ISO Compliance Insights & Best Practices

ISO 42001 Certification Timeline: A Clear 2026 Roadmap

A realistic ISO 42001 certification timeline runs six to twelve months from decision to certificate for an organization starting without a management system, and three to six months for one that already operates ISO/IEC 27001 with discipline. Those are typical ranges seen in 2026, not promises — the audit itself takes days; what takes months is building the evidence a stage 2 auditor needs to see operating.

This guide breaks the timeline into its eight phases, gives a typical duration and the exit criterion for each, explains where the calendar can be compressed and where it cannot, and covers the one external dependency — certification-body accreditation under ISO/IEC 42006:2025 — that can add weeks you do not control.

ISO 42001 certification timeline: eight phases from decision to certificate — Eight phases. The middle three are where the calendar is decided.

The ISO 42001 certification timeline in eight phases

Phase	Typical duration	Exit criterion
1. Scope and gap analysis	2–4 weeks	AIMS scope agreed (clause 4.3), AI system inventory complete, gap report against clauses 4–10 and Annex A
2. Design and documentation	4–8 weeks	AI policy, objectives, risk criteria, procedures and Statement of Applicability approved
3. Risk and impact assessments	3–6 weeks (overlaps 2)	Risk assessment (6.1.2) and an impact assessment (6.1.4) per AI system; treatment plan approved with residual risk accepted
4. Implementation and evidence	3–6 months	Controls operating; monitoring data, oversight logs and life-cycle records accumulating for every in-scope system
5. Internal audit and management review	2–4 weeks	Full internal audit (9.2) done, nonconformities in corrective action, management review (9.3) minuted
6. Stage 1 audit	1–2 days on site or remote, 2–6 weeks’ lead time to book	Documentation reviewed, readiness confirmed, stage 2 date set
7. Stage 2 audit	2–5 days, typically 4–8 weeks after stage 1	Implementation verified; findings issued
8. Findings closed and certificate issued	2–8 weeks	Corrective actions accepted by the certification body; certificate valid 3 years

Add the phases and the first-time ISO 42001 certification timeline lands at roughly six to twelve months. Organizations with an existing ISMS skip most of phase 2 for the shared clauses and shorten phase 4, because clause 7 disciplines — document control, competence, awareness, internal audit — already run.

The ISO 42001 certification timeline phase by phase

1. Scope and gap analysis

Fast if the AI system inventory exists; slow if nobody can list which systems the organization develops, buys and uses. The scope decision itself — one product line, one business unit, or the whole organization — is the biggest single lever on everything that follows. Our ISO 42001 implementation guide covers how to draw it.

2. Design and documentation

Writing from a blank page is where teams lose a quarter. Working from templates mapped to the clauses turns this into a review-and-tailor exercise measured in weeks. The documents that gate the next phase are the AI policy (5.2), the risk criteria (6.1.1), and the procedures for risk assessment, impact assessment and the AI system life cycle.

3. Risk and impact assessments

One impact assessment per AI system, or per justified grouping. Ten systems in scope means ten assessments, each needing product, engineering, legal and privacy input. This phase is limited by calendar availability of those people more than by effort. See our guides to the ISO 42001 risk assessment and the AI system impact assessment.

4. Implementation and evidence — the phase you cannot compress

A stage 2 auditor tests whether the system is operating, not whether it is designed. Clause 9.1 monitoring needs results; A.6.2.6 operation and monitoring needs records; A.6.2.8 needs event logs; human oversight needs a log with entries in it. Three months of operating evidence is the practical minimum a certification body will accept as demonstrating an implemented and maintained system; six is comfortable. Starting the clock early — turning controls on before the documentation is polished — is the single most effective way to shorten the whole ISO 42001 certification timeline.

5. Internal audit and management review

Both must have happened before stage 2, and the certification body will want to see the corrective actions from the internal audit at least in progress. Book the internal audit for the point at which three months of evidence exists, not at the end of documentation. Our guide to the ISO 42001 internal audit sets out what it has to cover.

