How to Achieve ISO/IEC 42001 Certification

Customers increasingly expect clear evidence that your organisation can demonstrate responsible AI and effective AI governance. ISO 42001 certification is the common term for certification to ISO/IEC 42001:2023. It provides independent assurance that your Artificial Intelligence Management System (AIMS) conforms to the standard.

Successful preparation requires clear ownership, proportionate controls and evidence that governance works in practice. Start by understanding what certification covers, then build a structured implementation programme around your organisation's AI activities.

Key Takeaways

• ISO 42001 certification confirms that an organisation’s defined Artificial Intelligence Management System (AIMS) conforms to ISO/IEC 42001:2023; it does not guarantee that every AI output is accurate or that every legal obligation has been met.

• Start by defining the AIMS scope, taking an inventory of AI activities and assigning clear ownership. Use a gap assessment to create a prioritised implementation plan.

• Assess organisational risks and impacts on people and society, then select proportionate controls and document their applicability in a Statement of Applicability.

• Certification preparation requires evidence that the AIMS works in practice, including operational records, internal audits, corrective actions and management reviews.

• The certification audit has two stages: a readiness review followed by an assessment of effective implementation. Timelines and costs vary according to scope, complexity and existing governance maturity.

What certification demonstrates

Published in December 2023, the ISO 42001 standard, formally designated ISO/IEC 42001:2023, is the world's first international standard for governing artificial intelligence. It sets requirements for the development, provision and use of AI.

An Artificial Intelligence Management System (AIMS) brings together policies, responsibilities, risk assessments, operational controls and continuous improvement. It helps your organisation address fairness, privacy, security, transparency and accountability across the AI lifecycle. An AIMS can support governance as a compliance framework alongside applicable legal obligations.

Certification confirms that the management system within a defined scope meets the standard's requirements. A certification body, not ISO, issues the certificate.

It doesn't guarantee that every AI output is accurate, every system is safe or every legal obligation has been met.

Formal certification is useful when customers, procurement teams or contracts require independent assurance. Organisations can also implement the standard without seeking certification, supporting governance improvement whilst allowing smaller teams to defer external audit costs.

Step 1: Define your AI management system scope

Start by identifying your organisation’s AI activities. Find where you develop, supply, integrate or use AI, including externally purchased tools.

Record each system’s purpose, business owner, users, data sources and supplier dependencies. Include experimental and employee-adopted tools where they fall within your intended scope.

Define the AIMS scope by setting the organisational boundaries, locations, activities and AI systems covered. Clarify your role, such as producer, provider or customer, and the responsibilities attached to it.

Document the AIMS scope in a clear statement. A supplier’s certification doesn’t cover your organisation’s use of its technology. You remain responsible for assessing your deployment, data handling and business decisions.

Next, identify customer expectations, contractual obligations and applicable laws. UK organisations operating in EU markets should assess whether the EU AI Act applies to their activities. The European Commission's implementation timeline sets out its phased requirements.

Finally, appoint an executive sponsor and an accountable AIMS owner. Agree a budget, implementation milestones and how progress will reach senior management.

Preparation output: an approved AIMS scope, AI inventory, obligations register and responsibility structure.

Step 2: Assess gaps against the mandatory requirements

Use a gap assessment to compare your existing governance arrangements with clauses 4 to 10 of the ISO 42001 standard. Test working practices and evidence through a risk assessment, rather than relying on policy titles.

The mandatory clauses cover the following areas.

Clause	Focus	Practical preparation
4	Context	Define interested parties, obligations and scope.
5	Leadership	Approve policy and assign responsibilities.
6	Planning	Assess risks, plan treatment and set objectives.
7	Support	Provide resources, competence and controlled documentation.
8	Operation	Apply assessments and controls in daily activities.
9	Performance evaluation	Monitor results, audit and review the AIMS.
10	Improvement	Address nonconformities and improve effectiveness.

Use the findings to build a prioritised action plan. Give each gap an owner, deadline and required evidence.

Organisations with an existing ISO 27001 (formally ISO/IEC 27001) management system can reuse document control, audit scheduling and management review processes. However, AI-specific risks and impacts still need dedicated assessment. AKRUP's ISO 27001 implementation support can help align shared governance processes. You can also use the NIST AI RMF to map or compare governance practices, but it isn't an ISO/IEC 42001 requirement or a substitute for assessing the standard.

