ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 42001 surveillance audit is the yearly check that your AI management system still works after the certificate arrives. It is lighter than the first audit, but it is where many organizations discover that certification is a programme, not a project.
Auditors do not repeat the entire audit. They sample parts of the system, follow up on earlier findings and look for evidence that the system is being maintained and improved.
This guide covers the three-year cycle, what gets sampled, how to prepare and what can put your certificate at risk. For the first audit, see our ISO 42001 Stage 1 audit guide.
Free gap assessment
How much of ISO 42001 could you evidence today?
Score every clause and Annex A control of the AI management standard, free, and see where the programme really sits.
Run the free ISO 42001 gap assessment → or View premium report sample
A management system certificate is typically valid for three years. During that period the certification body carries out surveillance audits, usually once a year, to confirm continued conformity.
At the end of the cycle a recertification audit checks the whole system again and, if successful, starts a new cycle. These expectations come from ISO/IEC 17021-1, which governs certification bodies, and your certifier will confirm its exact rules.
So the pattern is initial audit, surveillance in years one and two, then recertification before the certificate expires.
For the audit rules that apply to certifiers, see ISO/IEC 42006:2025 on iso.org.
Surveillance audits do not cover every clause each time. Auditors plan a programme so that, over the cycle, the whole system is sampled. Some areas are always included, such as internal audit, management review, corrective action and changes to the system.
They also follow up on previous findings, review use of the certificate and logo, and check for changes in scope, systems or regulation.
Expect to be asked for evidence of operation since the last audit: records, metrics, decisions and examples, not just documents.
Treat the ISO 42001 surveillance audit as an annual health check on the whole system.
Internal audit results and follow-up. Management review minutes and decisions. Corrective action records with effectiveness checks. Monitoring against AI objectives.
Changes to AI systems and how they were assessed for risk and impact. New suppliers and how they were evaluated. Incident records and how they were handled.
If you have tested these areas yourself first, the audit is much smoother. Our internal audit guide shows how.
| Phase | Typical timing | Focus |
|---|---|---|
| Initial certification | Stage 1 and Stage 2 | Full system and implementation |
| Surveillance audit 1 | About 12 months later | Sampled clauses, previous findings, changes |
| Surveillance audit 2 | About 24 months | Different sampling, trends, corrective actions |
| Recertification | Before the three-year expiry | Full system over the whole cycle |
Surveillance audits are shorter than the initial certification audit. The exact audit time depends on your size, complexity and the certifier’s method, which ISO/IEC 42006 now shapes for AI audits.
Confirm in your contract how many days each surveillance audit includes and how travel and report fees are handled. Budget for all three years from the start.
Our certification cost guide explains how to compare quotes across the cycle.
Six weeks out, run an internal audit covering the areas auditors will sample. Fix findings and update records. Four weeks out, hold a management review if one is due.
Three weeks out, update the document register, check that all approved changes are recorded and confirm your AI inventory is current. Two weeks out, brief people who may be interviewed.
One week out, send the requested documents and confirm the audit plan. Preparation turns the audit into a routine check.
Prepare for each ISO 42001 surveillance audit as you would for a customer review.
Ask your certifier for the audit plan in advance, so each interviewee knows when they are needed and what evidence to bring.
Report significant changes to scope, organization, locations, key AI systems or regulatory status. Large changes can trigger extra audit time or a special audit.
A new high-impact AI product, an acquisition or a major supplier switch are good examples. Ask your certifier how it wants to be notified.
Do not wait for the audit to mention a big change. Early notice avoids surprises and keeps the relationship constructive.
Findings are classified by the certifier, often as major or minor nonconformities and observations. Major nonconformities typically need a faster response and may affect the certificate if not resolved.
Log every finding in your corrective action process, find the root cause and agree the plan with the auditor. See our ISO 42001 corrective action guide.
Respond within the timeframe set by your certifier, and keep evidence of closure ready for the next audit.
Document your response clearly, with root cause, action and owner, because the auditor will compare it with your next records.
The usual causes are unresolved major nonconformities, failure to allow a surveillance audit, misuse of the certificate or logo and significant changes not reported.
In serious cases the certifier may suspend or withdraw certification. Customers who rely on the certificate may then ask questions, so avoid it by acting early.
If you have a problem, talk to the certifier. They usually prefer a clear plan to silence.
A recertification audit reviews the performance of the system over the whole cycle. It covers all requirements and looks at trends, audit results, management reviews and complaints.
Prepare earlier than you did for surveillance. Review three years of data, update documents against any new version of the standard and confirm the scope still fits.
Schedule it so that the new certificate issues before the old one expires, to avoid a gap.
The best preparation is routine. Run the monthly corrective action review, quarterly objective reporting and annual internal audit and management review, and the surveillance audit becomes an easy exercise.
Assign an owner for the calendar so nothing slips. Add key dates to a shared plan, and include certification audit windows.
Our toolkit includes an audit calendar and review templates, so the ISO 42001 Toolkit helps keep the cycle on track.
Standards are revised from time to time, and certifiers set transition periods. Watch ISO announcements and your certifier’s notices, and plan any update early.
Regulation also changes. If a new AI law applies to your systems, add it to your context analysis and update risk and impact assessments. Our guide to ISO 42001 vs the EU AI Act explains how a management system supports compliance.
Record these updates in the management review so the auditor can see how you responded.
A steady rhythm means the ISO 42001 surveillance audit never feels like a surprise.
Quarter one: review objectives and update the risk register. Quarter two: run the internal audit. Quarter three: management review and close findings. Quarter four: prepare and host the ISO 42001 surveillance audit.
Free AI risk assessment
Which of your AI systems could harm people, or you?
List your AI systems, models and data, pick from 38 AI risk scenarios, rate them for the people affected and for you, and plan treatment with ISO 42001 Annex A controls. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free AI risk assessment → or View premium report sample
Adjust the order to match your audit date, but keep the same set of activities each year. A repeatable calendar is the easiest way to avoid last-minute stress.
Share it with all owners at the start of each year.
Update the calendar after each audit while the lessons are fresh.
Keep a folder for each audit cycle containing the internal audit report, management review pack and minutes, corrective action log, objectives report, risk and impact assessment updates and supplier assessments.
Add a change log listing new AI systems, retired systems and major changes. Auditors love a clear record of what changed and how it was controlled.
Our AI risk register guide shows how to keep the register current, which makes the risk side of the audit easy to evidence.
Finally, store records where the audit team can access them quickly. Searching shared drives during an audit costs time and credibility.
They treat the audit calendar like a financial close: fixed dates, named owners and early escalation. They also assign a deputy to the governance lead, so holidays do not stop the system.
They share results openly with management, including bad news. A system that hides problems is brittle, and auditors can tell.
Above all, they use the ISO 42001 surveillance audit to improve. Each finding becomes an input to objectives, training or process design, and the system gets stronger every year.
Usually once a year during the three-year certificate cycle. Your certification body sets the exact timing in its rules and contract.
No. It samples parts of the system and follows up earlier findings, so it is shorter than the initial audit.
Major nonconformities must be resolved within the certifier’s timeframe. Unresolved ones can lead to suspension or withdrawal of the certificate.
Yes, through a transfer process managed by the accreditation rules. Ask both certifiers how it works.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026