ISO 42001 Certification: What the Standard Requires and How to Prepare

ISO 42001 certification is an independent confirmation, issued by a certification body, that your AI management system meets the requirements of ISO/IEC 42001:2023. The standard, published in December 2023, asks you to manage AI the way ISO/IEC 27001 asks you to manage information security. That means a defined scope, an AI policy, AI risk and impact assessments, a justified selection of controls, and records showing that the system works. ISO describes certification as voluntary and does not certify organisations itself; independent certification bodies do.

Before you commit, be clear about why you want the certificate: a customer or tender requirement, a group policy, or a regulator's expectation. The reason sets the scope, and the scope sets the effort.

What does ISO/IEC 42001 require?

ISO/IEC 42001 is a management system standard. It does not tell you how to build a model. It asks you to set policies and objectives for the responsible development, provision or use of AI, and to run the processes that achieve them on a Plan-Do-Check-Act cycle. Like other ISO management system standards, it follows the harmonised structure, so its main clauses (4 to 10) carry the same numbers and titles as ISO/IEC 27001, with AI-specific requirements added within them.

• Context (clause 4): the issues and interested parties that matter, your role as a developer, provider or user of AI, and the scope of the AI management system.
• Leadership (clause 5): top-management commitment, an AI policy, and assigned roles and responsibilities.
• Planning (clause 6): AI risk assessment and treatment, AI system impact assessment, and measurable AI objectives.
• Support (clause 7): resources, competence, awareness, communication and controlled documents.
• Operation (clause 8): running the planned processes and repeating risk and impact assessments when systems change.
• Performance evaluation (clause 9): monitoring, measurement, internal audit and management review.
• Improvement (clause 10): nonconformities, corrective action and continual improvement.

Published summaries of the standard, including certification bodies' guides, describe Annex A as a list of reference control objectives and controls. They cover AI policies, internal organisation, resources, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. You do not apply every control by default. You select the controls your risk assessment calls for and record each inclusion or exclusion, with its justification, in a statement of applicability, which auditors review.

How does ISO/IEC 42001 relate to ISO/IEC 27001, 23894 and 42005?

ISO/IEC 42001 works alongside other standards. The AI standards below come from the same ISO/IEC committee (JTC 1/SC 42); ISO/IEC 27001 is the information security standard many regional organisations already hold. Only some of them are certifiable.

ISO/IEC 42005, published in May 2025, looks at how an AI system and its foreseeable uses may affect individuals, groups and society, and recommends assessing impact across the whole life cycle. If you already hold ISO/IEC 27001, the new work is AI-specific: the AI inventory, AI risk criteria, impact assessments, life-cycle controls and data provenance. Governance processes you already run can extend to cover both systems.

ISO 42001 readiness checklist

Use this list to judge whether you are ready to book a certification audit. Each line should have evidence behind it, not only a document.

How long does ISO 42001 preparation take?

There is no standard duration, and we do not quote one before seeing the scope. Preparation time depends on four things:

• how wide the scope is: one product team or the whole organisation;
• how many AI systems fall in scope and how much risk they carry;
• whether you already run a management system such as ISO/IEC 27001;
• how quickly management can approve policy, risk appetite and scope.

Certification bodies expect the system to have operated before the Stage 2 audit. LRQA's published client note for ISO/IEC 42001, for example, states that Stage 2 confirms at least one management review and one internal audit covering the scope have taken place. So plan backwards from the audit date: management review, internal audit, a period of operating records, control implementation, then the gap assessment. A regional fintech already certified to ISO/IEC 27001 with three AI systems in scope will move faster than a ministry with no management system and AI in use across many departments.

What do ISO 42001 auditors look for?

Certification normally runs in two stages. At Stage 1, the auditor reviews your design and documents. Expect questions on business context, AI policy and objectives, roles, and your scope, including the type of AI organisation you are. The auditor also checks the risk assessment and the selection of controls in the statement of applicability, legal and regulatory requirements, risk treatment and measurement plans, and internal audit and management review records.

At Stage 2, the auditor tests whether the system works in practice. Expect interviews with the people who run it, samples of controls, and questions on whether your AI risk assessment fits the systems in scope. We suggest preparing clear answers to questions such as these:

1. Where did each AI system come from, and who approved it?
2. How did you decide which Annex A controls apply?
3. Which impact assessment changed a design or deployment decision, and how?
4. What happened at the last management review, and what was decided?
5. How do you know a model or vendor change triggered a new assessment?

Major nonconformities delay certification until the auditor confirms corrective action. After certification, expect surveillance audits and a recertification cycle; LRQA's note, cited here as one published example, describes three-yearly renewal; terms vary between bodies. Accredited certification bodies are assessed against ISO/IEC 42006:2025, published in July 2025, which adds AI-specific requirements to ISO/IEC 17021-1. Ask any body you consider how it is accredited for ISO/IEC 42001.

Does ISO 42001 certification cover the Saudi PDPL and other regional laws?

No. ISO states that the standard does not replace laws or regulations. The work overlaps, though. Saudi Arabia's PDPL Implementing Regulations require a written impact assessment for processing based on newly adopted technologies or decisions based on automated processing, and Jordan's Ministry of Digital Economy and Entrepreneurship publishes a guide on data protection impact assessment. One template that covers both data protection impact and AI impact lets the same evidence serve the regulator and the auditor. This is general information, not legal advice; your obligations depend on your sector and the data you process.

How to start

Our AI Governance & Compliance Foundation includes ISO/IEC 42001 readiness: scope, gap register, policy, risk and impact assessment, and the records auditors ask for. For the people who will run the system, Role-Based AI Training builds the hands-on skills each role needs. If you are not yet sure what AI is in use, start with the free AI Exposure Scan, or read more about our Governance Lab.

We prepare organisations for the audit; the certificate comes from an independent certification body.

Related lab: Governance Lab ↗