TL;DR
ISO 42001 certification is an independent audit that confirms your AI management system meets ISO/IEC 42001:2023 and actually runs as written. It is voluntary, and an independent certification body issues it, ideally one whose accreditation covers ISO/IEC 42001. You prepare in four steps: scope, gap analysis, an evidence pack, and an internal audit with a management review. The certification body then runs a Stage 1 document review and a Stage 2 test of how your controls operate. Stage 1 takes one or two days, Stage 2 three to nine or more, with four to twelve weeks between them. One published price guide puts the year-one audit in the $20,000s to $40,000s; the certificate lasts three years, with surveillance audits in years two and three.
Key Takeaways An outside auditor tests whether your AI management system works in practice, which a self-declared “we follow the standard” claim never shows. Scope is the first and most expensive decision, because every AI system inside it becomes something the auditor can sample. A gap analysis should map Clauses 4 to 10 and the Annex A control groups to the records an auditor will ask to see. Stage 1 checks that the system is designed and documented, while Stage 2 checks that controls have been operating over time. Choose a certification body whose accreditation covers ISO/IEC 42001, and check it in the accreditation body’s own directory. Budget for three years, covering the initial audit, two surveillance audits, internal effort and the work that closes any findings. Watch on YouTube
AI Security for Enterprises: Kanerika’s CISO on Prompt Injection, ISO 27001 & SOC 2
Kanerika’s CISO explains what years of ISO 27001 and SOC 2 audits teach about AI security, and the evidence habits any certification auditor will test.
Spend One Afternoon in the Auditor’s Chair
The Stage 2 auditor opens your AI inventory and points at one line, perhaps a customer-support assistant built on a third-party model. Then come the requests.
Show me the impact assessment for this system, the risk it raised and the treatment you chose. Show me the line in your Statement of Applicability that covers it, and the monitoring record from last month.
Each request is reasonable, and each one tests whether paperwork and practice match. A policy on the intranet, however, answers none of them. What answers them is a trail of dated records that someone created while doing the work, long before the auditor arrived.
That trail is what ISO 42001 certification really buys. So the steps below follow the order an auditor checks them. That way, your team builds the trail before anyone asks to see it.
What ISO 42001 Certification Proves, and What It Does Not
ISO/IEC 42001 is, in ISO’s own words, the first global standard for an AI management system . It covers how you establish, run, maintain and improve one. ISO also states that certification is voluntary and that ISO itself certifies no one. Independent certification bodies do the auditing, and national accreditation bodies may accredit them.
So a certificate says one specific thing. An outside auditor has checked your AI management system (AIMS) against the standard and found that it meets the requirements within a stated scope. It sits on top of whatever AI governance framework you already use, and it turns your internal claims into evidence someone else has tested.
Alignment vs Certification
Many companies say their program “follows ISO 42001,” but that phrase carries no outside check. An internal AI governance assessment sits in the middle, because it tests your controls but still reports to you. The table shows where each option leaves you.
Question Self-declared alignment ISO 42001 certification Who checks the controls? Your own team, or nobody An accredited certification body Is there a certificate? No Yes, for a defined scope Is ongoing review required? Only if you choose it Annual surveillance audits for three years What does a buyer get? Your word and your documents An outside opinion they can verify Typical use Internal improvement and early maturity work Customer contracts, procurement and supplier assurance
When Certification Is Worth Paying For
The clearest trigger is a customer who asks for it in a security questionnaire or a contract. Others include selling AI features into regulated buyers, or running many AI vendors who each want proof from you. Where none of these apply yet, an alignment program measured against an AI governance maturity model is often the cheaper first move.
What a Certificate Does Not Cover
A certificate covers the management system, not each model’s accuracy. It does not promise error-free outputs, and it does not make you compliant with any law on its own. For instance, obligations under the EU AI Act remain a separate legal question, which our guide to EU AI Act compliance covers in detail.
Still, the overlap is real, because the records do double duty. The risk registers, impact assessments and supplier reviews you build for certification are the same records regulators and boards tend to ask for. That is why many teams treat certification as part of a wider AI governance program rather than a one-off project.
Step 1: Draw the AIMS Scope the Auditor Will Test
Scope comes first because it decides how much work everything else takes. ANAB, a US accreditation body, notes that an AIMS depends on the organization’s size, structure and objectives.
It also depends on its role as a producer, provider or user of AI . A company that builds models carries different duties from one that only buys AI features inside SaaS tools.
