ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The ISO 42001 Stage 1 audit is the readiness review that decides whether your AI management system is mature enough for the main certification audit. It is shorter and more document-focused than Stage 2, but it is not a formality.
Auditors use it to confirm scope, read your core documents, check that an internal audit and management review are planned or complete, and decide how Stage 2 should run. Serious gaps found here must be fixed before Stage 2 can go ahead.
This guide explains what happens, what to have ready and which findings come up most often. For the full path, see the ISO 42001 certification timeline.
Free gap assessment
How much of ISO 42001 could you evidence today?
Score every clause and Annex A control of the AI management standard, free, and see where the programme really sits.
Run the free ISO 42001 gap assessment → or View premium report sample
Certification audits for management systems follow a two-stage pattern under ISO/IEC 17021-1. Stage 1 checks preparedness. Stage 2 checks implementation and effectiveness by sampling real operation.
At Stage 1 the auditor reviews your documented information, understands your scope and sites, evaluates your readiness, collects the information needed to plan Stage 2 and checks that internal audits and management review are planned and performed.
The outcome is not a certificate. It is a report that says whether you are ready to proceed and lists any areas of concern that could become nonconformities later.
You can read the standard’s official description at ISO/IEC 42001:2023.
Stage 1 asks whether the system is designed to meet the standard. Stage 2 asks whether it works in practice. Expect Stage 1 to lean on documents, interviews and walkthroughs, while Stage 2 samples AI systems, records and people.
Stage 1 is also shorter. The exact number of audit days depends on your size and complexity and on the certifier, so treat any figure as a planning range and confirm it in the quote.
Findings at Stage 1 are usually concerns that must be fixed before the next stage. Findings at Stage 2 become nonconformities that can block the certificate.
A well-prepared ISO 42001 Stage 1 audit usually ends with a short list of observations and a confirmed Stage 2 date, which is exactly the outcome you want.
Have these ready: the scope statement, AI policy, risk assessment method and results, impact assessment procedure and results, Statement of Applicability, AI objectives and the plan to achieve them.
Free AI risk assessment
Which of your AI systems could harm people, or you?
List your AI systems, models and data, pick from 38 AI risk scenarios, rate them for the people affected and for you, and plan treatment with ISO 42001 Annex A controls. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free AI risk assessment → or View premium report sample
Add the internal audit programme and report, the management review pack and minutes, the competence and awareness records, the supplier management approach and the incident procedure. Our ISO 42001 checklist lists them in order.
An index that maps each clause to its document makes the auditor’s job faster and shows that you control your documented information.
Our toolkit includes these documents in a ready structure, so the ISO 42001 Toolkit saves weeks of drafting.
| Area | Stage 1 focus | Stage 2 focus |
|---|---|---|
| Documents | Read and confirm they meet the standard | Check they are applied |
| Records | Look for signs of operation | Sample across systems and periods |
| Internal audit and review | Confirm planned or done | Check findings were actioned |
| People | Interview leaders and owners | Interview operators and developers |
| Outcome | Readiness report | Certification decision |
Even at Stage 1, auditors want signs of life. A risk register with owners, an impact assessment done on a real system and a completed internal audit are far more convincing than templates.
If your internal audit or management review has not yet happened, you must at least show it is planned with dates. Many certifiers expect both to be complete before Stage 2.
Do not wait for the audit to run your first internal audit. It is the best rehearsal available.
Bring one worked example for each core process, such as a risk assessed end to end, so the auditor can follow the thread from policy to record.
Four weeks out, freeze your core documents and run a mock Stage 1 using the clause list. Treat it like a real audit, with an auditor who did not write the documents.
Three weeks out, close the findings and complete the management review if it is still open. Two weeks out, brief the people who will be interviewed: top management, the AI governance lead, system owners and risk owners.
One week out, send the agreed documents to the certifier and confirm logistics. A calm Stage 1 audit is the product of preparation, not luck.
Treat every ISO 42001 Stage 1 audit as the start of your relationship with the certifier.
Expect top management, the person who runs the AI management system, risk and compliance staff, and the owners of the AI systems in scope. Interviews test whether leaders understand their role under clause 5.
Prepare people to answer in their own words. Reciting policy text sounds hollow, while describing how a recent decision was made sounds credible.
Make sure everyone knows the scope, the AI policy and where to find the objectives. Basic awareness gaps are easy to avoid and easy for auditors to spot.
Typical concerns include a scope that does not match reality, risk and impact assessments that are incomplete, a Statement of Applicability without justification and objectives that cannot be measured.
Other common concerns are a missing internal audit, no management review, weak supplier controls and no evidence of competence for the people building and reviewing AI systems.
Most of these are fixable in weeks if you start early. The painful ones are the absence of any operating evidence, which you cannot invent at the last minute.
The certifier issues a report. If it finds major concerns, you fix them and the certifier may need to review them before Stage 2. Your gap analysis should already list these items.
The report also sets the Stage 2 plan: sites, systems to sample, the audit team and timing. Use it to brief your teams, and confirm the dates in writing.
Many standards expect Stage 2 to follow within a reasonable period. If too long passes, the certifier may require another Stage 1 review, so plan the gap between stages.
Stage 1 can often be performed remotely, especially for document review, though some certifiers prefer a short on-site visit to understand locations and operations. Ask which they plan.
Remote audits need good document sharing and quiet, reliable video. Set up a secure data room with read-only access, and agree what the auditor may copy.
For a deeper view of audit logistics, our ISO 42001 certification guide covers the full programme.
Score yourself yes or no on ten points: scope approved, AI policy approved, risk assessment complete, impact assessment done, Statement of Applicability signed, objectives set, internal audit complete, management review complete, competence records ready and supplier approach defined.
Anything with a no is a task. If you have four or more, delay the audit and fix them. A delayed ISO 42001 Stage 1 audit costs less than a failed one.
Keep the scorecard with your project records. It shows leadership that readiness was tested honestly.
Honest scoring before the ISO 42001 Stage 1 audit prevents most surprises.
Send the certifier your document index in advance, with version numbers and dates. It signals control and cuts the time the auditor spends hunting for files.
Keep one person responsible for answering audit questions and tracking requests. Chaos in the room reads as chaos in the system.
If you do not understand a question, ask the auditor to rephrase it. Guessing leads to wrong answers that become findings.
Finally, remember the auditor is checking conformity with the standard, not grading your AI. Stay on the requirements and bring evidence.
Place the audit after your core documents are approved and your first internal audit and management review are done, as set out in your implementation plan. Placing it earlier saves nothing and often adds a second Stage 1.
Allow a few weeks between Stage 1 and Stage 2 to fix concerns. Build that buffer into your budget and calendar so a small finding does not delay certification by months.
If you plan carefully, the ISO 42001 Stage 1 audit becomes a useful checkpoint rather than a hurdle, and it gives your team confidence before the main audit.
Also review your AI risk register the week before the audit, because auditors often start their sampling there.
Stage 1 does not award a certificate, so it is not a pass or fail test. The auditor reports whether you are ready, and serious concerns must be fixed before Stage 2.
It depends on organization size and complexity. It is usually shorter than Stage 2. Confirm audit days in your certifier quote.
You should have one completed or firmly planned. Many certifiers expect it to be complete before Stage 2, so do it early.
No. It is a confidential document between you and the certifier.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026