For smaller organisations, existing registers and controlled document repositories can support implementation. A new software platform isn't a prerequisite.

Preparation output: a gap assessment report and achievable implementation roadmap.

Step 3: Assess AI risks and impacts

Risk assessment and AI impact assessment answer related but different questions. Both should inform your controls and approval decisions.

Assess risks to organisational objectives

Define a repeatable risk assessment method with consistent likelihood, consequence and acceptance criteria. The NIST AI RMF may inform your approach, but it isn't a mandatory ISO/IEC 42001 method. Identify risks associated with data quality, security weaknesses, unreliable outputs, supplier changes and inappropriate use.

Connect each risk to an identifiable AI system, activity or dependency. Assign a risk owner and decide whether to reduce, avoid, share or accept it.

Document existing safeguards and the evidence supporting your assessment. Residual risk acceptance should follow an approved authority structure. Repeat assessments when deployment conditions, data, intended use or underlying technology change.

Assess impacts on people and society

An AI impact assessment examines potential consequences for individuals, groups and society. Depending on the system, this can include discrimination, privacy intrusion, accessibility barriers, safety concerns and environmental effects.

Use a consistent AI impact assessment record:

1. Describe the intended purpose, deployment context and foreseeable misuse.

2. Identify affected people, including vulnerable groups and those indirectly affected.

3. Record potential harms, benefits and supporting evidence.

4. Assess severity, likelihood and uncertainty.

5. Document safeguards, responsible owners and remaining concerns.

6. Record approval, review triggers and the next review date.

Involve relevant business, technical, security, legal and data protection colleagues. A data protection impact assessment may support the process, but it doesn't automatically address every AI-related impact.

Preparation output: approved risk and AI impact assessments with traceable treatment decisions.

Step 4: Select controls and document applicability

Annex A contains 38 controls across nine control objectives. These Annex A controls cover AI policies, responsibilities, resources, system impacts, lifecycle management, data and third-party relationships.

Use your risk treatment process to identify necessary controls. Compare your decisions with the Annex A controls to check that relevant safeguards haven't been overlooked. NIST AI RMF can support control discussions, but it doesn't determine ISO/IEC 42001 applicability.

The Statement of Applicability records the necessary controls, why they apply and whether they're implemented. It also explains any exclusions from Annex A.

You don't automatically need to implement all 38 Annex A controls. Exclusions must be justified by your context, scope, activities and risks.

For purchased AI, relevant controls may concern supplier assessment, acceptable use, human oversight and performance monitoring. Development activities require closer attention to data preparation, testing, deployment approval, AI lifecycle management and documentation.

BSI's AI management system guidance provides further context on the standard's application.

Keep the Statement of Applicability aligned with your risk register and operational procedures. An auditor should be able to trace each identified risk to its treatment.

Preparation output: a risk treatment plan and controlled Statement of Applicability.

Step 5: Operate the AIMS and test its effectiveness

Approved documentation is only the starting point. Your organisation needs records showing that employees follow the agreed processes.

Build evidence through normal operations

Implement proportionate procedures for AI approval, supplier review, incident reporting, change management and system monitoring. Train employees according to their responsibilities, rather than giving every team identical material.

Retain evidence such as completed assessments, approval decisions, test results, training records and monitoring reports. Records should show who acted, when they acted and what decision followed.

Set measurable objectives linked to your risks and business priorities. Useful measures include assessment completion, overdue corrective actions and whether required human reviews occur. Define thresholds that trigger action.

You can also use the NIST AI RMF as a supplementary reference when monitoring or evaluating AI systems.

Complete internal audit and management review

Conduct an internal audit before the certification assessment, covering AIMS requirements and applicable controls. Use competent auditors to ensure the internal audit is comprehensive and impartial.

Investigate nonconformities, identify causes and implement corrective actions. Check whether those actions have resolved the underlying problem.

Senior management should review performance, audit findings, changing obligations, risks and resource needs. Record decisions and assigned actions, not simply attendance.

  A completed policy doesn't demonstrate an effective control. Auditors need evidence that the procedure has been applied and produces the intended result.  

Preparation output: operational records, internal audit findings, corrective actions and management review decisions.

