ISO 42001 Certification

Certification Process and Requirements

The ISO 42001 certification audit follows the standard 2-stage model: Stage 1 (readiness review) and Stage 2 (on-site audit), followed by issuance of a 3-year certificate and annual surveillance audits. A detailed “roadmap” is:

• Preparation (Pre-Audit): Before engaging a CB, organizations establish their AIMS: define scope, governance structure, policies, and implement controls. This typically involves an internal gap analysis against ISO 42001 clauses and Annex A, developing an AI inventory, writing an AI policy, setting objectives, conducting AI risk and impact assessments, and documenting processes/controls. Many organizations perform at least one internal audit of the AIMS to verify readiness (ISO 42001 actually “requires that you perform an internal audit… including prior to the first Stage 1 audit”).
• Stage 1 Audit (Documentation Review): The CB reviews key AIMS documentation to confirm readiness. Auditors will examine the scope statement, AI governance framework, policies, risk assessment approach, Statement of Applicability (Annex A controls mapped to risks), and other foundational docs. The goal is to ensure all required processes are defined. The Stage 1 audit typically lasts a few days and includes interviews of key personnel. Auditors issue any areas of concern (AOCs) or minor findings, which the organization must address before Stage 2.
• Stage 2 Audit (Operational Effectiveness): This on-site audit verifies that the AIMS is implemented and effective. Auditors will observe processes and review records to check Clause 8 (operation) items: they will look for evidence that AI risks are actively managed, controls are working, internal audits and management reviews have been conducted, and continual improvement is happening. Typical evidence includes AI risk registers, AI model test logs, incident reports, training records, internal audit reports, and management review minutes. Stage 2 often spans several days (longer for broader scopes). At its conclusion the CB lists any nonconformities or observations. All major nonconformities must be resolved (with corrective actions) to obtain certification; minor findings are fixed in agreed time frames.
• Certification & Surveillance: Upon successful completion of Stage 1 and Stage 2 (and closure of findings), the CB issues the ISO 42001 certificate (valid 3 years). Annual surveillance audits (typically in Years 1 and 2) then verify continued compliance. These are shorter reviews focusing on any changes, key AIMS updates, and demonstration of monitoring/controls. A recertification audit is performed at the end of the third year to renew certification for another 3-year cycle.
• Surveillance & Nonconformities: During surveillance, auditors check that the organization has addressed prior audit findings and maintained the AIMS. Common findings in ISO 42001 audits include: missing or outdated AI risk registers, undefined or overly broad AIMS scope, incomplete documentation, lack of performance reviews (e.g. model monitoring), and unclear roles/responsibilities. (For example, RSI notes that “missing or outdated AI Risk Register” and “undefined AIMS Scope” are frequent gaps.) Organizations should correct any nonconformities promptly.