How ISO 42001 stage 1 and stage 2 audits work
If a customer or contract now asks for ISO 42001 certification, the first thing to understand is that initial certification is one audit in two stages, and only an accredited or recognized certification body can issue the certificate. DeployOpen prepares systems and evidence for that audit, but it does not audit or certify. The organization owns its AI management system and its controls, the certification body plans and performs both stages, and the certification body alone decides whether to recommend certification. Stage 1 reviews whether the management system is documented and ready for a detailed test. Stage 2 tests whether it is implemented and operating. Timing is driven by three things: the gap between the two stages, the scope the organization chooses, and how mature the management system is when stage 1 starts.
Stage 1 is where the certification body documents its conclusions on readiness for stage 2 and communicates them to the client, including areas of concern that could become a nonconformity later. Under ISO/IEC 17021-1, the certification body must also allow an interval between the two stages so the client can resolve those concerns. The standard sets no maximum length for that interval, so the certification body judges whether its stage 1 result still holds, particularly after significant changes to the AI systems or the organization. The reader should ask the certification body in writing how it will document stage 1 findings, how it will set the interval, and what it expects to see before stage 2 begins. Confirm these points directly with the certification body rather than assuming a standard timeline.
Stage 2 tests the implementation of the statement of applicability, the AI risk and impact assessments, the operational controls and the internal audit and management review cycle. Any major nonconformity must be closed within the window set by the certification body's rules. Under the ISO/IEC 17021-1 rule cited by European Accreditation, if corrections and corrective actions for every major nonconformity cannot be verified within 6 months after the last day of stage 2, the certification body must conduct another stage 2 before recommending certification. A practical step is to plan the evidence trail and corrective action records before stage 2, so that fixes can be verified inside that window. If the organization also seeks ISO/IEC 27001 certification, the stage 1 audit must confirm the level of integration between the two systems, and each finding must trace to the standard it relates to.
What happens from stage 1 planning to the certification decision
The two-stage initial audit moves from a planning step through documentation review, a formal list of concerns, a window for the organization to resolve them, and an evidence-based stage 2 test, ending with a decision by the certification body. Each phase produces a written output that the next phase depends on.
Agree the audit plan and scope
The certification body and the organization agree the scope of the AI management system, the sites and AI systems in scope, and the audit team. The certification body prepares an audit plan for each stage. The stage 1 plan may be informal, but it still needs to exist. You know this step is done when the scope statement and the stage 1 plan are on file and the organization has accepted them in writing.
Review documentation and readiness in stage 1
The auditor reviews the documented AI management system, including the AI policy, the statement of applicability, AI risk and impact assessment records, and the internal audit and management review records. The purpose is to judge whether the system is designed and documented well enough to be tested in stage 2. Stage 1 is usually conducted at the client's premises or remotely, depending on the certification body's arrangements. You know this step is done when the auditor has reviewed the core documents and recorded what was checked.
Issue documented stage 1 conclusions
The certification body documents its stage 1 conclusions on readiness for stage 2 and communicates them to the client. This report must include any areas of concern that could be classified as a nonconformity in stage 2. These concerns are the organization's main guide to what needs fixing before the next step. You know this step is done when the organization has received the written conclusions and the list of concerns.
Resolve stage 1 concerns in the interval
The organization uses the interval between the two stages to close the concerns from stage 1. This typically means revising documents, completing missing risk or impact assessments, running internal audits, or holding management review. The standard requires an interval so the client can act, but it sets no maximum length. The certification body must judge whether the stage 1 result is still valid, particularly if significant changes occur in the AI systems or the management system during that time. You know this step is done when each concern has documented evidence of correction.
Hold the stage 2 opening meeting
Stage 2 begins with an opening meeting between the audit team and the organization's leadership and process owners. The auditor confirms the scope, the audit plan, the sampling approach, and how findings will be reported. The meeting sets expectations for who will be interviewed and which records and AI systems will be sampled. You know this step is done when the attendance and agreed plan are recorded.