Start with an inventory of every AI system in the candidate scope. Include in-house models, vendor copilots and AI features inside existing software.
Also add the tools staff adopted on their own, because shadow AI is exactly what an auditor’s interviews tend to surface. For each entry, record the owner, the business unit, your role and any third party involved.
Next, decide the boundary. A narrow scope, such as one product line, gets you to an audit sooner, but buyers will read the scope statement on the certificate. In addition, every exclusion needs a written reason that would satisfy a skeptical auditor, and a senior sponsor should sign the final scope.
Checklist
AI Governance Checklist
Check that your AI policy, roles, inventory and review gates are in place before you lock the AIMS scope for certification.
Get the Checklist → Agents also deserve a separate look at this stage. Systems that call tools or take actions raise questions about permissions and oversight, which our guide to agentic AI governance works through. Likewise, an agent’s retirement plan belongs in scope, and AI agent lifecycle management shows what that record looks like.
Step 2: Run a Gap Analysis Against Clauses 4 to 10 and Annex A
ISO 42001 follows the same layout as other ISO management system standards. Its requirements sit in Clauses 4 to 10 , from Context of the Organization through to Improvement.
A set of reference controls then sits in Annex A. A useful gap analysis asks one question per clause, namely what record would prove this to an auditor.
Clause What the auditor asks to see Common gap 4. Context of the Organization Scope statement, AI role, interested parties AI systems missing from scope 5. Leadership Signed AI policy, named roles and authority Policy approved but no owner per system 6. Planning Risk method, risk register, impact assessments, objectives Risks listed without treatment decisions 7. Support Training records, competence, document control Training planned but not completed 8. Operation Lifecycle records, supplier reviews, change approvals Controls described but never run 9. Performance Evaluation Monitoring results, internal audit report, management review minutes No completed internal audit 10. Improvement Nonconformity log, corrective actions, root causes Fixes closed without a root cause
Annex A groups its controls under nine headings, from A.2 Policies Related to AI to A.10 Third-Party and Customer Relationships. In between sit internal organization, resources, impact assessment, the AI system life cycle, data, information for interested parties and the use of AI systems. After that, map each one to a process you already run, then mark what is missing.
Risk Assessment and Impact Assessment Are Two Records
Auditors look for both, but teams often merge them by mistake. The risk assessment asks what could go wrong for the organization and how you will treat it.
The impact assessment, by contrast, asks what the system could do to people, groups and society. For guidance, the Schellman guidance published by the Cloud Security Alliance points to ISO 42005:2025 for how to run one.
Above all, keep the two linked. For instance, a harm found in an impact assessment should also appear as a risk with an owner and a treatment.
Then the auditor can follow one thread from start to finish. Tools that support explainable AI and bias testing produce exactly the evidence that thread needs.
The Statement of Applicability Is Where Auditors Start
The Statement of Applicability (SoA) lists every Annex A control and whether you apply it. It also records why, and how far implementation has gone. Auditors use it as a map, because each “applied” line is a promise they can test. Each exclusion, in turn, is a judgment they will question.
Write the SoA last in the gap phase, once risk treatments are settled, and tie each control to the risks it answers. Then turn every gap into a backlog item with an owner and a due date. Each item also needs a closure test that names the record proving the fix.
Worked Example: One AI System Traced Through the Clauses
To make this concrete, here is the thread from the opening scene, written out for the customer-support assistant. The sub-clause numbers and titles come from NIST’s AI RMF to ISO/IEC 42001 crosswalk , drafted against the final draft of the standard. NIST’s AI Resource Center lists it as a contribution from Microsoft.
Sub-clause Record the auditor samples for this one system Typical owner 4.3 Determining the scope of the AI management system Scope statement that names the assistant and your role as its user or provider Governance lead 6.1.2 AI risk assessment Risk register entry for wrong or harmful answers, with likelihood and impact rated System owner 6.1.3 AI risk treatment Treatment decision, plus the matching line in the Statement of Applicability Risk owner 6.1.4 AI system impact assessment Signed impact assessment covering the customers who rely on its answers System owner and legal 9.1 Monitoring, measurement, analysis and evaluation Last month’s log of sampled answers, escalations and drift checks Operations team 9.2.2 Internal audit programme Internal audit report that sampled this system Internal auditor 9.3.3 Management review results Minutes that record a decision about this system Leadership 10.2 Nonconformity and corrective action Corrective action entry with a root cause and a closure check System owner
Eight rows, one system. If any cell stays empty for a system the auditor samples, they have found the gap before you did. Run this table for every system in scope while you prepare for ISO 42001 certification.
