ISO 42001 surveillance audit and recertification explained

How often ISO 42001 surveillance and recertification audits happen

At least one audit must take place in every calendar year, either a surveillance audit or a recertification audit, and a delayed audit cannot be used to push the following year's audit back. The certification cycle is three years, and the certificate must show the expiry or recertification due date that completes the cycle. An organization holding or about to receive an ISO 42001 certificate should therefore plan one audit per calendar year and mark the cycle end date on its compliance calendar from the day the certificate is issued.

The exact audit dates, sampling and audit time are set by the certification body's audit programme, and they depend on the scope of the certificate, the number of AI systems in scope and the changes made since the last audit. The certification body reviews planned audit time at each surveillance and recertification audit to reflect those changes and the maturity of the system, so a major new AI system or a change in supplier can alter the plan. Ask the certification body for its audit programme in writing, and tell it about material changes before it sets the next date.

The organization owns its AI controls and decides how they run. An implementation partner, if one is used, prepares systems and evidence but does not decide the outcome. Only the certification body, which must hold accreditation for ISO/IEC 42001 certification, can issue or maintain the certificate. Accreditation for this scope is still developing, so confirm the certification body's accreditation status and the certificate's scope with that body before relying on any certificate in a customer contract or tender.

How the three-year cycle runs from certificate to recertification

The sequence turns one certification decision into a repeating cycle of audits, where each step produces a record the certification body uses to decide whether the certificate stays valid. Read in order, it shows where the calendar-year audit rule and the three-year expiry constrain planning.

Issue the certificate after stage 2
The certification body makes the certification decision after the stage 2 audit and any major nonconformities have been closed and verified. The certificate it issues must show the expiry or recertification due date that completes the three-year cycle. Your records should confirm the certificate scope, the statement of applicability in force at the time, and the date that starts the cycle. You know this step is complete when the certificate and its due date are on file and the team has noted the calendar year of each required audit.
Complete the first surveillance audit
The first surveillance audit falls in the calendar year after certification. It must include continuing operational control, so the auditor tests how the AI management system runs in practice, not only the documents. Before the visit, the certification body obtains updated client data and reviews the planned audit time to reflect changes in your organization and in system maturity. The output is an audit report with any nonconformities recorded and graded, and the decision is whether the certificate remains valid.
Close nonconformities and verify corrections
Each nonconformity from the surveillance audit needs a documented correction and corrective action, which the organization owns and the certification body reviews. Corrective actions should address the root cause, such as a missing risk assessment review or an outdated entry in the statement of applicability, rather than only the single example found. The certification body verifies major nonconformities before they can support continued validity. You know this step is complete when the auditor has accepted the evidence and recorded the closure in the audit file.
Complete the second surveillance audit
The second surveillance audit falls in the next calendar year, and again must test continuing operational control across the AI management system. The auditor reviews whether earlier findings were corrected, whether internal audit and management review still run on schedule, and whether changes to AI systems, suppliers or intended use have been assessed. The certification body updates client data and the planned audit time before the visit. The output is a second audit report and nonconformity record, and the decision is again whether the certificate remains valid for the cycle.
Plan and complete the recertification audit
The recertification audit completes the three-year cycle and must finish before the certificate expires. It covers the full management system again, including the risk and impact assessments, the statement of applicability and the evidence for the controls you have included. The certification body issues a recertification audit report and records any nonconformities. You should confirm the scheduled date early, because if the audit is not completed, or major corrections are not verified, before expiry, recertification is not recommended and validity is not extended.
Decide on recertification and issue the new cycle
The certification body reviews the recertification audit report, the nonconformity records and the verification of corrections before it makes a recertification decision. If the decision is positive, it issues a certificate that starts a new three-year cycle with a new expiry or recertification due date. If major corrections remain open, recertification is not recommended. The output is the new certificate and updated audit programme, and the cycle restarts with the calendar-year audit rule.
Hold the calendar-year audit rule
Across the whole cycle, at least one audit must take place in every calendar year, either a surveillance audit or a recertification audit. A delayed audit cannot be used to push the following year's audit back, so a slipped visit cannot be absorbed by moving the next one. Ask your certification body to confirm the audit dates for each calendar year in writing when the certificate is issued, and keep that plan with the certificate records. You know the cycle is on track when each calendar year has a dated audit in the programme.