6 and 7. Stage 1 and stage 2

Stage 1 is a documentation and readiness review; stage 2 is the implementation audit. The gap between them is set by the certification body and by how many stage 1 observations you have to clear. Booking lead times for AI management system audits are longer than for ISO 27001 in 2026 because the pool of auditors competent under ISO/IEC 42006 is still small — engage the certification body during phase 2, not phase 5.

8. Closure and certificate

Minor nonconformities are usually closed with a corrective action plan and evidence; major ones may require a follow-up visit. The certificate runs for three years, with surveillance audits in years one and two and a recertification audit before expiry — the standard ISO/IEC 17021-1 cycle.

The ISO 42001 certification timeline dependency nobody controls: ISO/IEC 42006:2025

ISO/IEC 42006:2025, published on 7 July 2025, sets the requirements for bodies auditing and certifying AI management systems — competence of auditors, audit time calculation, impartiality — on top of ISO/IEC 17021-1. Accreditation bodies are extending certification bodies’ scopes to it. In practice this means two things for your ISO 42001 certification timeline:

Ask any certification body you shortlist whether its ISO 42001 scope is accredited and by which accreditation body, and whether that accreditation is to ISO/IEC 42006:2025. An unaccredited certificate is a real certificate but carries less weight with customers and regulators.
Expect audit days to be calculated under 42006’s method, which considers the number and complexity of AI systems in scope rather than headcount alone. More systems means more days, and more days means a longer stage 2 and a higher fee — our ISO 42001 certification cost guide gives the bands.

Three ISO 42001 certification timeline profiles side by side

Profile	Starting position	Typical ISO 42001 certification timeline
AI-native startup, 2–3 AI systems, no management system	Engineering discipline, no governance documents	6–9 months; phase 4 dominates
Mid-size company with ISO 27001, deploying vendor AI	ISMS running, no AI inventory	3–6 months; phases 1 and 3 dominate because scope and impact assessments are new
Enterprise AI provider, 15+ systems, several jurisdictions	Some governance, uneven across teams	9–14 months; the per-system impact assessments and audit-day count stretch every phase

Where the ISO 42001 certification timeline can be compressed

Start evidence before documents are final. Turn on monitoring, logging and oversight records in month one.
Template the documentation. Phase 2 from eight weeks to two.
Run impact assessments in parallel, with a facilitator and a fixed template, rather than one after another.
Book the certification body early. Auditor availability is the external constraint in 2026.
Do not narrow the scope to save time and then widen it later. A scope extension is a new audit.

What no ISO 42001 certification timeline can compress: the operating evidence in phase 4, the mandatory internal audit and management review, and the certification body’s own gap between stages.

Frequently asked questions

How long does ISO 42001 certification take?
Six to twelve months is typical for a first-time management system; three to six for organizations that already run ISO 27001 well. The audits are days; the evidence-building is months.

Can we get certified in 90 days?
Only with an existing management system, a small scope, evidence already accumulating and a certification body with availability. For most organizations the three-month figure is the length of phase 4 alone.

How long is the certificate valid?
Three years, subject to surveillance audits in years one and two and a recertification audit before expiry.

Does the ISO 42001 certification timeline change if we already hold ISO 27001?
Yes, materially. The shared clauses — context, leadership, support, performance evaluation, improvement — are already implemented; what remains is the AI-specific work in clauses 6 and 8 and Annex A.

What most often delays certification?
Impact assessments that are late or shallow, evidence that started accumulating too late, and certification-body lead times. All three are avoidable with early planning.

Where this leaves you

Plan the ISO 42001 certification timeline backwards from the stage 2 date the certification body can offer, and make sure at least three months of operating evidence will exist by then. Front-load the scope decision and the impact assessments, template the documentation, and treat the internal audit as a milestone in the middle of the project rather than a task at the end. Do that and the six-to-twelve-month range becomes a schedule rather than a hope.

References

ISO/IEC 42001:2023 — the AI management system standard that certification is issued against.
ISO/IEC 42006:2025 — requirements for bodies providing audit and certification of AI management systems, published 7 July 2025.