How to Get ISO 42001 Certified: Steps, Timeline, and What the Audit Checks

To get ISO 42001 certified, you define the scope of your AI management system (AIMS), assess your gaps against the standard, build and operate the required processes and controls, run an internal audit and management review, and then pass a two-stage audit by an accredited certification body. For a prepared SaaS company, that typically takes about three to six months. The certificate is valid for three years, with annual surveillance audits.

Below is the process in order, with what each step produces and a phased timeline you can plan against.

Before you start: three decisions

1. Why you are doing it. Usually a customer requirement, a regulatory concern, or both. The reason shapes the scope: if one enterprise customer is asking about one product, certify that product first.

2. Who owns it. Name an AIMS owner with time to run the project. Top management must also be visibly involved, because Clause 5 requires leadership commitment and the auditor will interview leadership.

3. Who will certify you. Pick an accredited certification body early, because their calendars fill up. Confirm accreditation covers ISO/IEC 42001 specifically; in the US, ANAB runs an accreditation program for ISO/IEC 42001 certification bodies. Remember that your certification body cannot also be your consultant.

Step 1: Inventory your AI systems and define scope

List every AI system you develop, provide, or use, including third-party models and AI features inside vendor tools. For each, note its purpose, owner, data sources, users, and who it affects.

Then write the AIMS scope statement (Clause 4.3): which AI systems, products, teams, and locations are in, what is out, and why. Also record your role for each system (developer, provider, user) and the internal and external issues and interested-party requirements that shape your AIMS (Clauses 4.1 and 4.2).

Our AI risk assessment guide covers building an AI inventory in more detail.

Step 2: Run a gap assessment

Compare current practice against every requirement in Clauses 4 to 10 and every one of the 38 Annex A controls. The output should be:

• A list of gaps, each rated by effort and audit risk
• A prioritized remediation plan
• A first draft of the Statement of Applicability (which Annex A controls apply, which do not, and why)

You can start with our free readiness self-assessment and the ISO 42001 checklist, or commission a full ISO 42001 gap assessment (fixed fee from $12,500, about two weeks).

Step 3: Build the core AIMS documents

These are the documents the auditor will read first in Stage 1:

Document	Clause / control	What it should do
AIMS scope	4.3	State boundaries and AI systems covered
AI policy	5.2, A.2	Set direction and commitments, approved by top management
Roles and responsibilities	5.3, A.3	Name who owns what, including how concerns are reported
AI risk assessment methodology	6.1.2	Define how risks are identified, analyzed, and evaluated
AI risk treatment plan	6.1.3	Record chosen treatments and control owners
AI system impact assessment process	6.1.4, A.5	Assess consequences for individuals, groups, and society
Statement of Applicability	6.1.3	Justify inclusion or exclusion of each Annex A control
AI objectives	6.2	Measurable objectives with owners and timelines
Document control procedure	7.5	Versioning, approval, and retention of documented information

Use an AI policy template as a starting point, but tailor it. Auditors notice policies that describe processes the company does not run.

Step 4: Implement the Annex A controls you selected

This is the operational work: putting controls into the AI life cycle (A.6), data handling (A.7), information for interested parties (A.8), responsible use (A.9), and supplier and customer relationships (A.10). For most SaaS teams, that means adding governance steps to existing engineering workflows, such as requirements reviews, documented validation before deployment, monitoring and event logging, and incident communication paths.

See the Annex A controls guide for what evidence typically satisfies each control.

Step 5: Run the system and build records

The auditor in Stage 2 is checking that the AIMS operates, not just that it is written down. That means records: completed impact assessments, risk register updates, training and awareness records (Clause 7.2 and 7.3), approvals, monitoring outputs, supplier reviews, and logged incidents or concerns.

Certification bodies generally expect the AIMS to have been operating for a period before Stage 2, commonly around three months of records. Plan for this. It is the main reason certification takes months rather than weeks.

Step 6: Internal audit and management review

Run a full internal audit (Clause 9.2) against the standard and your own procedures. The internal auditor should be objective and impartial with respect to the areas they audit, which is why many companies use an outside party for this. Log any findings as nonconformities and work them through corrective action (Clause 10).

Then hold a management review (Clause 9.3) with top management. Cover the inputs the standard expects, such as audit results, objective performance, risk changes, and feedback from interested parties, and record decisions and actions.