What a surveillance audit must cover beyond paperwork

The core point is that a surveillance audit cannot be a document review. Under the certification body rules that apply to ISO/IEC 42001 certification, every surveillance audit must include continuing operational control, so the auditor tests how the AI management system runs in practice. European Accreditation FAQ 44.2 makes this explicit for ISO/IEC 17021-1 audits: a surveillance audit cannot be limited to the documents and records of the management system. Expect the auditor to pick a sample of AI systems and trace each one back through its impact assessment, risk treatment decisions, verification and validation results, deployment approval, and event logs. The auditor will ask whether those records were created when the system changed, not only when the last audit was prepared for.

Beyond the AI systems themselves, the sample usually reaches the management review and internal audit records, and the status of corrective actions raised at earlier audits. A finding that was closed on paper but has recurred in a later sample is a problem the auditor will record. Changes to scope also get tested. If the organization added a new AI system, retired one, or moved a data source or third party into the scope, the auditor will check whether the scope statement and the statement of applicability were updated, and whether the justification for each included or excluded Annex A control still holds. Keep the statement of applicability current at every change, not only before the audit.

Confirm the exact sample size, the evidence list and the time allocated to each area with your certification body before the audit. The planned audit time and sample are set by its audit programme and reviewed at each surveillance and recertification audit to reflect changes in the organization and the maturity of the system, so they will differ between certification bodies and between organizations. Ask for the audit plan in advance and ask which AI systems, impact assessments and internal audit records it intends to sample. Then run an internal check on those same items a few weeks ahead, so that the first time anyone looks at them is not during the audit.

Which route fits: recertify on time, restore after expiry, or transfer

This table compares three situations an ISO 42001 certificate holder can face near the end of its cycle: recertifying before expiry, restoring after expiry, or transferring to another certification body. Read each row for what the certification body can do, what the organization must finish, and where the main risk sits. The main takeaway is that recertification must be completed before the certificate expires, because validity is not extended if it is not.

Situation	What the certification body can do	What the organization must complete	Main risk
Recertification completed before expiry	Issues the recertified certificate, which must show the expiry or recertification due date that completes the three-year cycle	Complete the recertification audit and verify corrections for any major nonconformity before the certificate expires	If the recertification audit or major nonconformity verification is not finished before expiry, recertification is not recommended and validity is not extended
Certificate expired, recertification activities outstanding	Can restore the certificate within 6 months if the outstanding recertification activities are completed	Finish all outstanding recertification activities within the 6-month window	If the activities are not completed in time, at least a stage 2 audit is required, which adds effort and delay
Expired certificate, restoration not possible	Requires at least a stage 2 audit before the certificate can be issued again	Run the management system through a stage 2 audit and close any major nonconformities	Loss of certified status for the period and a longer path back to certification
Transfer to another certification body	Accepts the transfer of accredited certification under the mandatory Global ACI transfer document (Global ACI-TECH-3-002 (M))	Confirm the receiving body follows the transfer rules and provide the records it requests before the existing certificate lapses	A transfer started late can leave a gap in certified status if the current cycle ends first
Transfer combined with recertification	Depends on the receiving body's transfer process and its audit plan for the current cycle	Agree in writing who schedules the recertification audit and whether it falls before or after the transfer	Duplicate audit effort or confusion over which body owns the next audit date

Who owns each part of the surveillance and recertification work

The organization owns its AI management system and every control it claims in its statement of applicability. Its own people make the decisions that keep the certificate valid: they keep AI system records current, decide when a system changes enough to affect scope, run internal audits and management review, and act on nonconformities. No outside party can take these decisions on the organization's behalf, and an auditor will ask who made them and when.

AI system records: Owners update inventories, impact assessments, data records and deployment approvals whenever a model, dataset, vendor or use case changes.
Internal audit and management review: Staff schedule and carry out internal audits of the AI management system and hold management review meetings with recorded decisions before each certification audit.
Scope decisions: Leadership decides whether a new AI system or business unit falls inside the certified scope and updates the statement of applicability with a justification.
Nonconformity handling: Owners record root cause and corrective action for every finding, and they keep proof that each correction works in operation.
Evidence preparation: The organization assembles records for each audit, names the people who can explain them, and confirms that the evidence reflects day-to-day operation rather than a one-time exercise.

