ISO/IEC 42006 Explained: Who Is Allowed to Certify Your AI Management System
ISO/IEC 42001 tells your company what to build. ISO/IEC 42006 tells the certification body how it must audit you. Here is what the second one requires, and the check to run before you hire.
The short answer
ISO/IEC 42006:2025 is the standard that sets requirements for bodies that audit and certify AI management systems. It was published in July 2025 and sits on top of ISO/IEC 17021-1, the general rulebook for management-system certification bodies. You are not certified to it. Your certification body is held to it.
So a company can certify its AI management system to ISO/IEC 42001 only through an accredited certification body whose accreditation covers AI management systems. Check the accreditation body, the accredited scope on the public register, and the audit team before you sign.
Accredify Global is accredited under UAF, an IAF MLA signatory, with ISO/IEC 42001 in scope, and we encourage you to verify that the same way you would for any body.
ISO 42001 vs ISO 42006: Two Standards, Two Different Jobs
When a buyer asks who certified your AI governance, the honest answer has two layers. One is the standard your company followed. The other is the standard the certifier followed. People often mix the two up, and the difference decides how much weight the certificate carries.
| Standard | Who it is for | What it governs |
|---|---|---|
| ISO/IEC 42001:2023 | The organisation building or using AI | The AI management system: policy, risk and impact assessment, data and model controls, oversight, improvement |
| ISO/IEC 17021-1 | Any body that audits and certifies management systems | The general rules for impartiality, competence, audit process and certification decisions |
| ISO/IEC 42006:2025 | Bodies that certify AI management systems, and the accreditation bodies that assess them | The AI-specific additions on top of 17021-1: audit-team competence, audit time, certification documents, and more |
ISO 42001 certifies the management system around your AI. It does not approve a particular model or product as safe.
Put simply, a company is certified to 42001. Its certification body is accredited against 17021-1 with 42006 added for AI work. A certificate is only as strong as that second layer.
Three numbers in the ISO/IEC 42000 series are worth keeping straight. ISO/IEC 42001 is the management system standard you implement. ISO/IEC 42005:2025 gives guidance on assessing the impact of an AI system, which feeds the risk and impact work 42001 expects. ISO/IEC 42006 is the one aimed at the certifier. Only 42001 is a standard you get certified to. You can read the standards' own descriptions on the ISO page for 42001 and the ISO artificial intelligence sector page.
What ISO/IEC 42006 Asks of a Certification Body
The standard does not rewrite how audits work. It adds AI-specific expectations to the rules that already apply. Based on the published summaries from the standards and accreditation community, these are the areas that matter most to a buyer.
Competence of the audit team
Auditing AI is not auditing a standard IT system. The standard looks at the competence of the audit team as a whole, including an understanding of AI technologies, the AI management system standard and its controls, and the legal obligations within scope.
A structured way to set audit time
Audit duration is calculated with a defined method, not only by company size. It starts from the people involved in the AI lifecycle and is adjusted for factors such as how many AI systems are in scope, how sensitive their use is, and third-party dependencies.
Impartiality and liability
The body must stay independent of the organisations it audits and manage its liability responsibly. Accreditation bodies assess both. Added requirements on liability were among the changes made as the standard moved to its final form.
Clear certification documents and scope
What the certificate covers should be stated clearly, so a buyer can see which AI management system, and which part of the organisation, the certificate refers to.
One more point is easy to miss. Accreditation bodies use 42006 to assess certification bodies, which supports consistency between them and recognition across borders. In August 2025, for example, the Standards Council of Canada announced that new applicants and scope extensions would be assessed against the 2025 edition, and that bodies it had already accredited would need to move their accreditation to it. Other accreditation bodies are working through the same transition on their own timelines.
What This Means for a Company Buying Certification
You do not need to read 42006 to benefit from it. What it gives you is a sharper set of questions. A body that has been through the AI-specific assessment should be able to answer them without hesitation. If the answers are vague, that tells you something about the audit you would receive.
Comparing certification bodies for ISO 42001? A short scoping call shows how your AI systems and scope translate into audit time, and what we would be accountable for.
Book a scoping callFive Checks Before You Choose a Certification Body
- 01The accreditation bodyFind out who accredited the certification body, and confirm it is a signatory of the IAF Multilateral Recognition Arrangement. That is what lets a certificate be accepted across borders.
- 02The accredited scopeLook the body up on the public register and confirm that ISO/IEC 42001 or AI management systems is named in its scope, not only ISO 27001 or ISO 9001. A logo on a homepage can be copied. A register entry cannot.
- 03The transition to 42006Ask where the body stands on ISO/IEC 42006 and what its accreditation body has confirmed. A confident, specific answer is a good sign.
- 04The people who will audit youAsk who leads the audit, how many ISO 42001 audits that person has led, and how they would approach your AI risk and impact assessment, your data controls and your change management for models.
- 05Independence from the buildA firm that builds your management system and also certifies it is auditing its own work. Keep implementation help and certification with separate organisations.
Three Things to Look at Twice
None of these means a certificate is fraudulent. Each is a good reason to check the register yourself, before a customer does it for you at a harder moment.