Test implementation and effectiveness in stage 2
The auditor tests whether the AI management system works in practice, not only on paper. This covers interviews with staff, sampling of AI systems across their life cycle, and checking evidence such as deployment approvals, verification and validation results, event logs, and monitoring records. Stage 2 is conducted on site or remotely, as agreed in the plan. Each finding is classified as a nonconformity or observation and must trace to the requirement it relates to. You know this step is done when every planned area has been tested and findings are recorded.
Close with the closing meeting and nonconformity follow-up
The audit team presents its findings at a closing meeting, distinguishing major nonconformities from minor ones. A major nonconformity affects the system's ability to achieve its intended results. The organization must show corrections and corrective actions. The certification body must be able to verify these within 6 months after the last day of stage 2; otherwise it must conduct another stage 2 before recommending certification. You know this step is done when the findings are acknowledged and the corrective action deadlines are confirmed in writing.
Make the certification decision
The certification body reviews the audit report, the evidence of corrective actions, and the closure of major nonconformities before deciding. Decisions are made by people independent of the audit team. The certification body alone issues the certificate, and only after its decision. ISO does not certify organizations. You know this step is done when the organization receives the decision in writing and, if certified, the certificate.
What stage 1 checks and what it reports
Stage 1 checks whether the AI management system is ready to be tested in depth, not whether it already works. The auditor confirms the scope of the AI management system, reviews the documentation against the management system requirements in clauses 4 to 10 of ISO/IEC 42001, and reads the statement of applicability to see which Annex A controls are included, excluded and justified under clause 6.1.3. Ask the certification body to state in writing which documents it will sample and which interviews it expects, so the organization can prepare the AI policy, the AI risk and impact assessment records, and the internal audit and management review records before the visit.
Under ISO/IEC 17021-1, the stage 1 conclusions must be documented and communicated to the client, including any areas of concern that could be classified as a nonconformity during stage 2 (European Accreditation FAQ 32.5). Treat that written output as the main action list for the next interval. Each concern needs an owner, a corrective step and evidence that the step was finished, because the time between stages is what lets the organization close them. The certification body decides whether the stage 1 result is still valid before stage 2, so a large change in scope or AI systems during that interval may require the organization to show what has changed.
A pre-audit is acceptable before stage 1 if impartiality is not compromised, but it cannot replace stage 1 and it cannot run between stage 1 and stage 2 (European Accreditation FAQ 48.11). Confirm with the certification body whether it offers a pre-audit, who performs it, and whether that person may later perform the stage 1 audit. A pre-audit gives an early view of gaps, but it does not produce the stage 1 report or the documented readiness conclusions that the formal stage 1 must issue.
Why the gap between stage 1 and stage 2 decides how fast you get certified
The interval between stage 1 and stage 2 is not a fixed waiting period. It is the time your organization needs to fix what stage 1 found and to build enough operating history for stage 2 to test. The five decisions below control how long that takes, and each one should be confirmed with your certification body in writing.
Closing stage 1 concerns
Stage 1 conclusions must be documented and communicated to you, including areas of concern that could become a nonconformity in stage 2. Each concern needs an owner, a fix and evidence that the fix works. Ask the certification body which stage 1 items it regards as likely nonconformities, because those set the minimum work before stage 2 can start.
Running operations long enough
Stage 2 tests whether the management system works in practice, so it needs records produced by operation. Internal audit and management review are the records most often missing at stage 2. Plan at least one full internal audit cycle and one management review before the stage 2 date, and confirm with the certification body what records it expects to sample.
Significant changes after stage 1
A stage 1 result is not permanent. If your AI scope, models, data sources, suppliers or intended uses change materially after stage 1, the certification body must judge whether its earlier findings still hold. An illustrative case: a new generative AI feature added to a credit workflow could require the impact assessment and statement of applicability to be revised before stage 2 proceeds.