Step 3: Build an Evidence Pack That Shows Controls Running
A new policy written the week before the audit proves very little. Instead, auditors trust records created as a side effect of real work. Think of an approval in a ticket, a signed impact assessment, a completed training log or a dated supplier review.
Kanerika Service
AI Governance Consulting Services
Kanerika runs the clause-by-clause gap analysis and builds the evidence register, so every Annex A control has dated records before the auditor arrives.
Talk to an Expert For this reason, build a central evidence register. Give each row a requirement reference, the record itself, its owner, the AI systems it covers and the date it was last reviewed. When the auditor asks for something, your team should retrieve it in minutes, not reconstruct it from email.
Lineage, in particular, helps here more than most teams expect. If you can show where a model’s training and input data came from, the data controls in Annex A become far easier to evidence.
Our guide to data lineage explains how to capture it. A working data governance framework covers much of the rest.
Datasheet
Elevate Data Governance, Compliance and Security
See how Kanerika sets up classification, access policies and audit trails that give the data controls in Annex A their evidence.
Download the Datasheet → Reuse Your ISO 27001 Records and Monitoring Logs
Existing ISO programs save effort as well. Schellman’s ISO 42001 FAQ notes that ISO 27001 and ISO 42001 share the same structure, with Clauses 4 to 10 and an annex of controls. As a result, document control, internal audit and corrective action processes can carry over, while the AI-specific records still have to be created.
Even so, monitoring is where many evidence packs run thin. Production AI needs logs of drift, incidents and human review, and the AI observability tools you already run can feed that record. Security testing counts too, so results from AI red teaming belong in the register.
Step 4: Finish the Internal Audit and Management Review First
An external gap assessment cannot replace your own internal audit. The certification auditor will ask to see your internal audit report and your management review minutes, and the Stage 2 audit tests both. Without them, the management system has never checked itself.
First, pick internal auditors who did not build the controls they will review. Then give them the scope, the criteria and a sampling plan, and ask them to test operation, not just read documents. A finding such as “impact assessments were done for four of seven in-scope systems” is far more useful than “policy exists.”
Close each internal finding with a root cause, an owner and evidence that the fix worked. After that, hold the management review. Leadership should look at AIMS performance, audit results, changes in AI risk and resource needs, and the minutes should record the decisions they made.
Watch on YouTube
Klara- Compliance Agent I the AI Agent to Enforce Your Governance Playbook I Kanerika
Watch Klara, Kanerika’s compliance agent, check documents against a governance playbook and flag gaps, the kind of routine check an internal audit relies on.
Finally, make the go/no-go call in writing. A short readiness memo should confirm scope stability, evidence coverage, internal audit closure and a completed management review.
That memo then gives the sponsor a clear reason to book the external audit. The checklist in our AI auditing framework guide works well as a dry run.
Step 5: What Happens in the Stage 1 and Stage 2 Audits
The external audit runs in two stages. According to the CSA article on the certification process , Stage 1 reviews your design and documents, while Stage 2 tests whether the system operates. The figures below come from Schellman’s published guidance, and your certification body may plan differently.
Audit detail Stage 1 Stage 2 Purpose Confirm the AIMS is designed and documented Confirm the AIMS operates effectively What gets reviewed Scope, policies, risk and impact methods, SoA Operation (Clause 8), risk treatment, Annex A controls, monitoring, internal audit, management review Typical length 1 to 2 days 3 to 9 or more days Possible findings Areas of concern to fix before Stage 2 Nonconformities and opportunities for improvement Output Stage 1 report Audit report, recommendation and certification decision
The gap between the stages is typically four to twelve weeks. Schellman’s guidance also adds that it should not exceed six months, or Stage 1 may need repeating. Use that window to close every area of concern, since unresolved ones can turn into formal nonconformities in Stage 2.
During Stage 2, expect interviews with system owners and control owners, not just the governance lead. Auditors will trace sampled AI systems through your records, much like the afternoon described at the top of this guide. A clear closing meeting follows, then a formal report, and the certification body makes its decision after that.
