ISO 42001 Recertification Audit: The Complete 2026 Guide

An ISO 42001 recertification audit is the full-system audit your certification body runs in year three to renew your AI management system certificate before it expires. ISO/IEC 42001 was published in December 2023, so the first certificates issued in 2024 reach their three-year expiry dates during 2027. For many organizations, this is the first renewal they have ever planned, and the rules are stricter than most teams expect.

This guide explains what the ISO 42001 recertification audit checks, how it differs from the two surveillance audits before it, the deadlines that decide whether your certificate lapses, and what changed for certification bodies when ISO/IEC 42006:2025 replaced the draft criteria they were accredited against.

What an ISO 42001 recertification audit is

Every accredited ISO 42001 certificate runs on the three-year cycle defined in ISO/IEC 17021-1, the general standard for management system certification bodies: an initial two-stage audit, surveillance audits in years one and two, and a recertification audit in year three. A successful recertification decision starts a new three-year cycle.

ISO/IEC 17021-1 clause 9.6.3.1.1 says the recertification audit confirms “the continued conformity and effectiveness” of the management system as a whole, and that it must be planned and run in time for the certificate to be renewed before its expiry date. ISO/IEC 42006:2025 adds the AI-specific requirements for certification bodies on top of 17021-1. It does not replace it.

If you have not been through the earlier stages yet, start with our step-by-step guide to ISO 42001 certification. This post assumes you hold a certificate and want to keep it.

ISO 42001 recertification audit vs surveillance audit

A surveillance audit samples parts of your system. Our ISO 42001 surveillance audit guide covers what gets sampled each year. The ISO 42001 recertification audit is different in scope, purpose and consequence.

Aspect	Surveillance audit (years 1 and 2)	ISO 42001 recertification audit (year 3)
Coverage	Sampled clauses and controls, not necessarily the full system	The full AIMS against the whole certified scope
Time window	The past 12 months	Performance over the whole three-year cycle
Inputs reviewed	Previous findings, changes, internal audit, management review	All previous surveillance reports (17021-1 clause 9.6.3.1.2), plus everything a surveillance audit covers
Stage 1	Not applicable	Only if there are significant changes to the system or to legislation (clause 9.6.3.1.3)
Major nonconformity deadline	Set by the certification body’s own procedure	Corrected and verified before the certificate expires (clause 9.6.3.2.2)
Outcome	Certificate maintained, or suspension in serious cases	A new three-year certificate, or no renewal

The practical point: a surveillance audit asks whether the system is still working. The recertification audit asks whether it has worked for three years and is set up to keep working.

What the auditor must assess

ISO/IEC 17021-1 clause 9.6.3.2.1 sets three questions every ISO 42001 recertification audit has to answer:

• Effectiveness across the scope. Is the AIMS effective for the whole scope of certification, taking account of internal and external changes, and is the scope still relevant?
• Commitment. Has top management shown commitment to maintaining and improving the system?
• Results. Is the system achieving your objectives and the intended results of the AI management system?

For an AI management system, those questions translate into specific evidence. Expect the auditor to trace a current AI system from your inventory through its risk assessment (clause 6.1.2), its AI system impact assessment (clause 6.1.4 and 8.4), the controls in your Statement of Applicability and the monitoring records that show the controls operate. Expect them to compare three years of AI objectives and see whether targets moved, and why.

Management review carries more weight in an ISO 42001 recertification audit than at surveillance. Three sets of minutes should show decisions, not just attendance. Our ISO 42001 management review guide lists the inputs clause 9.3 requires.

ISO/IEC 42006:2025: what changed for your certifier

When the first ISO 42001 certificates were issued, ISO/IEC 42006 did not exist as a published standard. Accreditation bodies used the draft (DIS) or final draft (FDIS) as temporary criteria. ISO/IEC 42006:2025 was published in July 2025 as a 31-page first edition, according to ISO’s page for ISO/IEC 42006:2025.