Certification body scheduling
The certification body sets the stage 2 date based on auditor availability, its audit programme and the team it assigns. The interval is therefore partly outside your control. Ask for the proposed stage 2 date in writing at the close of stage 1, the auditor team composition and the consequences of rescheduling, since a delayed stage 2 also delays the start of any 6-month window for major nonconformities.
Maturity of AI impact assessments
AI risk and impact assessments are the evidence areas most likely to be judged immature. Auditors look for assessments that were performed on the actual systems in scope, reviewed when conditions change, and linked to treatment decisions and the statement of applicability. Before stage 2, check that each in-scope system has a dated, approved assessment and that the assessments reflect how the system runs today.
What stage 2 tests in operation
Stage 2 tests whether the AI management system is implemented and working across the scope the certification body accepted at stage 1, not whether the documents exist. The auditor takes samples of records and follows them through the organization: the statement of applicability justifications, AI impact assessments, verification and validation results, deployment approvals, event logs, internal audit findings and management review minutes. The question at each sample is whether the process ran as written, by the people named, with records that show the outcome. Before stage 2, confirm that every Annex A control you included in the statement of applicability has at least one dated record in operation, and that each exclusion still holds for the systems in scope.
Auditors classify what they find as a nonconformity or a major nonconformity, and the difference shapes your remediation plan. In the wording quoted by European Accreditation, a nonconformity is the non-fulfilment of a requirement. A major nonconformity is one that affects the capability of the management system to achieve its intended results. A single missing deployment approval for one system is usually a nonconformity. A management review that never happens, or an impact assessment process that no team follows, is more likely to be treated as major because it undermines the system as a whole. Ask the certification body in writing how it applies these definitions to your findings, since the classification is its decision, not yours.
Closing findings is a planned task with a deadline. Under the ISO/IEC 17021-1 rule summarized by European Accreditation, the certification body must verify corrections and corrective actions for every major nonconformity within 6 months after the last day of stage 2, or repeat stage 2 before it can recommend certification. Plan who owns each corrective action, what evidence proves it works over time (for example, a second cycle of internal audit or a repeated impact assessment), and when that evidence will exist. Confirm the exact handling of minor findings and the closure route with your certification body before the audit begins.
Closing major nonconformities within the 6-month limit
Major nonconformities found in stage 2 must be closed on a clock. The cards below follow one finding from root cause to verified closure, showing where the organization's work ends and the certification body's verification begins. Each step needs evidence that an auditor can check without guessing what changed.
The 6-month verification rule
Under ISO/IEC 17021-1, if the certification body cannot verify corrections and corrective actions for every major nonconformity within 6 months after the last day of stage 2, it must conduct another stage 2 before recommending certification. The clock starts after the last day of stage 2, not when the finding is written. Ask the certification body in writing how it will record that date and what it accepts as verification.
Classifying the finding correctly
A major nonconformity is a failure that affects the management system's ability to achieve its intended results, while a minor one does not reach that level. Classification determines whether the 6-month rule applies, so the organization should read the auditor's wording closely and ask for the reasoning behind any major finding. Disputes should be raised during the audit, before the report is final.
Root cause analysis before the fix
A correction fixes one instance, while a corrective action removes the cause so the failure does not recur. For an AI management system, a missing impact assessment might trace to unclear ownership, no trigger for reassessment after a model change, or a gap in the AI inventory. Record the method, the people involved and the cause found, because an auditor will test whether the fix addresses that cause.
Evidence of corrective action
Closure requires records that show the change was made and is working, such as a revised procedure with version history, the updated AI system register, training attendance, or a re-run of the affected process. A document saying the issue is fixed is weak evidence on its own. Before submitting, check each record against the clause or Annex A control named in the finding, so the auditor can trace one to the other.
Planning evidence for verification
Build a closure tracker that lists each major nonconformity, its owner, the corrective action, the evidence location and the date submitted. Give the certification body enough time to review and, if needed, to observe the change in operation. Agree the verification method in advance, whether it is a document review, a follow-up visit or a remote review, and ask what it will cost, since that depends on the method chosen.
