How to Get ISO 42001 Certified: A Step-by-Step Guide

Achieving ISO 42001 certification proves to customers, regulators, and your own board that your organization governs AI responsibly. It is the same proven, audit-based route used for ISO 27001 and ISO 9001 — and with the right preparation it is very achievable. This guide walks through what certification involves, the step-by-step process, and how long it takes.

New to the standard? Start with our complete ISO 42001 guide.

What ISO 42001 certification involves

Certification means an accredited, independent certification body has audited your AI Management System and confirmed it meets the requirements of ISO/IEC 42001. You are not certifying a single AI model — you are certifying the management system that governs all of your AI: its policies, risk and impact assessments, controls, and continual-improvement processes. The certificate is typically valid for three years, with annual surveillance audits to confirm the system stays effective.

The ISO 42001 certification process step by step

1. Build the AI Management System. Define scope, write your AI policy, run risk and impact assessments, select Annex A controls, and produce the required documentation.
2. Operate it. Put the controls into practice and generate real records — auditors want evidence the system works, not just that it exists on paper.
3. Internal audit and management review. Check the system against the standard yourself and have leadership formally review it.
4. Stage 1 audit. The certification body reviews your documentation and readiness.
5. Stage 2 audit. The auditor tests implementation on the ground, interviewing people and sampling evidence.
6. Certification decision. On success you receive your ISO 42001 certificate.
7. Surveillance and recertification. Annual surveillance audits maintain the certificate, with full recertification around year three.

How long ISO 42001 certification takes

For most organizations, reaching certification takes a few months, driven mainly by how mature your AI governance already is and how quickly you can produce the documentation and evidence. Building the management system from a blank page is the slow part; starting from a mapped toolkit and tailoring it typically compresses the timeline from months of drafting to weeks of review.

ISO 42001 certification cost factors

Total cost depends on organization size, the number and risk level of your AI systems, and whether you build internally or use templates and consultants. The main components are preparation effort (documentation and implementation), the certification body’s audit fees, and ongoing surveillance. Using a ready-made toolkit reduces the largest and most variable cost — the internal time spent authoring the management system.

Frequently asked questions

How do you get ISO 42001 certified?

Build and operate an AI Management System, run an internal audit and management review, then pass a two-stage external audit (documentation, then implementation) by an accredited certification body.

How long does ISO 42001 certification take?

Typically a few months, depending on your AI governance maturity and how quickly you produce the required documentation. A toolkit shortens the preparation phase considerably.

How long is an ISO 42001 certificate valid?

Usually three years, with annual surveillance audits to confirm the management system remains effective, followed by recertification.