ISO 42001 certification: steps, audit stages and test evidence

ISO 42001 certification is an independent audit of how your organization manages AI, and it tests no model or product. An accredited certification body checks that you run an AI management system (AIMS) that meets ISO/IEC 42001:2023 and that the system works in practice. This page covers the steps, the two audit stages, what the certificate does and does not show, and which technical evidence helps in the audit. It is not legal advice.

What does ISO 42001 certification cover?#

The certificate covers an organization's AI management system within a stated scope. ISO/IEC 42001:2023 was published on 18 December 2023. The IEC webstore gives its scope as requirements and guidance for "establishing, implementing, maintaining and continually improving an AI (artificial intelligence) management system within the context of an organization". It applies to organizations that provide or use AI products or services.

That makes it a management system standard, in the same family of ideas as ISO 27001 for information security. It asks for policy, roles, risk and impact assessment, lifecycle controls, internal audit and management review. It does not set pass marks for model accuracy, and it does not define attack tests. For the standard itself, read our ISO 42001 guide. This page covers the certification process.

Annex A of the standard lists reference control objectives and controls, and Annex B gives implementation guidance. The sample pages note that an organization "may not require all controls listed in Annex A". You justify which controls you use and which you leave out.

What are the steps to ISO 42001 certification?#

Most teams follow six steps before the external audit: scope, gap assessment, risk assessment, controls, internal audit and management review. The standard does not number these steps for you. This order is common practice and fits the way management system standards are built, so treat it as a plan and check it against the text you buy.

1. Set the scope. List the AI systems, teams, sites and roles inside the AIMS, and say what is outside. A narrow first scope, such as one product line, is easier to audit than the whole company.
2. Run a gap assessment. Compare current practice with the clauses and Annex A. Record each gap with an owner.
3. Assess AI risks and impacts. Cover risks to the organization and effects on people who use or are affected by the system. Keep the method and the results.
4. Select and implement controls. Write a statement of which Annex A controls apply, why, and where the evidence lives.
5. Run an internal audit. Someone who did not build the controls checks them against the standard and your own rules.
6. Hold a management review. Leadership reviews audit results, risks and changes, and records decisions.

Some certification bodies, BSI among them, also offer a pre-certification assessment before the formal audit. It is optional. Ask whether the same firm that does the pre-assessment may also do the certification audit, because many accreditation rules limit consulting by the auditor's own organization.

What happens in the stage 1 and stage 2 audit?#

Stage 1 reviews whether your AIMS is designed and documented well enough to audit. Stage 2 checks that you follow it. This two-stage pattern is the usual way certification bodies audit management systems. The ISO 42001 text does not describe it, so confirm the details in your certification body's audit plan.

Auditors sample. They pick AI systems, projects and records and follow them from the policy to the evidence. If you only prepare for the documents, stage 2 interviews expose the gaps. Teams that built the controls for a real product, with a named owner, answer these questions better than teams that wrote policy first and chose a system later.

A certificate from a body accredited under the IAF multilateral arrangement is recognized by other accreditation bodies that signed it. The IAF page explains that recognition. Check that your certification body holds accreditation for ISO/IEC 42001 itself. BSI states, for example, that it is accredited by UKAS to certify to this standard.

What does it cost and how long does it take?#

We do not state a price or a duration, because we found no sourced figure we could cite. Public cost guides rank for this query, but the ones we checked do not show a dated, citable quote. Cost depends on the scope, the number of AI systems, the size of the organization and the audit days the certification body sets.

Ask each certification body for a written quote that lists four things: audit days for stage 1 and stage 2, the surveillance audit schedule, travel or remote terms, and what happens if you have a major nonconformity. Plan your own time too. Gap work, control evidence and an internal audit take internal staff, and for most teams that effort exceeds the auditor fee. As of November 2026, we cannot give a number for it.

Does an ISO 42001 certificate prove an AI product is secure?#

No. The certificate shows that your organization governs AI under a managed process. It does not show that a given system resists attack. The ISO text says nothing in its scope about certifying a model, and a management system audit samples records. It does not send adversarial prompts at your app.

An example shows the gap. Take Harbor Notes, a fictional note-taking app with a support assistant that reads user notes.

The certificate in that example is honest and the product still has an open indirect prompt injection path. Customers who read "ISO 42001 certified" as "tested against attack" are drawing a conclusion the certificate does not support. See how indirect prompt injection works for the attack type in the example.

What technical evidence can you bring to the audit?#

Bring evidence that each control you claim runs on real systems. For AI security controls that means test reports with scope, method, findings and retest results. NIST AI 600-1 defines AI red-teaming as "a structured testing exercise used to probe an AI system to find flaws and vulnerabilities such as inaccurate, harmful, or discriminatory outputs". Its action MS-2.7-007 suggests red-teaming to assess resilience against abuse, prompt injection and ML attacks.

Map your evidence to the controls you selected. Use this list as a starting point, and confirm each mapping against the control text you have licensed.

• Verification and validation records for each in-scope AI system, including security test reports and dates.
• A risk register entry for each finding, with owner, decision and fix date.
• Retest evidence for fixed findings.
• Supplier and model provider records for third-party models and tools.
• Monitoring and incident records, including what you changed after an incident.
• Change records that show when a new model, prompt or tool triggered a new test.

An AI red team assessment produces the first three items. We cannot say whether a given certification body accepts a given report. Ask your auditor which evidence formats they sample. A customer security questionnaire often asks for the same reports, so one test can serve both.

The EU AI Act is a different matter. Article 15 asks high-risk systems to be resilient against attempts to alter their use, outputs or performance by exploiting vulnerabilities, and it does not name red teaming. An ISO certificate does not replace those duties. See AI compliance for the legal map.

Why do ISO 42001 audits find gaps?#

Audits find gaps where policy and practice differ. These are the patterns to check before the auditor does.

• The scope names a product, but the inventory misses shadow AI features that teams added.
• The risk method exists, but no completed assessment exists for a live AI system.
• A control says "tested before release", but the records show only accuracy checks.
• Third-party models are in use, and no supplier record says which version runs.
• The internal audit was done by the person who wrote the controls.
• Management review minutes list no AI risk or incident decision.
• Findings from tests have no owner, no date and no retest.

Fix these before stage 1. A gap closed with a real record is cheaper than a nonconformity raised in stage 2.