Ownership of fixes and verification
The organization owns the fixes, the evidence and the decision to make them. An implementation partner can help prepare records and systems, but the certification body alone verifies corrections and decides whether they close the finding. Keep this split clear in the engagement scope so that no one assumes an outside party has accepted responsibility for a result it cannot certify.
How a combined ISO 42001 and ISO 27001 audit changes stage 1
A stand-alone ISO/IEC 42001 audit assesses only the AI management system against the requirements in clauses 4 to 10 and the controls the organization has included in its statement of applicability. Stage 1 is a document and readiness review of the AI management system as a whole. The auditor checks scope, the AI policy, roles, the AI risk and impact assessment approach, and whether the statement of applicability justifies each Annex A inclusion or exclusion. Stage 1 concludes with documented observations on readiness for stage 2, including areas of concern that could become nonconformities. The certification body must communicate those conclusions to the client.
- Scope and boundary: the stage 1 review confirms which AI systems, business units and sites fall inside the certificate scope.
- Statement of applicability: the auditor checks that every excluded Annex A control has a stated justification.
- Management system operation: internal audit and management review must have run far enough to produce records.
- Stage 1 report: the conclusions on readiness are documented and shared with the organization.
- Interval: the organization uses the time before stage 2 to close the concerns raised in stage 1.
Confirm with the certification body which documents it expects at stage 1 and whether it wants a stage 1 plan in writing.
When an organization already holds an ISO/IEC 27001 certificate, or audits both standards at the same visit, the certification body may combine the audits. Global ACI-TECH-3-008 requires the stage 1 audit to confirm the level of integration between the two management systems. That confirmation determines how much of the ISO 27001 documentation, risk process and internal audit programme the ISO 42001 audit can reuse, and which parts still need separate evidence. The auditor records the integration decision during stage 1 so that stage 2 tests against the same plan.
- Level of integration: stage 1 establishes which policies, risk processes and internal audit activities are shared and which are specific to AI.
- Shared documentation: a single document set can serve both standards only where each AI requirement is still addressed explicitly.
- Separate AI controls: AI-specific areas such as impact assessment, data provenance and AI system life cycle need their own evidence.
- Plan and sampling: the combined audit plan must show how each standard is sampled and at what depth.
- Stage 1 confirmation: the auditor confirms the integration approach before stage 2 is scheduled.
Confirm in writing whether the certification body treats the ISO 27001 certificate as a basis for reduced ISO 42001 stage 1 work or only as shared context.
An integrated audit covers both standards in one visit and may produce one report. Global ACI-TECH-3-008 permits integrated or separate reports, and the choice is a matter for the certification body and the client to agree. An integrated report is convenient for management, but it must still make clear which findings relate to ISO/IEC 42001 and which relate to ISO/IEC 27001. Each finding must trace to the standard it relates to, so a single finding cannot be left unattributed in a combined document.
- Report format: confirm whether the certification body issues one integrated report, two separate reports or a combined report with separate sections.
- Finding traceability: every nonconformity names the clause or Annex A control it relates to.
- Classification: a major nonconformity under one standard is handled under that standard's closure rules, even when it appears in a shared report.
- Certificate outcome: each standard may be certified on its own result, so one open finding does not automatically hold back the other.
- Closure tracking: corrections for each finding are tracked against its standard and its deadline.
Ask the certification body for a sample integrated report before contracting, so you can see how findings are traced.
The combined model is set by the certification body's own procedures, not by the organization's preference. Because the integration decision shapes stage 1, the sampling and the report, it should be agreed in writing before the stage 1 date is fixed. Illustrative example: an organization with a current ISO 27001 certificate may expect shared access control evidence to count once, but the auditor may still require separate records showing how AI system access is governed. Settling that question early avoids repeating evidence work during stage 2.
- Integration level: request the certification body's written statement of how it will confirm integration at stage 1.
- Report model: ask whether reports are integrated, separate or both, and who receives each.