The Standards Council of Canada’s bulletin 2025-21 of 28 August 2025 lists the changes between the DIS and the published standard: liability (5.3.2), audit time calculation (9.1.4.2 and Annex A), more prescriptive competence requirements for personnel (7.1 and 7.2), AIMS certification documents (8.2.2) and access to the organization’s documentation (8.4.2). The bulletin says the FDIS and the published version differ only editorially.

What this means for your ISO 42001 recertification audit:

• Audit time may change. If your initial audit was sized under draft criteria, the recertification quote may be sized under the published Annex A method. Ask the certification body to show the calculation rather than accepting a number.
• The audit team may change. Tighter competence rules can mean a different lead auditor or an added technical expert.
• Document access will be asked about. Plan how you will give auditors access to sensitive AI documentation, such as model cards, training data descriptions or impact assessments, before the audit plan arrives.

One thing you do not need to plan for: a standard transition. ISO’s page for ISO/IEC 42001:2023 shows Edition 1 still at stage 60.60 with no replacement listed. Unlike ISO 9001 and ISO 14001, both revised in 2026, there is no new edition of ISO 42001 to transition to during your recertification.

The deadlines that decide whether your certificate lapses

Most failed ISO 42001 recertification audit outcomes are timing failures, not system failures. The rules in ISO/IEC 17021-1 are short and unforgiving:

Situation	What happens (ISO/IEC 17021-1)
Audit done and all majors closed before expiry	New certificate; its expiry can be based on the old expiry date, so you keep your anniversary (9.6.3.2.3)
Audit done, but a major nonconformity still open at expiry	Recertification is not recommended and the certificate is not extended (9.6.3.2.2 and 9.6.3.2.4)
Certificate expired, activities finished within 6 months	The certification body can restore certification; the new effective date is on or after the decision and the expiry is based on the prior cycle (9.6.3.2.5)
Certificate expired more than 6 months ago	At least a stage 2 audit is needed (9.6.3.2.5)

Note the gap in the restore route: between expiry and restoration you hold no valid certificate. If a customer contract or a tender requires a current ISO 42001 certificate, that gap is the commercial risk, even if the audit itself goes well.

Work back from the expiry date printed on your certificate. A typical plan looks like this:

Months before expiry	Action
6	Confirm the audit dates and audit days with your certification body; decide whether to stay or switch certifier
5	Review scope, AI system inventory and legal context; tell the certifier about significant changes
4	Run a full internal audit of every clause and every applicable Annex A control
3	Hold a management review that looks at the whole cycle, not just the last year
2 to 3	Recertification audit on site
1 to 2	Close any nonconformities and submit evidence; allow time for the certification decision

Two to three months between the audit and expiry is the margin that lets you close a major nonconformity without losing the certificate. Shrink it and you are betting the audit finds nothing serious.

When the ISO 42001 recertification audit needs a stage 1

Clause 9.6.3.1.3 of ISO/IEC 17021-1 says the recertification may need a stage 1 when there have been significant changes to the management system, the organization or the context in which it operates, such as changes to legislation. AI teams hit both triggers more often than most.

On the system side, think about acquisitions, a new product line built on a general-purpose AI model, a move from AI user to AI developer, or new countries in scope. On the legal side, the EU AI Act has changed during most current certification cycles. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the Annex III high-risk obligations to 2 December 2027 and the Annex I product-embedded high-risk obligations to 2 August 2028. The Article 50 transparency obligations applied from 2 August 2026, and the new prohibitions added by the Omnibus apply from 2 December 2026.

Your clause 4.1 context, your risk criteria and your impact assessments should show how you responded to those changes. If they still describe the legal position at your initial audit, expect a finding. Our guide to ISO 42001 and the EU AI Act explains how the two fit together. Tell your certification body about significant changes early: an unplanned stage 1 adds audit days, and finding out at the audit adds weeks.

