How to Prepare for ISO 42001 Certification: A Practical Checklist for AI Teams
What the standard actually requires, translated into controls you can build, plus a realistic timeline and cost.
Six months ago, an enterprise security questionnaire asking about AI governance was rare. Now it's showing up in procurement packets from banks, hospitals, and Fortune 500 vendor onboarding teams as a standard line item. If your product touches a model, whether you built it, fine-tuned it, or just wrapped an API around someone else's, customers want to know how you govern it. ISO 42001 is the standard most of them are pointing to when they ask.
This isn't a certification to collect for the badge on your website. It's the answer to a specific question buyers are now trained to ask: how do you know your AI system won't do something you can't explain, defend, or fix?
What ISO 42001 Actually Is
ISO/IEC 42001 is the first international standard built specifically for managing artificial intelligence. Not a code of ethics, not a list of "responsible AI" principles, but a management system standard, structured the same way ISO 9001 or ISO 27001 are. That matters because certification isn't about writing a policy document and filing it away. It requires you to run an actual system: define how AI risk gets identified and assessed, assign accountability for decisions the system makes, document what data trains and feeds your models, and prove with evidence, not assurances, that the system operates the way you say it does.
The standard applies whether you develop AI models, deploy third-party ones, or sit somewhere in between (most companies do). Auditors aren't grading your model's accuracy. They're grading whether your organization can demonstrate control over how the model is built, monitored, and changed over time.
The Clauses, Translated Into Controls You Can Build
Strip away the standard's language and ISO 42001 comes down to four things an auditor will want to see evidence of.
Risk assessment
A documented process for identifying what could go wrong with a given AI system: biased outputs, data leakage, model drift, over-reliance by end users. Scored by likelihood and impact, revisited on a schedule rather than once at launch.
Bias mitigation
Evidence that you tested for it, not just that you believe your training data was representative. A documented testing methodology, the results, and what changed as a result.
Accountability
A named owner for each AI system in production, not "the engineering team." Auditors ask who signs off before a model change ships, and what happens if the model does something it shouldn't.
Auditability
Logs, version history, and decision trails that let someone outside the team reconstruct why the system behaved a certain way on a given date. If your only record is a Slack message, this is where prep usually stalls.
The Checklist: Getting From Zero to Audit-Ready
- 01Gap assessmentMap your current AI inventory, every model, every third-party AI tool embedded in your stack, against the standard's requirements. Most organizations are surprised by how many AI touchpoints they have once someone actually counts.
- 02Scope definitionDecide which systems the certification covers. Trying to certify everything at once is the most common reason timelines slip.
- 03DocumentationWrite the AI policy, risk register, and roles-and-responsibilities matrix the standard requires. This is usually the single largest time investment.
- 04Control implementationPut the actual mechanisms in place: risk review cadence, bias testing process, model change approval workflow, an incident response plan specific to AI failures.
- 05Internal auditRun your own audit against the standard before the real one. This is where you find the gaps that would otherwise surface expensively during certification.
- 06Certification auditAn accredited body reviews your documentation and evidence, typically in two stages: a readiness review, then the full assessment.
- 07Surveillance auditsCertification isn't a one-time event. Expect annual surveillance audits to confirm the system is still operating as certified.
Seven steps looks straightforward on paper. Knowing exactly where your organization stands against them, before an auditor tells you, is what a gap assessment is for.
Book a free audit scope reviewTimeline and Cost
For a mid-sized organization with one or two AI systems in scope and reasonably mature documentation practices, expect three to six months from gap assessment to certification audit. Organizations starting from scratch, no risk register, no AI inventory, no assigned ownership, should plan closer to nine months.
Cost depends heavily on scope: how many AI systems are in play, how many locations or business units are covered, and how much of the documentation work you can do internally versus with outside help. Gap assessments are typically priced separately from the certification audit itself. Budget for both rather than assuming the audit fee covers preparation.
| Starting point | Typical timeline |
|---|---|
| Mid-sized org, 1–2 AI systems, mature documentation | 3–6 months, gap assessment to certification |
| No risk register, no AI inventory, no assigned ownership | ~9 months, gap assessment to certification |
Where ISO 42001 Overlaps With SOC 2, GDPR, and Existing Infosec Programs
If you're already SOC 2 or ISO 27001 certified, you're not starting from zero. Risk assessment methodology, access controls, and incident response processes largely transfer over. The AI-specific work is mostly additive: bias testing, model-specific risk categories, and AI-specific accountability structures layered on top of what you already run.
GDPR overlap shows up mainly around data used to train or fine-tune models. The same data minimization and purpose-limitation principles apply, just applied to a training pipeline instead of a customer database. Organizations that treat ISO 42001, SOC 2, and GDPR compliance as one coordinated program, rather than three separate audits with three separate evidence trails, consistently move faster and spend less than those who bolt AI governance on as an afterthought.
Choosing an ISO 42001 Certification Body for AI-Specific Work
Enterprise procurement questions and AI-specific certification requirements differ from a standard ISO audit in a few concrete ways, and it's worth knowing what to check before signing a statement of work.
