ISO/IEC 42006: What It Means When You Choose an ISO 42001 Certification Body
ISO 42001 tells you how to run an AI management system. ISO/IEC 42006 tells the certification body how to audit it. Here is what that second standard requires, and how to use it to check a body before you sign.
An enterprise customer asks for an AI management system certificate before it signs. You search for a certification body and find dozens, all saying they can certify your AI management system. What the search results rarely say is that there is now a standard for the certifiers themselves.
That standard is ISO/IEC 42006, often shortened to ISO 42006. It sets out how these bodies must work: who can audit, how long the audit must take, and what the certificate must show. If you know what it asks for, you can tell quickly whether a body is ready to audit AI.
Quick answer: ISO/IEC 42006:2025 is the standard for bodies that audit and certify AI management systems against ISO/IEC 42001. It was published on 7 July 2025 and adds AI-specific requirements to ISO/IEC 17021-1. It covers auditor competence, audit time and certificate content. Accreditation bodies now use it to accredit ISO 42001 certification bodies, so ask any body you shortlist whether ISO 42001 is in its accredited scope and how its auditors meet ISO/IEC 42006.
What Is ISO 42006?
Three standards work together when you certify an AI management system. Only one of them applies to you.
| Standard | Who it applies to | What it sets |
|---|---|---|
| ISO/IEC 42001:2023 | Your organization | Requirements for an AI management system (AIMS) |
| ISO/IEC 17021-1 | Every management system certification body | General rules on impartiality, competence and the audit process |
| ISO/IEC 42006:2025 | Bodies that certify ISO 42001 | Extra AI-specific rules on auditors, audit time and certificates |
| ISO/IEC 42005:2025 | Your organization (guidance) | How to assess the impact of an AI system on people and society |
You certify to ISO 42001 only. ISO 42006 applies to the certification body, and ISO/IEC 42005 is guidance you can use for the AI impact assessments that ISO 42001 asks for. ISO/IEC 42006 applies to bodies certifying organizations that provide, develop or use AI systems. It plays the same role for AI management systems that ISO/IEC 27006-1 plays for ISO 27001. If you are new to how certification and accreditation fit together, start with our guide to what an ISO certification body is.
Why ISO/IEC 42006 Matters to Buyers of ISO 42001 Certification
Before ISO/IEC 42006, a certification body could audit AI management systems using only the general rules in ISO/IEC 17021-1. There was no common bar for what an AI auditor must know. Now accreditation bodies assess these certification bodies against both ISO/IEC 17021-1 and ISO/IEC 42006.
- Enterprise customers increasingly check that an AIMS certificate is accredited, not just issued.
- Accredited certificates can be verified through the accreditation body and the certification body's register.
- Consistent audits mean two accredited bodies should reach a similar view of the same AIMS.
A certificate from a body that is not accredited for this standard can be legal to issue. It is just much harder for your customers to rely on.
What ISO/IEC 42006 Expects of ISO 42001 Auditors
The standard accepts that no single person is likely to know everything an AI audit needs. Instead, it requires the certification body to define the competence each role needs and to make sure the audit team as a whole has it.
The standard
The AIMS requirements, the Annex A controls, and how they work in practice.
AI technology
How the AI systems in scope are built, trained, deployed and monitored.
AI law and obligations
Awareness of the legal requirements that apply to AI within your scope.
Your sector
Industry terms, risks and practices, including software development where relevant.
The same applies beyond the audit team. The people who review your application and make the certification decision also need the right competence. The standard defines technical areas by the fields of AI within your scope, so a body should be able to say which technical areas it covers.
How ISO/IEC 42006 Sets Audit Time
Audit time for an AIMS is not set by headcount alone. ISO/IEC 42006 has a normative annex on audit time. The calculation starts from the number of people under your control who are involved in AI life cycle processes, then adjusts for factors such as:
- the number and complexity of AI systems in scope
- high-risk or sensitive uses of AI
- the legal and regulatory frameworks that apply
- third parties involved in your AI life cycle
- the number of sites, with separate rules for multi-site sampling
The standard also covers combined audits of more than one management system, and how remote auditing can be used. Ask any body to show how it calculated your audit days. A quote that looks much lower than others usually means fewer days than the rules allow.
What ISO 42006 Means for Your Audit
You never get audited against ISO 42006 yourself, but it shapes how your ISO 42001 audit runs. Expect the same two-stage structure as other management system audits, carried out by a team that meets the competence rules above.
| Stage | What the auditor looks at |
|---|---|
| Stage 1 | Your AIMS scope, your inventory of AI systems and your role for each (developer, provider or user), your AI policy, and your risk and impact assessment method |
| Stage 2 | Evidence that controls work in practice, sampled across the AI systems in scope |
| Surveillance | Annual audits in years two and three, then recertification |
The evidence auditors usually ask for:
- A current inventory of AI systems in scope, including third-party AI you use
- Your AI policy and objectives, and who is accountable for them
- AI risk assessments and risk treatment, with a Statement of Applicability for the Annex A controls
- AI system impact assessments for affected people and groups
- Records across the AI life cycle: data, development, testing, deployment and monitoring
- Supplier controls for AI models, data and services you buy in
- An internal audit and a management review of the AIMS
If you only use AI built by others, such as a third-party model behind your product, you can still certify. Your scope covers how you select, use and monitor that AI. Our ISO 42001 checklist goes clause by clause.
Planning ISO 42001 for an AI product? See how our accredited audit works, from scope review to certificate.