Preparing for your ISO 42001 recertification audit

Preparation for an ISO 42001 recertification audit is a cycle review, not a document refresh. Work through these items in the four months before the audit:

1. Read every audit report from the cycle. List each finding and observation from stage 2 and both surveillance audits, with the closure evidence. Auditors check that closed findings stayed closed.
2. Reconcile the AI system inventory. Systems added, retired or materially changed since the initial audit each need a risk assessment and, where relevant, an impact assessment.
3. Re-test the Statement of Applicability. Check that exclusions are still justified and that every included Annex A control has current evidence.
4. Trend your objectives. Put three years of AI objective results side by side and explain any target that was missed, dropped or changed.
5. Run a full internal audit. Cover all of clauses 4 to 10, not the rotating sample you used for surveillance. Our ISO 42001 internal audit guide sets out a programme.
6. Check supplier evidence. AI suppliers, model providers and data providers should have current assessments, not ones from the first year.
7. Brief interviewees. People who joined since the initial audit will be interviewed with no memory of it. Make sure they know where the records live.

The ISO 42001 Toolkit from Governance Docs includes the policy set, risk and impact assessment templates, an internal audit programme and management review records. If your first-cycle documents were written in a hurry, the toolkit gives you a clean base to rebuild them before the auditor sees them. See what is inside the ISO 42001 Toolkit.

Switching certification body at recertification

Recertification is the natural point to change certifier, because you are paying for a full-system audit either way. Before you switch, check that the new body is accredited for ISO 42001 by an accreditation body that is a signatory to the international recognition arrangements, and ask how its audit time compares under the ISO/IEC 42006 Annex A method. Expect the new body to review your current certificate and the previous audit reports, including any open findings, before it accepts the transfer.

Our guide to choosing an ISO 42001 certification body covers how to verify accreditation and compare quotes.

Common reasons an ISO 42001 recertification audit goes badly

• Late scheduling. The ISO 42001 recertification audit lands in the final month, a major nonconformity is raised and there is no time to close it before expiry.
• A frozen inventory. The AI system list still matches the initial audit while the product has moved on.
• Stale legal context. Risk criteria still reflect the EU AI Act timetable from 2024.
• Repeated findings. The same nonconformity appears in two surveillance reports. Auditors treat repetition as evidence that corrective action does not work.
• Management review as a formality. Minutes that do not record decisions or resources fail the commitment question in clause 9.6.3.2.1 b).

None of these need a new system. They need a calendar and an owner. For the same process on an information security certificate, see our ISO 27001 recertification audit guide.

ISO 42001 recertification audit FAQ

How long is an ISO 42001 certificate valid?

Accredited ISO 42001 certificates follow the three-year certification cycle in ISO/IEC 17021-1. You keep the certificate valid by passing surveillance audits in years one and two, then an ISO 42001 recertification audit before the expiry date in year three.

Is the recertification audit as long as the initial audit?

Usually it is shorter than stage 1 and stage 2 combined but longer than a surveillance audit. The exact audit days come from the method in ISO/IEC 42006:2025 clause 9.1.4.2 and Annex A, applied by your certification body. Ask for the calculation in the quote.

What happens if our certificate expires before recertification is finished?

Under ISO/IEC 17021-1 clause 9.6.3.2.5, the certification body can restore certification within six months of expiry if the outstanding activities are completed. After six months, at least a stage 2 audit is required. You have no valid certificate during the gap.

Can the ISO 42001 recertification audit be done remotely?

ISO/IEC 17021-1 calls for an on-site audit at recertification. Certification bodies can use remote techniques under the accreditation rules for information and communication technology in audits, but how much they use depends on their own procedures and your risk. Agree this in the audit plan.

Do we need to transition to a new version of ISO 42001 at recertification?

No. As of November 2026, ISO lists ISO/IEC 42001:2023 as the current first edition with no replacement in progress. Your certification body will audit against the 2023 edition, using ISO/IEC 42006:2025 as its own requirements.