Step 6: Choose an Accredited ISO 42001 Certification Body
Accreditation and certification are two different layers, so it helps to separate them. An accreditation body checks that a certification body is competent and impartial, and the certification body then audits you.
In the United States, ANAB accredits ISO/IEC 42001 certification bodies against ISO/IEC 17021-1. It also lists ISO/IEC 42006:2025, the standard for bodies that audit AI management systems, among its requirements.
For that reason, never take a provider’s accreditation claim on trust. Check the accreditation body’s own directory of accredited certification bodies, and confirm that ISO/IEC 42001 appears in the accredited scope. Later, buyers can confirm your certificate through IAF CertSearch , the International Accreditation Forum’s certificate validation database.
When proposals arrive, compare them over three years rather than on the first invoice. Also ask for itemized fees for Stage 1, Stage 2, each surveillance audit, recertification, extra sites and any follow-up visits. Also ask who the lead auditor is and what AI systems they have audited before.
Bundling can also help. If you already hold ISO 27001 or ISO 27701, a body that audits several standards together may reduce duplicated interviews. The AI security framework you run for those programs often covers part of the AIMS already.
The Nonconformities That Stall ISO 42001 Certification
No public dataset ranks ISO 42001 audit findings by frequency. So treat this as a list of weak points to inspect, not a league table. Each one maps to a step above, and each one is cheaper to find yourself than to hear about in a closing meeting.
A vague scope. AI systems in use but missing from the inventory, or exclusions with no written reason.Thin risk and impact records. Assessments missing for some systems, methods that change between teams, or risks with no treatment decision.A weak Statement of Applicability. Controls marked “applied” with no operating evidence, or exclusions that contradict the risk register.Policies nobody follows. Missing approvals, unfinished training, absent monitoring logs or supplier reviews that never happened.No internal audit or management review. Either step missing, or held without minutes and decisions.Fixes without root causes. The same finding appearing twice, which shows the system is not improving itself.Major and Minor Findings
Findings, moreover, come in two classes, and the line between them is written down. It comes from ISO/IEC 17021-1, the standard that certification bodies are accredited against. The European co-operation for Accreditation quotes it in an FAQ on classifying findings . A major nonconformity “affects the capability of the management system to achieve the intended results.”
Even so, small findings can add up. The note to that definition says several minors tied to the same requirement can show a systemic failure, and so count as a major.
Handling also differs. Amtivo, a certification body, covers this in its guide to the three-year certification cycle . A minor can usually be fixed through an internal action plan, while a major needs a plan agreed with the auditor and supporting evidence. Either way, the closure evidence matters as much as the fix.
How Much Does ISO 42001 Certification Cost?
Audit fees are the most visible cost, although rarely the largest one. Schellman, an accredited certification body, publishes one of the few public price guides.
Its ISO 42001 FAQ was last updated in June 2026. It says a year-one Stage 1 and Stage 2 audit typically ranges from the $20,000s up to the $40,000s.
The same guide puts each surveillance year at roughly $13,000 to $20,000 or more. Those are one provider’s figures, and they move with complexity, so use them to sanity-check quotes rather than as a market average.
What Goes Into a Three-Year Budget
Six components make up the full cost, and only two of them appear on the certification body’s invoice.
Cost component What drives it How to estimate it Stage 1 and Stage 2 audit Scope size, number of AI systems, sites Quotes from two or three accredited bodies Surveillance audits (years 2 and 3) Same drivers, smaller sample Ask for them on the same proposal Gap analysis and readiness work How much of the AIMS exists today Internal estimate or advisory quote Internal staff time Control owners, internal auditors, governance lead Hours per role across the project Tools and evidence storage Inventory, risk register, evidence register Existing platforms first, new licenses second Recertification Scope changes over three years Quote before the certificate expires
For this reason, a simple three-year formula keeps the budget honest. Add the initial audit, both surveillance audits, readiness work, internal hours, tooling and recertification preparation. Then compare that total against the deals or contracts that asked for the certificate in the first place.
Scope is the largest lever you control. After all, every extra business unit and AI system adds interviews, samples and audit days. Starting with the scope that buyers actually ask about, then widening it at recertification, keeps year one affordable.
How Long Does ISO 42001 Certification Take?
The external audit calendar is fairly predictable. Based on Schellman’s guidance, Stage 1 takes one or two days.
The gap before Stage 2 is usually four to twelve weeks, and Stage 2 takes three to nine days or more. Then come the report, any corrective actions and the certification decision.