See ISO 42001 certificationHow to Check an ISO 42001 Body Has Trained Auditors
Use ISO 42006 as your checklist. Ask every body on your shortlist these questions, and compare the answers side by side.
| Question | What a good answer covers |
|---|---|
| Is ISO 42001 in your accredited scope? | The accreditation body's name, and where you can check it |
| How do your auditors meet ISO/IEC 42006? | Defined competence for AI, the standard, AI law and your sector |
| Who leads our audit? | A named lead auditor, with AI or software experience in your field |
| How did you work out our audit days? | People in AI life cycle processes, AI systems in scope and risk factors |
| Can you audit ISO 42001 with ISO 27001? | One audit program, with shared evidence where the rules allow |
| How will our customers verify the certificate? | A public register and accredited certificate details |
Comparing several bodies? Our guide to choosing a certification body has a fuller scorecard that applies to ISO 42001 as well.
Red Flags When Choosing an ISO 42001 Certification Body
- No accreditation for ISO 42001. Accreditation for ISO 9001 or ISO 27001 does not cover ISO 42001.
- An auditor with no AI background. General management system experience is not enough on its own.
- A fixed number of days for every client. Audit time should reflect your AI systems and risk.
- Building your AIMS and certifying it. A certification body must stay impartial and cannot certify a system it designed.
- No way to verify certificates. Your customers should be able to check yours.
Still building your AI management system?
Our ISO 42001 checklist walks through the clauses, the controls and what audit-ready looks like.
Certifying ISO 42001 and ISO 27001 Together
Many AI companies already hold ISO 27001 or are working towards it. Both standards share the same management system structure, so one certification body can audit them together as one program. Combined audits share evidence for common clauses, such as context, leadership, internal audit and management review. Each standard is still audited against its own requirements, including the controls specific to it.
If you are deciding between frameworks, our page on AI governance and compliance compares ISO 42001 with the EU AI Act and the NIST AI RMF. Our ISO 27001 certification page covers the information security side.
ISO 42001 Certification with Accredify Global
Accredited for ISO 42001
ISO 42001 is in our UAF accreditation scope, so your certificate is accredited.
Senior auditor
A senior auditor leads every ISO 42001 engagement, from scope review to certificate.
ISO 27001 and ISO 42001 together
One audit program and one team, with evidence shared where the rules allow.
Fixed fee
One fixed-fee proposal for your real scope, with no hidden costs or scope creep added later.
We audit on site, remotely or in a hybrid format, as explained in our guide to remote ISO audits. As a certification body we audit your AIMS but do not design it, in line with our trust and impartiality rules. You can check any certificate we issue on our certificate verification page, and teams in the US can see ISO certification in the USA.
Need ISO 42001 for an enterprise contract?
Tell us about your AI systems, team and deadline. We'll show how your audit days are worked out, suggest dates and send a fixed-fee proposal.
Book your free scope review →ISO/IEC 42006 FAQ
What is ISO 42006?
ISO/IEC 42006:2025 is the standard for bodies that audit and certify AI management systems against ISO/IEC 42001. It adds AI-specific requirements to ISO/IEC 17021-1, covering auditor competence, audit time and certificate content.
When was ISO/IEC 42006 published?
ISO published ISO/IEC 42006:2025, edition 1, on 7 July 2025.
What is the difference between ISO 42001 and ISO 42006?
ISO 42001 sets requirements for your AI management system. ISO 42006 sets requirements for the certification body that audits it. Your organization certifies to ISO 42001; you never certify to ISO 42006.
Do ISO 42001 certification bodies need to meet ISO 42006?
Accreditation bodies now use ISO/IEC 42006 together with ISO/IEC 17021-1 to accredit bodies that certify ISO 42001. Ask any body whether ISO 42001 is in its accredited scope.
How do I know an ISO 42001 certification body has trained auditors?
Ask how its auditors meet the competence requirements of ISO/IEC 42006: knowledge of ISO 42001 and its Annex A controls, AI technology, AI legal obligations in your scope and your sector. Ask who will lead your audit and what AI experience they have.
How is ISO 42001 audit time calculated?
Under ISO/IEC 42006, audit time starts from the number of people involved in AI life cycle processes and is adjusted for factors such as the AI systems in scope, high-risk uses, regulation, third parties and sites.
Can ISO 42001 and ISO 27001 be audited together?
Yes. Both follow the same management system structure, so one certification body can audit them as one program and share evidence for common clauses. Each standard is still audited against its own requirements.
Does ISO 42006 apply if we only use third-party AI?
ISO 42006 applies to the certification body, not to you. Your ISO 42001 certification can cover AI you only use, such as a third-party model, by covering how you select, use and monitor it.
What evidence matters most in an ISO 42001 audit?
An inventory of AI systems in scope, your AI policy, AI risk and impact assessments, a Statement of Applicability, life cycle records, supplier controls, and an internal audit and management review.
Which certification body can certify our AI system to ISO 42001 for an enterprise contract?
Choose a body with ISO 42001 in its accredited scope, auditors who meet ISO/IEC 42006, and a register your customer can check. Accredify Global is UAF-accredited for ISO 42001, and a senior auditor leads every engagement.
Is Accredify Global accredited for ISO 42001?
Yes. ISO 42001 is in Accredify Global's UAF accreditation scope. A senior auditor leads every ISO 42001 engagement, and you get a fixed-fee proposal after a free scope review.