Before each audit, check that a named internal owner can walk an auditor through every record without relying on a consultant.

What makes surveillance and recertification heavier or lighter

The certification body sets audit time from the organization's size and complexity, and it reviews that planned time at every surveillance and recertification audit, so the time can go up or down between cycles. The cards below cover the drivers that most often change it and what the organization can do to keep its audits proportionate.

Number and risk of AI systems in scope

Every AI system inside the certified scope is sampled and traced through its life cycle, impact assessment and monitoring records. Adding systems, or moving a system into a higher-risk use, adds sampling and evidence review at the next audit. Before each audit, confirm the AI system inventory matches the scope in the statement of applicability and record which systems were retired, added or reclassified since the last visit.

Changes to models, data and suppliers

Model updates, new training or retrieval data sources, and new AI suppliers each create records the auditor expects to see: version histories, data provenance, supplier assessments and change approvals. Changes made without a documented trail are the most common reason an auditor widens sampling. Keep a change log that links each model, data or supplier change to its risk assessment and approval, so the audit can follow it without reconstruction.

Number of Annex A controls included

The statement of applicability justifies which of the 38 Annex A controls the organization includes and excludes. A broader set of included controls means more operating evidence to test at every surveillance audit, while a narrow set with well-reasoned exclusions is simpler to sustain. Review each exclusion at every cycle point and confirm that the justification still holds after changes to the AI portfolio.

Maturity of internal audit and management review

Surveillance audits must include continuing operational control, so auditors look for evidence that the management system runs on its own schedule. Internal audits and management reviews that run on time, produce findings and close them lower the effort needed to demonstrate control. Weak or missing records of these reviews tend to produce nonconformities, which add follow-up work and can extend the audit. Confirm the internal audit programme and management review minutes are current before each visit.

Integration with ISO 27001 or other systems

When ISO 42001 shares a management system with ISO 27001 or another standard, the common clauses and processes can be audited once, which can reduce duplicated sampling. The certification body still decides the audit time for each scope, so ask it how an integrated audit would be planned before relying on savings. Shared risk registers, document control and internal audit programmes make that approach workable. Divergent processes for the two standards usually offset any saving.

Number of sites and locations

Each site where AI systems are developed, hosted or operated can require its own sampling and on-site time, and remote or cloud-hosted locations still need to be covered by the scope. Adding a site, or a new development team in another country, usually increases audit days at the next visit. Maintain a current list of locations and the controls that apply at each one, and ask the certification body how it will sample across them.

Questions buyers ask about ISO 42001 surveillance and recertification

Does an ISO 42001 certificate need an audit every year after it is issued?

Yes. At least one audit must take place in every calendar year, either a surveillance audit or a recertification audit, and a delayed audit cannot be used to push the following year's audit back. The certification cycle runs for three years under ISO/IEC 17021-1, and the certificate must show the expiry or recertification due date that completes that cycle. Confirm the exact audit dates and the number of audit days with your certification body, because its programme sets the plan for each cycle and it reviews planned audit time at every surveillance and recertification audit as the organization and its AI management system change.

Can a surveillance audit be done on documents and records only?

No. Every surveillance audit must include continuing operational control, so it cannot be limited to reviewing the documents and records of the management system. Auditors will expect to see the AI management system working on live or recent AI systems, including risk and impact assessment outputs, approvals, monitoring, event logs and corrective actions. Prepare for this by keeping records current throughout the year rather than assembling them before the audit, and ask your certification body how it plans to sample AI systems and processes in each visit.

What happens if the recertification audit is not finished before the certificate expires?

Recertification is not recommended and validity is not extended. If the recertification audit is not completed, or corrections for any major nonconformity are not verified, before the certificate expires, the certification body cannot simply carry the certificate forward. Plan the recertification window with the certification body early, schedule the audit with enough margin for corrective actions to be verified, and agree in writing what happens if a major nonconformity is still open near the expiry date.

Can an expired ISO 42001 certificate be restored, and within what limit?

Possibly, but only within a fixed limit. After a certificate expires, the certification body can restore it within 6 months if the outstanding recertification activities are completed. If that window is missed, or the activities are not complete within it, at least a stage 2 audit is required before certification can be restored. Confirm with the certification body which activities it counts as outstanding, how it handles the restoration decision, and whether it requires a fresh stage 2 audit in your case.