- Sampling approach: confirm how samples are drawn for each standard and whether they overlap.
- Finding classification: confirm how findings are labeled by standard and how major nonconformities are handled.
- Cost and timing: ask how a combined audit changes the audit days quoted and whether it affects the interval before stage 2.
Only the independent certification body decides the audit model and issues the certificate. An implementation partner can prepare the shared documents and evidence, but the decision on integration belongs to the auditor.
Who owns each stage deliverable
This table compares who prepares, who decides and who signs off on each stage 1 and stage 2 deliverable across the organization, an implementation partner such as DeployOpen, and the independent certification body. Read each row as a handoff: the partner prepares the systems and evidence, the organization owns its controls and decisions, and only the certification body issues findings, reports and the certification decision.
| Deliverable | Organization and partner | Certification body |
|---|---|---|
| Stage 1 documentation | Organization owns the AI policy, scope, statement of applicability and risk records. Partner can help assemble the documented information set but cannot approve it. | Reviews the documentation against the standard and records what it reviewed in the stage 1 report. |
| Stage 1 concerns | Organization decides how to resolve each concern, assigns owners and sets the work plan before stage 2. | Documents areas of concern that could become nonconformities in stage 2 and communicates them to the client. |
| Interval before stage 2 | Organization schedules and funds the remediation work. Partner may support implementation of controls and evidence collection. | Judges whether the stage 1 result still holds, especially after significant changes to the AI management system. |
| Corrective actions for nonconformities | Organization writes and implements corrective actions and keeps the records that prove them. | Verifies each correction and corrective action. For major nonconformities, must verify within 6 months after stage 2 or repeat stage 2. |
| Stage 2 evidence | Organization runs the controls and produces operating records. Partner prepares systems, logs and evidence trails for the auditor to sample. | Samples evidence, interviews staff and determines whether the system operates as documented. |
| Audit findings and report | Organization receives findings and responds to them. Partner has no role in classifying findings. | Classifies findings as nonconformities or observations and issues the audit report. |
| Certification decision and certificate | Organization accepts the decision and meets its obligations for surveillance and recertification. | Makes the certification decision and issues the certificate. ISO does not certify organizations. |
Questions buyers ask about ISO 42001 stage 1 and stage 2
How long do ISO 42001 stage 1 and stage 2 take, and what sets the gap between them?
No supplied figure fixes the duration of either stage, so confirm the planned days and calendar dates with your certification body before you commit. The gap between stages is set by the certification body, which must allow time for you to resolve concerns found in stage 1. Clause 9.3.1.2.4 of ISO/IEC 17021-1 requires that interval, but the accreditation guidance sets no maximum. The certification body must judge whether the stage 1 result still holds, especially after significant changes to your AI management system. Ask for the planned gap in writing, the conditions that would trigger a repeat of stage 1, and how stage 2 scheduling depends on your readiness.
Can a pre-audit replace the ISO 42001 stage 1 audit?
No. A pre-audit cannot be used as a stage 1 audit. Under the IAF position recorded in European Accreditation FAQ 48.11, a pre-audit before stage 1 is acceptable if impartiality is not compromised, but a pre-audit is not acceptable between stage 1 and stage 2. A pre-audit is a voluntary readiness check that can highlight gaps, but it does not produce the documented stage 1 conclusions the certification body must issue. Treat it as preparation, and confirm with the certification body how it will treat any pre-audit findings and whether the same firm can later perform stage 1 without a conflict of interest.
What must the organization provide before stage 1 and stage 2 begin?
Before stage 1, you need a defined scope, a statement of applicability that lists the Annex A controls you include or exclude with reasons under clause 6.1.3, and documented AI management system records for the clauses 4 to 10 requirements. Before stage 2, you need evidence that these processes operate in practice, not just on paper. Typical items include AI risk and impact assessment records, internal audit and management review records, and evidence of operated controls. Ask the certification body for its document request list and the format it expects, since the list determines how much work stage 1 takes.