Preparation is the part that varies, and no honest source can give you one number for it. It depends on how much of the AIMS already exists, how many AI systems sit in scope and how quickly owners close gaps. A company with a running ISO 27001 program and a small scope moves much faster than one starting from a blank page.
One constraint is easy to miss. Because Stage 2 tests whether controls have been operating, you need enough history for an auditor to sample.
That means several monitoring cycles, completed reviews and closed internal findings. Plan the audit date around that history, not around the date the last policy gets approved.
After the Certificate: Surveillance and Recertification
The certificate is the start of a cycle. According to Schellman, a successful Stage 2 leads to certification for three years, with surveillance reviews in years two and three. Those reviews act as annual check-ins on whether the management system still runs and still meets the standard.
Surveillance audits are smaller. The CSA guidance says they take about a third of the time of the initial audit. They also tend to rely on sampling instead of a full review. Even so, the sample can land on any in-scope system, so every owner needs current records.
Between audits, meanwhile, change creates work.
A new AI product, an acquisition or a new vendor model can each move your scope. Likewise, a shift from user to provider rewrites your risks and your SoA along with it. Then, near the end of year three, a recertification audit reviews the whole system again, and any change nobody recorded shows up there.
The simplest defense is an AIMS calendar with named owners. Put policy reviews, risk and impact reassessments, monitoring checks, internal audits and external audit dates on it.
Then review it at every management meeting. Good AI governance tools can also automate the reminders.
A Go/No-Go Checklist Before You Book Stage 1
Run through this list with the sponsor before you sign a certification proposal. Any “no” is a reason to wait a few weeks, because a Stage 1 that finds basic gaps costs time and money.
First, the AIMS scope is written, justified and signed by a sponsor. Every in-scope AI system has an owner and an inventory entry. The gap analysis covers Clauses 4 to 10 and all Annex A groups. Risk and impact assessments exist for each in-scope system. The Statement of Applicability is approved and tied to risks. Controls have operating records, not only written procedures. The internal audit is complete and its findings are closed. Leadership has held and minuted the management review. Your certification body’s ISO/IEC 42001 accreditation is checked in the directory. Owners for surveillance and recertification are named. If a few items are still open, map them against the AI governance best practices your team already follows, since several gaps usually close together. The NIST AI RMF Playbook also suggests concrete actions for many of the same risk areas.
How Kanerika Helps Enterprises Get Ready for the Certification Audit
Kanerika holds ISO 27001, ISO 27701:2019, ISO 9001:2015 and SOC 2 Type II, so our own teams go through external audits too. That experience shapes how our AI governance consulting team prepares clients: we build for the auditor’s sampling questions, not for a policy binder.
To be clear, Kanerika is not a certification body and does not issue certificates. Our role is to get your AIMS ready for an independent audit and to leave records your team can keep running.
What the Readiness Work Produces
In each case, the stage ends in a record the auditor will ask to see, rather than a slide.
Gap register. Clauses 4 to 10 and every Annex A group, mapped clause by clause with the same evidence-first method as an AI security assessment .Scope and inventory. A signed scope statement and an AI system inventory with an owner, a role and any third party for each entry.Risk and impact records. A risk register and impact assessments linked to each other, plus a draft Statement of Applicability.Evidence register. Each requirement mapped to its record, owner and last review date.Self-check pack. An internal audit plan, support for the management review and a written go/no-go readiness memo.AIMS calendar. Named owners and dates that keep surveillance audits routine.For document checks, an agent also helps. Klara, Kanerika’s compliance agent, checks documents against a governance playbook and flags clause risks, while people keep the final say. That suits an AIMS, where each new procedure should match the AI policy before it goes live.
Proof From Kanerika’s Compliance Work
Evidence on demand is a pattern we have delivered before. The project was not an AI audit, but the discipline is the same. For a private equity fund administrator , Kanerika replaced quarterly reporting by Excel and email with governed reports that carry their own data trails.
As a result, manual reporting hours fell by 70%, and data trails became available on demand for SEC compliance review. Audit preparation turned into retrieval instead of reconstruction.
Case Study
70% Fewer Manual Hours in Fund Reporting with Power BI
Kanerika gave a private equity fund administrator governed reports with built-in data trails, cutting manual reporting hours by 70% and making audit evidence available on demand.