Can an organization move its ISO 42001 certificate to another certification body?

Yes, transfer is possible for accredited management system certification, governed by a Global ACI mandatory document issued on 10 July 2026. The receiving body needs to verify the existing certificate and the status of open findings before accepting the transfer, so gather the latest audit reports, nonconformity records and the current statement of applicability before approaching a new body. Note that ISO/IEC 42001 is not yet listed as an endorsed sub-scope of the Global ACI arrangement, so confirm the accreditation status of any proposed body and the scope of its accreditation for AI management systems before you agree to a transfer.

How much internal effort does surveillance and recertification take, and what does the team need to provide?

The effort is recurring, and it is driven by how much of the AI management system is kept current. The main internal roles are a management representative who owns the system, control owners for the AI systems in scope, people who run internal audit and management review, and staff who can show evidence for event logs, monitoring and impact assessments. Effort rises when records are created only at audit time, when the scope has grown, or when AI systems change often. Ask your certification body for its planned audit days for each year of the cycle, and ask any consultant to estimate the internal hours in a written scope before work starts.

Can an implementation partner prepare the evidence for surveillance and recertification audits?

Yes, an implementation partner can help prepare systems, controls and evidence, such as organizing records, testing monitoring and event logging, and keeping the statement of applicability aligned with real operations. The organization still owns its controls and decides what to report. DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside the client's own infrastructure, and its ongoing support is offered as a retainer under a written scope. Only the independent certification body issues certificates and audit outcomes, so an implementation partner cannot guarantee a result.

Can a consultant or partner sign off that the organization is ready for a surveillance or recertification audit?

No. A consultant or implementation partner can review readiness and report gaps, but only the independent certification body decides whether the audit findings support certification. An internal readiness review is useful for finding open actions before the audit, yet it cannot replace the certification body's own assessment. Keep the independence clear in your contract: the partner should not be the party that decides whether the organization passes, and you should confirm with the certification body what pre-audit review, if any, it will accept.

Mistakes that cause missed audits and lapsed certificates

Most lapsed ISO 42001 certificates trace back to a small set of scheduling, record-keeping and evidence gaps that build up quietly between audits. Each card below names one of these mistakes, the consequence an assessor or certification body will apply, and the control that prevents it.

Pushing the annual audit back

An audit must take place in every calendar year, either a surveillance or a recertification audit, and a delayed audit cannot be used to push the following year's audit back. Teams that leave the booking until late in the year often find the certification body has no slot left, and asking to move the date into the next year is not an option. Put the next audit date on the calendar when the current certificate is issued, and confirm with the certification body which calendar year each audit falls in.

Letting internal audit lapse

Clause 9 of ISO 42001 requires internal audit and management review of the AI management system, and certification auditors check the records of both at each visit. When these reviews are skipped between audits, the organization has no evidence that its controls still work, and nonconformities tend to surface at the next surveillance audit. Keep a dated internal audit programme and management review schedule, with minutes that record decisions and actions, and confirm that each cycle has a named owner.

Missing changes to AI systems

AI systems change through new models, retrained weights, new data sources, altered prompts and new use cases, and each change can alter the risks, impacts and controls already documented. If the impact assessment, system records and statement of applicability are not updated to match, the certification body will find that the documentation describes a system that no longer exists. Run a change log that links each AI system change to a risk review and a statement of applicability update before the change goes live.

Leaving major nonconformities open

A major nonconformity must be corrected and the correction verified before recertification can be recommended, and the certificate's validity cannot be extended while that is outstanding. After expiry, restoration within 6 months is possible only if the outstanding recertification activities are completed. Otherwise a stage 2 audit is required. Track each nonconformity against its verification date and plan the corrective action well before the expiry date.

Treating surveillance as a document check

Every surveillance audit must include continuing operational control, so the auditor examines whether AI systems are governed in practice, not only whether policies and records exist. Teams that prepare only a folder of documents tend to fail when the auditor asks to see a live system, a recent decision and the evidence that followed it. Prepare operational samples for each in-scope AI system, such as recent approval records, monitoring output and event logs, and rehearse how staff explain them.