Step 6: Complete the two-stage certification audit

Choose a certification body with relevant experience and current accreditation for ISO/IEC 42001. Verify its scope before arranging accredited certification.

UKAS has confirmed BSI's accreditation for AI management systems. ANAB accreditation may be relevant for US-recognised arrangements; UK organisations should check the relevant UK accreditation, such as UKAS. Accreditation concerns the provider’s competence, while certification concerns your organisation’s management system.

Stage 1: Establish readiness

The Stage 1 audit reviews your AIMS scope, documented arrangements and readiness for the main assessment. Auditors check that requirements are understood and implementation has progressed sufficiently.

Prepare your policies, risk methodology, assessments, Statement of Applicability and internal audit programme. Make management review records available.

The certification body may identify concerns that need attention before Stage 2. Resolve these through documented actions and confirm the next audit’s arrangements. Use this opportunity to address weaknesses before the detailed effectiveness assessment.

Stage 2: Demonstrate effective implementation

The Stage 2 audit examines whether your AIMS meets requirements and operates effectively. Auditors sample records, interview employees and assess how controls work across the AIMS scope.

Make process owners available and organise evidence so it’s easy to retrieve. Employees should explain their actual responsibilities without rehearsed answers.

Respond to nonconformities within the required timescales. The provider makes the certification decision after its review; an interview or audit alone doesn’t guarantee certification.

After certification, plan for each surveillance audit and periodic recertification. Keep the AIMS operating and evidence current for every surveillance audit. Surveillance audits recur throughout the certification cycle.

Plan your ISO 42001 certification budget

Timelines and costs depend on scope, governance maturity, AI complexity and available resources. Establish these assumptions before requesting proposals.

Allow time for implementation and evidence

Around six to twelve months is an indicative timeframe for implementing ISO/IEC 42001 and completing certification, not a guaranteed completion period. A focused organisation with mature governance may progress faster than a complex group starting without an AI inventory.

Allow time for assessments, control implementation, staff training and operational records. Internal audit, management review and corrective actions also need space in the programme.

Agree audit availability with the audit provider early. Avoid setting a contractual certification deadline before you understand the implementation gaps and evidence required.

Compare complete, scoped costs

There isn't a universal certification cost for ISO/IEC 42001. Request itemised quotations covering Stage 1, Stage 2, surveillance, audit fees, travel and any follow-up assessment charges.

Your implementation budget should also account for internal staff time, training, technical remediation and optional consultancy. Compare proposals using the same scope and assumptions.

Smaller organisations can reduce expenditure by reusing existing governance processes and seeking targeted assistance. AKRUP's ISO/IEC 42001 implementation support covers gap assessment, risk and impact assessment, documentation and audit preparation.

Frequently Asked Questions

What does ISO 42001 certification confirm?

It confirms that an organisation’s AIMS, within a defined scope, conforms to ISO/IEC 42001:2023. A certification body issues the certificate; ISO does not.

Does certification guarantee that AI systems are safe or legally compliant?

No. Certification does not guarantee that every AI output is accurate, every system is safe or every legal obligation has been met. Organisations remain responsible for their AI activities and applicable obligations.

Do organisations have to implement all 38 Annex A controls?

No. Organisations select necessary controls through their risk treatment process and document them in a Statement of Applicability. Any exclusions from Annex A should be justified by the organisation’s context, scope, activities and risks.

How long does it take to achieve ISO 42001 certification?

Around six to twelve months is an indicative timeframe, not a guaranteed completion period. The actual time depends on factors such as governance maturity, the complexity of AI activities and the work needed to build evidence.

What are the stages of the certification audit?

Stage 1 reviews the AIMS scope, documented arrangements and readiness for the main assessment. Stage 2 assesses whether the AIMS meets requirements and operates effectively, using records, interviews and samples of controls.

Build a management system you can maintain

Achieving ISO 42001 certification against ISO/IEC 42001 requires a defined scope, justified controls and evidence of effective governance. Clear ownership and regular review help your AIMS remain useful as AI activities change.

Begin with your inventory and gap assessment, then prioritise the work needed before external audit. Certification should support ongoing risk management and business assurance.

If you would like to find out more information or require any of our services please Contact Us and complete the contact form.