Can our own team run the stage 1 readiness work without outside help?
Yes, your team can prepare for stage 1 without an outside firm, provided it understands clauses 4 to 10 and the Annex A controls and has the authority to change processes. Independence matters at the audit itself: only the certification body performs stage 1 and stage 2 and issues the report and certificate. An implementation partner can prepare systems, documentation and evidence, but it cannot audit its own work or issue a certificate. If you bring in help, agree in a fixed written scope which tasks the partner owns, which the organization keeps, and how the partner stays independent of the certification body.
What happens if a major nonconformity is not closed within 6 months?
If the certification body cannot verify corrections and corrective actions for every major nonconformity within 6 months after the last day of stage 2, it must conduct another stage 2 before it can recommend certification, as set out in European Accreditation FAQ 36.14. A major nonconformity is one that affects the capability of the management system to achieve its intended results. The practical consequence is that a slow fix can cost you a repeat audit, so plan corrective actions during stage 2 and collect objective evidence of each fix. Confirm the closure process, the evidence format and the deadline with your certification body in writing.
Does a combined ISO 42001 and ISO 27001 audit reduce stage 1 effort?
It can reduce duplicated effort, but it does not remove the separate requirements. Global ACI-TECH-3-008 requires the stage 1 audit to confirm the level of integration when ISO/IEC 42001 is audited with another standard such as ISO/IEC 27001. Reports may be integrated or separate, but each finding must trace to the standard it relates to. Shared work such as document control, internal audit, management review and risk registers can often be reused, while AI-specific items such as impact assessments and AI life cycle records still need their own evidence. Ask the certification body how it will plan the combined audit and which findings it will record against each standard.
Who is allowed to certify an organization against ISO 42001?
Only an external certification body can issue an ISO 42001 certificate. ISO does not certify organizations itself. Accreditation of certification bodies is voluntary, and the requirements for bodies certifying AI management systems are set out in ISO/IEC 42006:2025, which adds to ISO/IEC 17021-1. Before you contract, ask the body whether it holds accreditation for ISO/IEC 42001 and which accreditation body issued it, then verify that scope directly with that accreditation body. Consultants and implementation partners cannot certify you, and a firm that prepared your management system should not perform the certification audit.
How DeployOpen prepares ISO 42001 systems and evidence for stage 1 and stage 2
DeployOpen prepares the systems, controls and records that an organization presents at ISO 42001 stage 1 and stage 2, inside the client's own infrastructure. The organization owns its AI management system and its controls, and only an independent certification body issues the certificate.
How we scope
- Agree the written scope of the AI management system and the Annex A controls in the statement of applicability before work starts.
- Confirm which AI systems, environments and teams fall inside the audit boundary for stage 1.
- Identify any integration with an existing ISO 27001 management system and record the agreed level of integration.
How we build
- Configure self-hosted open-source platforms that hold AI inventory, risk and impact assessment, and change records.
- Set up logging, monitoring and access controls so stage 2 can sample operating records over time.
- Prepare internal audit and management review records in the formats the client's auditor is expected to test.
How we hand over
- Deliver a documented evidence map linking each in-scope control to its records, owners and storage location.
- Provide a log of gaps raised during preparation, with the corrective actions the client owns and the status of each.
- Document the stage 2 readiness position so the client can review it with its certification body before the audit.
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Ongoing support, upgrades and continuous testing are available as a retainer after the audit.
- The client decides how to respond to certification body findings, and DeployOpen does not issue audit reports or certificates.
Sources and further reading
- ISO/IEC 42001:2023 (ISO) ↗
- ISO/IEC 42001:2023 preview: contents, introduction and scope ↗
- European Accreditation FAQ 32.4: two-stage initial audit ↗
- European Accreditation FAQ 32.5: stage 1 output ↗
- European Accreditation FAQ 49.3: interval between stage 1 and stage 2 ↗
- Global ACI-TECH-3-008 (M): integrated management system audits ↗