No accreditation mark
A certificate that carries no accreditation body mark anywhere on it, or a mark you cannot trace on the accreditation body's own site.
Certification in a fixed number of days
A quote that promises a result by a set date, whatever the audit finds. Audit time should come from your scope and your AI systems, not from a promise.
One firm that builds and certifies
A single organisation offering to write your policies and then certify them. The two roles have to stay apart.
A claim that the certificate approves your model
ISO 42001 covers the management system around your AI. Anyone selling it as a safety approval of a product is overstating it.
If You Already Hold ISO 27001: Certifying Both Together
Many AI companies reach ISO 42001 with ISO 27001 already in place. Both standards share the same management system structure, so much of the groundwork carries over: leadership commitment, risk treatment, internal audit, management review and corrective action. What 42001 adds is the AI-specific layer: AI risk and impact assessment, data and model lifecycle controls, and accountability for how AI systems are built and used.
That makes a combined engagement worth asking about. When one certification body holds both standards in its accredited scope, it can plan the two audits together, so your team answers one set of questions about shared processes instead of two. Ask any body you compare whether it can do this, and whether the same senior auditor would lead both. Your audit time still comes from your scope under each standard, so treat a quote that skips that step with care. For the information security side, see our ISO 27001 certification page.
How We Answer the Same Questions
When a buyer asks whether the body that issued our certificate is allowed to certify AI management systems, this is our answer:
Yes. Our Artificial Intelligence Management System (AIMS) is certified to ISO/IEC 42001:2023. Our certification body is accredited by the United Accreditation Foundation (UAF). As required by international accreditation rules, UAF assessed our certification body against ISO/IEC 42006:2025 to grant them the competence and authority to issue our certificate.
Accredify Global is accredited under UAF, an IAF MLA signatory, and ISO/IEC 42001 is within our scope. A senior auditor leads every ISO 42001 engagement. After a free scope review you receive one fixed-fee proposal for your real scope, with no hidden costs added afterwards. We do not write your policies or build your system, and the certification decision stays independent.
Accreditation bodies publish how they assess certification bodies for AI. For example, ANAB lists its ISO/IEC 42001 accreditation programme, and IAF members recognise each other's accredited certificates under the Multilateral Recognition Arrangement described at iaf.nu.
We would rather you check us than take our word for it. Use the five checks above on us, and on anyone else you are considering. For the practical side of the process, see our ISO 42001 certification page and our guide to ISO 42001 certification cost. If you are new to the idea of accreditation, what an accredited certification body is explains why it matters, and our AI governance and compliance services page shows how ISO 42001 fits with your wider programme.
Want to check a certification body before you sign?
A free scope review shows what an ISO 42001 audit would involve for you, and which questions to put to any body you compare.
An audit you can defend to your buyer
Accredify Global is accredited under UAF, an IAF MLA signatory, across ISO 9001, 27001, 42001, 14001, 45001, 13485, and more. After a short scoping call you receive one fixed-fee proposal, with no hidden costs added after scoping.
Book your free scope review →Frequently Asked Questions
What is ISO/IEC 42006?
ISO/IEC 42006:2025 is the international standard that sets requirements for bodies that audit and certify artificial intelligence management systems (AIMS). It was published in July 2025 and supplements ISO/IEC 17021-1. It is written for certification bodies and for the accreditation bodies that assess them. It is not a standard that a company gets certified to.
What is the difference between ISO 42001 and ISO 42006?
ISO/IEC 42001 is the AI management system standard that a company implements and is audited against. ISO/IEC 42006 governs the certification body doing the audit: its competence, impartiality, audit-time method and processes. A company is certified to 42001; its certification body is accredited against 17021-1 together with 42006.
Does my company need to comply with ISO 42006?
No. ISO/IEC 42006 applies to certification bodies and accreditation bodies, not to the organisations they certify. What it changes for you is the check you run on the certification body before you hire it.
Does ISO 42006 replace ISO/IEC 17021-1?
No. It adds AI-specific requirements on top of ISO/IEC 17021-1, which remains the general standard for bodies that audit and certify management systems.
How do I check whether a certification body is qualified to certify ISO 42001?
Find the accreditation body that accredited it and confirm that body is an IAF MLA signatory. Then look the certification body up on the public register and confirm that ISO/IEC 42001, or AI management systems, is named in its accredited scope. Finally, ask how it is handling the move to ISO/IEC 42006.
Can I certify ISO 27001 and ISO 42001 in one engagement?
Yes, if the certification body holds both standards in its accredited scope. It can plan the two audits together, so shared processes such as internal audit, management review and risk treatment are examined once. Audit time is still set by your scope under each standard.
Does an ISO 42001 certificate mean the AI product or model is safe?
No. The certificate covers the defined scope of your AI management system: how you govern, assess risk, control change and oversee AI. It is not a safety approval for any individual model or product.
Can the firm that helps me build the AI management system also certify it?
Not for the same client. Accredited certification bodies must stay impartial, and a body that writes your policies would be auditing its own work. Keep the implementation help and the certification audit with separate organisations.