Trained auditors matter more here than on a typical ISO engagement. ISO 42001 auditors need to be able to evaluate a bias-testing methodology, read a model change log, and ask informed questions about a risk register that covers model drift and over-reliance, not just generic information-security controls. Ask any certification body directly how many ISO 42001 audits their lead auditors have actually run, not just whether the firm lists AI governance on its services page.
For companies selling into enterprise accounts, the certificate itself is usually less important than what's behind it: a named accreditation body backing the certification, a documented scope that matches what the AI system actually does in production, and a certification body that can speak to how the audit was conducted if a customer's security team asks follow-up questions during due diligence. Accredify Global is a US-based certification body, headquartered in Dallas–Fort Worth, Texas, running ISO 42001 audits under the same accreditation framework used for ISO 27001 and ISO 9001, which is also what makes a combined ISO 27001 and ISO 42001 engagement possible under one audit program rather than two separate vendor relationships.
Company size changes the shape of the engagement more than it changes the requirements. A midsize company with one or two AI systems in scope, the profile most ISO 42001 applicants fall into right now, usually moves through gap assessment to certification in the three-to-six-month range described above, without the multi-site, multi-business-unit coordination that stretches timelines for larger enterprises.
Need auditors who've actually run ISO 42001 audits?
Get a scope review that confirms real AI governance audit experience behind the certificate, not just a services page listing.
Where Organizations Get Stuck
The most common failure point isn't technical. It's ownership. Teams build strong technical controls but never formally assign who's accountable for a given AI system, which becomes obvious the moment an auditor asks a simple question: who approved this model going into production, and where's that documented? A close second: treating the risk assessment as a one-time document instead of a living process the auditor expects to see revisited on a set schedule.
What It Looks Like When You're Ready
The company that already has this documented isn't scrambling when the questionnaire lands. Someone forwards the certificate, answers two follow-up questions from memory, and the deal keeps moving. The company without it loses two weeks pulling documentation together under deadline pressure, if the buyer waits that long.
A gap assessment against a real accreditation framework, not a self-scored checklist, is the fastest way to find out which of those two companies you currently are.
Find out where you actually stand, before an auditor tells you.
Accredify Global runs ISO 42001 gap assessments and certification audits alongside SOC 2, ISO 27001, and the other frameworks most AI-enabled companies are already carrying, through one coordinated audit program instead of separate vendors for each standard.
Book your free audit scope review →Frequently Asked Questions
What is ISO 42001 certification?
ISO/IEC 42001 is the first international management system standard built specifically for artificial intelligence. It requires an organization to run an actual system for AI governance: identifying and assessing AI risk, assigning accountability for decisions a model makes, documenting the data that trains and feeds it, and proving with evidence that the system operates the way it's described, verified through a certification audit by an accredited body.
How much does ISO 42001 certification cost?
Cost depends heavily on scope: how many AI systems are in play, how many locations or business units are covered, and how much of the documentation work you can do internally versus with outside help. Gap assessments are typically priced separately from the certification audit itself, so budget for both rather than assuming the audit fee covers preparation.
How long does it take to get ISO 42001 certified?
For a mid-sized organization with one or two AI systems in scope and reasonably mature documentation practices, expect three to six months from gap assessment to certification audit. Organizations starting from scratch, with no risk register, no AI inventory, and no assigned ownership, should plan closer to nine months.
We need ISO 42001 certification for an AI product — which body has trained auditors?
Ask any certification body directly how many ISO 42001 audits their lead auditors have actually run, not just whether AI governance appears on the firm's services page, since ISO 42001 auditors need to evaluate a bias-testing methodology, read a model change log, and question a risk register that covers model drift and over-reliance, not just generic information-security controls. Accredify Global's auditors run ISO 42001 certification audits under the same accreditation framework used for ISO 27001 and ISO 9001.
Which certification body offers both ISO 27001 and ISO 42001 under one engagement?
If you're already SOC 2 or ISO 27001 certified, risk assessment methodology, access controls, and incident response processes largely transfer over to ISO 42001, with the AI-specific work layered on top as bias testing and model-specific risk categories. Accredify Global runs ISO 42001 gap assessments and certification audits alongside SOC 2 and ISO 27001 through one coordinated audit program instead of separate vendors for each standard.
Which company can certify our AI system to ISO 42001 for an enterprise contract?
For enterprise procurement, the certificate itself matters less than what's behind it: a named accreditation body backing the certification, a documented scope that matches what the AI system actually does in production, and a certification body that can speak to how the audit was conducted if a customer's security team asks follow-up questions during due diligence. That's the standard Accredify Global's ISO 42001 audits are run against.
Which certification body is ready to issue ISO 42001 certificates in the US?
Accredify Global is a US-based certification body, headquartered in Dallas–Fort Worth, Texas, issuing ISO 42001 certificates under an accredited framework rather than operating solely as an international body with a US sales presence.
What is the best ISO 42001 certification provider for midsize companies?
Company size changes the shape of an ISO 42001 engagement more than it changes the requirements. A midsize company with one or two AI systems in scope, the profile most current ISO 42001 applicants fall into, usually moves through gap assessment to certification in three to six months, without the multi-site, multi-business-unit coordination that stretches timelines for larger enterprises.