Auditor's note: In audits, a common gap we look for is a management review that happened on paper only: a slide deck with no recorded decisions, no actions, and no owners. Auditors read management review minutes closely because they show whether leadership actually runs the system. Record what was decided, who owns each action, and by when, then show those actions closed at the next review.

Step 7: Stage 1 audit

Stage 1 is a documentation and readiness review. The auditor checks your scope, AI policy, risk and impact assessment methods, Statement of Applicability, and whether the internal audit and management review have happened. They will tell you whether you are ready for Stage 2 and flag any areas of concern.

Treat Stage 1 findings as a short punch list. Close them before Stage 2.

Step 8: Stage 2 audit

Stage 2 tests implementation and effectiveness. Expect interviews with the AIMS owner, leadership, engineers, and product owners, and sampling of records for specific AI systems: pick-a-system walkthroughs from inventory to impact assessment to risk treatment to controls in operation.

Findings are graded as major or minor nonconformities or opportunities for improvement. Major nonconformities generally must be closed before certification is granted.

Step 9: Certification and the three-year cycle

After a successful Stage 2 and the certification body's decision, you receive a certificate valid for three years. Surveillance audits follow in each of the next two years, and a recertification audit renews the certificate before it expires. Between audits, you keep running internal audits, management reviews, and corrective actions. Our AIMS retainer covers that ongoing work.

Realistic ISO 42001 implementation timeline

This is a typical plan for a SaaS company starting without ISO 27001, with a single product line in scope. Phases overlap.

Phase	Typical weeks	Key activities	Outputs
0. Mobilize	Week 0–1	Name AIMS owner, confirm leadership sponsor, shortlist certification bodies	Project plan, sponsor sign-off
1. Scope and gap assessment	Weeks 1–3	AI inventory, scope statement, gap assessment against Clauses 4–10 and Annex A	Gap report, remediation plan, draft SoA
2. Build core documents	Weeks 3–8	AI policy, roles, risk method, impact assessment process, objectives, procedures	Approved AIMS documentation
3. Implement controls and assess	Weeks 4–10	Risk and impact assessments for in-scope systems, control changes in life cycle and supplier processes, training	Completed assessments, risk treatment plan, final SoA, training records
4. Operate and gather records	Weeks 6–18	Run processes, log evidence, handle concerns and incidents	Roughly three months of operating records
5. Internal audit and management review	Weeks 14–18	Independent internal audit, corrective actions, management review	Internal audit report, CAPA log, management review minutes
6. Stage 1 audit	Around week 18–20	Documentation and readiness review by the certification body	Stage 1 report, punch list
7. Stage 2 audit	A few weeks after Stage 1	Implementation and effectiveness audit	Stage 2 report, any nonconformities
8. Certification decision	After nonconformities are addressed	Body reviews corrective actions and decides	Certificate (valid three years)

Organizations that already run ISO 27001 can often shorten phases 2 and 5 substantially, because document control, internal audit, and management review already exist. Larger scopes with many AI systems tend to stretch phase 3. The actual gap between Stage 1 and Stage 2, and how long you have to close findings, is set by your certification body.

For what each phase costs, see ISO 42001 certification cost.

Common mistakes that delay certification

• Scope too broad. Every AI system in scope needs an impact assessment and evidence. Start narrow.
• Booking the audit too late. Certification body availability can set your timeline. Contact them early.
• Documents without records. A policy is not evidence of operation. Stage 2 samples records.
• Impact and risk assessments that don't connect. The auditor will trace from one to the other for a sample system.
• Excluding Annex A controls without justification. Every exclusion in the SoA needs a reason tied to your context and risk assessment.
• Internal audit run by the person who built the system. Auditors look for objectivity.

How TrustAIMS helps

TrustAIMS is not a certification body; an independent accredited body audits and certifies you. Our certification readiness engagement (fixed fee from $35,000, about 10 to 14 weeks) builds the AIMS with your team: policy, scope, risk and impact assessments, Statement of Applicability, procedures, training, internal audit, and management review, then supports you through Stage 1 and Stage 2.

Not sure where you stand? Start with the free 10-question readiness assessment, read the ISO 42001 overview, or contact us to scope a project. Pricing for all services is on the pricing page.