Read the Case Study → A closer match for ISO 42001 work is a compliance platform. The client, an AI-powered regulatory compliance provider, serves financial institutions across several jurisdictions. Kanerika built it a centralized platform that automates requirement mapping, controls monitoring and audit traceability.
The published results are 60% less manual compliance work, 40% faster regulatory response and 5X better audit traceability. In other words, that is the mapping a gap analysis needs, kept running instead of done once.
The data side matters as much as the AI side. Our data governance services and work on Microsoft Purview give clients the lineage and classification records that the data controls in Annex A depend on. Teams earlier in the journey can start with an AI readiness assessment or our view of responsible AI before scoping certification.
AI Assessment
Get a Baseline Before You Scope Certification
Kanerika’s AI Maturity Assessment scores your AI/ML foundations, generative AI and AI agent readiness, then returns personalized recommendations you can use to plan the gap analysis.
Take the AI Maturity Assessment → Wrapping Up
ISO 42001 certification comes down to one test. Can an outside auditor pick any AI system in your scope and follow its records from risk to control to monitoring without a gap?
Draw a scope you can defend, map every clause to a record, and run your own internal audit and management review first. Then choose an accredited body, book Stage 1 once controls have real history, and budget for three years. Do that, and the auditor’s afternoon becomes a walkthrough rather than a search.
Frequently Asked Questions
Is ISO 42001 certification mandatory?
No. ISO states that certification for ISO/IEC 42001 is voluntary. Organizations usually pursue it because customers, procurement teams or partners ask for independent proof of AI governance. Some contracts may require it, but ISO does not require it, and holding one does not on its own prove compliance with any AI regulation.
Who issues ISO 42001 certification?
Independent certification bodies issue it, not ISO. An accreditation body, such as ANAB in the United States, checks that each certification body is competent and impartial. Before you sign a proposal, confirm in the accreditation body’s own directory that the provider’s accredited scope includes ISO/IEC 42001, rather than relying on its marketing pages.
What is the difference between ISO 42001 alignment and certification?
Alignment is a self-declared claim that your AI governance follows the standard, with no outside check. Certification means an accredited body has audited your AI management system against ISO/IEC 42001:2023 within a defined scope and found it conforms. Certification also commits you to annual surveillance audits across a three-year cycle, which alignment never requires.
How much does ISO 42001 certification cost?
Schellman’s published FAQ says a year-one Stage 1 and Stage 2 audit typically ranges from the $20,000s up to the $40,000s, with surveillance years at about $13,000 to $20,000 or more. Those are one provider’s figures. Readiness work, internal staff time, tooling and recertification add to the total over three years.
How long does ISO 42001 certification take?
The external audits follow a fairly set pattern. Stage 1 takes one or two days, the gap before Stage 2 is usually four to twelve weeks, and Stage 2 takes three to nine days or more. Preparation time varies most, because it depends on scope, existing ISO programs and how much operating evidence exists.
What do auditors check in the ISO 42001 Stage 2 audit?
Stage 2 tests whether the AI management system operates as documented. Auditors review operation under Clause 8, risk and impact treatment, the in-scope Annex A controls, monitoring, internal audit, management review and corrective action. They interview system and control owners and trace sampled AI systems through their records to confirm the paperwork matches practice.
Can a company get ISO 42001 certified without ISO 27001?
Yes. ISO 42001 is a standalone management system standard, so you can certify against it without holding ISO 27001. An existing ISO 27001 program does help, because both standards share Clauses 4 to 10 and an annex of controls. Document control, internal audit and corrective action processes can often be reused for the AI management system.
What happens if a company fails its ISO 42001 audit?
Most audits end with findings rather than a flat failure. A minor nonconformity is usually fixed through an internal action plan. A major nonconformity needs a corrective action plan agreed with the auditor and supporting evidence, and the certificate is normally held back until the certification body accepts that the fix works.
How often must ISO 42001 certification be renewed?
The certificate is valid for three years. Surveillance audits run in years two and three to confirm the AI management system still operates, and each one takes roughly a third of the time of the initial audit. Near the end of year three, a recertification audit reviews the whole system again before a new certificate is issued.
Can an individual get ISO 42001 certified?
Organizations receive ISO 42001 certification for their AI management system. Individuals can earn separate personnel credentials, such as lead implementer or lead auditor certificates, from training providers. Those credentials show that a person understands the standard, but they do not certify any organization, and buyers should not confuse the two when reviewing supplier claims.