Skipping the accreditation check

Transfers between certification bodies are governed by a mandatory accreditation document, and the receiving body's accreditation status determines whether its certificate carries weight with customers and regulators. ISO 42001 accreditation is voluntary and is not yet an endorsed sub-scope of the Global ACI arrangement, so an organization that assumes accreditation without checking may end up with a certificate of limited standing. Ask the proposed certification body for its accreditation scope in writing, and verify it with the accreditation body before signing the transfer.

How to choose a certification body and a consultant for ongoing audits

The organization that certifies you and the firm that helps you prepare for surveillance and recertification should be chosen separately, with different checks. The cards below cover accreditation, independence, experience, scope and the questions to settle before any contract is signed.

Confirm the certification body's ISO 42001 accreditation

Ask the certification body which accreditation body accredits it for ISO/IEC 42001 and request the accreditation scope in writing. ISO 42001 is not listed as an endorsed sub-scope of the Global ACI arrangement in the supplied version, so a recognition statement from another body does not prove that the certificate is accredited for this standard. Check the scope document directly with the accreditation body before you rely on any certificate it issues.

Keep the preparer and the auditor apart

The consultant that writes your risk assessments, statement of applicability and internal audit records should not be the body that audits the same cycle. An auditor that helped build the evidence cannot evaluate it independently, and the certification body must keep its impartiality. Ask each firm to describe its conflict checks and to confirm in writing which organization it will not serve for the same audit.

Check experience with AI management system audits

Ask for evidence that the auditing team has performed ISO/IEC 42001 audits, not only ISO 27001 audits with AI added to the scope. Surveillance audits must include continuing operational control, so auditors need to test AI systems in operation, including monitoring, incident handling and changes to models or data. Ask who will sit on the team, what sector experience they hold and how they plan audit time when your AI use changes.

Write the scope and fee basis down

Ask for a written scope that names the AI systems, sites, clauses and Annex A controls covered by each surveillance or recertification audit. Require the fee basis to state what is included, what counts as additional audit time and how changes to the organization or system maturity will be priced. Verbal estimates for surveillance work tend to drift when new AI systems are added, so the written scope should say how changes are handled.

Ask who writes and who owns the evidence

Confirm whether the consultant drafts evidence, such as policies, impact assessment records and management review minutes, or only reviews what your own staff produce. The organization owns its controls and must be able to operate and explain them after the consultant leaves. Ask who approves each record, where it is stored and whether your staff can answer auditor questions without the consultant present.

Agree what happens when a deadline slips

Before signing, ask what happens if a surveillance audit is postponed, if a major nonconformity is open near a deadline or if recertification cannot be completed before the certificate expires. Ask the certification body how it handles restoration and what the consultant will do to support corrective action within the agreed scope. Get the answers, including any added costs, in the contract rather than relying on general assurances.

How DeployOpen prepares evidence for each ISO 42001 audit

DeployOpen prepares the systems, controls and records that an ISO 42001 surveillance or recertification audit will examine, inside your own infrastructure. The certification body owns the audit decision and issues any certificate, and your organization keeps ownership of its AI governance.

How we scope

Engagements are fixed-scope, with the AI systems, Annex A controls and audit period agreed in writing before work starts.
We confirm which controls on your statement of applicability changed since the last audit and what each change affects.
Ongoing support for evidence upkeep between audits is available as a retainer, scoped separately from the audit preparation.

How we build

We set up self-hosted open-source tooling that keeps AI risk, impact assessment and change records current across the cycle.
We configure event logging and monitoring so operational records exist for the continuing operational control an auditor will test.
We help run internal audit and management review routines so their records are dated, complete and traceable to findings.

How we hand over

You receive an evidence index mapping each in-scope control to its records, owners and storage locations.
We document how corrective actions from the previous audit were closed, with the supporting records attached for review.
You receive runbooks describing how the evidence is refreshed, so your staff can answer the certification body's requests directly.

How we support

We prepare a pre-audit review of records against the planned audit scope, and you confirm the findings and any remediation owners.
Before a recertification audit, we help check that every major nonconformity has verified corrections in place, ahead of the expiry date.
Continuous testing and upgrades of the platforms are available as retainers, and we ask you to confirm the certification body's requirements in writing.