle records, and reviewers who run internal audits. Engineering staff will spend time producing verification and validation results, deployment approvals and event logs, while legal or privacy staff review impact assessments. Estimate the hours from your own inventory of AI systems and ask the certification body how it will sample records, since that shapes the evidence you must prepare.
What happens in years two and three after certification?
ISO/IEC 17021-1 uses a three-year certification cycle, and the certificate must show the expiry or recertification due date (European Accreditation FAQ 51.7). At least one audit must take place in every calendar year, either a surveillance audit or a recertification audit, and a delayed audit cannot be used to push the following year's audit back (FAQ 37.12). Surveillance audits check that the system keeps operating, including internal audit, management review and corrective action. Ask your certification body for the audit programme across all three years and budget for each audit day in its quotation.
How DeployOpen prepares your timeline and evidence
DeployOpen prepares the self-hosted systems, records and evidence that an ISO 42001 management system needs to be operating before a certification body's stage 1 audit. Your organization owns its AI management system and decides on certification, while an independent certification body performs the audits and issues any certificate.
How we scope
- Scope is agreed in writing before work starts, covering which AI systems, business units and infrastructure are included.
- The written scope lists the clauses 9.1 to 9.3 and 10.2 records the operating system must produce before stage 1.
- Your certification body's audit days come from its own quotation, so we confirm that quote against the agreed deliverables.
How we build
- We configure the self-hosted tooling that produces monitoring, internal audit and management review records inside your environment.
- We set up nonconformity and corrective action tracking so that major findings can be closed within the timeline your auditor sets.
- We prepare the statement of applicability and supporting evidence so that the operating cycle has run long enough to be assessed.
How we hand over
- You receive documented procedures, configuration records and an evidence index mapped to the Annex A controls you include.
- We walk your internal owners through each record so they can produce it on request during stage 1 and stage 2 audits.
- Handover includes a list of open items, owners and dates so your team can plan the interval between stage 1 and stage 2.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover, which can cover surveillance year preparation.
- A retainer can keep evidence current for the annual audit that the three-year certification cycle requires in every calendar year.
- Changes to scope, AI systems or certification body requirements are handled through a written change to the agreed scope.
