ISO 42001 Certification Process: Stage 1, Stage 2 & Surveillance

Certification Process Overview

ISO 42001 certification follows the standard ISO management system certification process, adapted for AI Management Systems. The journey involves selecting an accredited certification body, undergoing a two-stage initial audit, and maintaining certification through ongoing surveillance.

The certification cycle spans three years, with annual surveillance audits ensuring continued conformity. Understanding each stage helps organizations prepare effectively and avoid delays.

Choosing a Certification Body

Selecting the right certification body (CB) is a critical first step. Not all CBs are accredited to certify against ISO 42001, and auditor expertise varies significantly.

Accreditation Requirements

Verify the CB holds accreditation from a recognized body (e.g., IAS, UKAS, ANAB, JAS-ANZ, DAkkS) with ISO 42001 specifically listed in their scope. Accreditation ensures:

• Auditors are competent and qualified
• Audit processes meet international standards
• Certificates are internationally recognized
• Independent oversight of CB operations

Selection Criteria

• AI Expertise: Does the CB have auditors with AI/ML background?
• Industry Experience: Have they audited organizations in your sector?
• Geographic Coverage: Can they audit all locations in your scope?
• Timeline Flexibility: Can they meet your certification timeline?
• Pricing Transparency: Are audit day rates and expenses clear?

Request proposals from at least three certification bodies. Compare not just price, but auditor qualifications, sector experience, and client references. The cheapest option rarely delivers the best audit experience.

Stage 1 Audit: Documentation Review

The Stage 1 audit assesses your organization's readiness for the full certification audit. It focuses on documentation review and preliminary evaluation of AIMS implementation.

Stage 1 Objectives

• Review AIMS documentation against ISO 42001 requirements
• Evaluate scope definition and boundaries
• Assess organization's understanding of standard requirements
• Identify any areas of concern before Stage 2
• Plan Stage 2 audit activities and resource allocation

What Auditors Review

• Scope Statement: Clear definition of AI systems, roles, and boundaries
• AI Policy: Top management commitment to responsible AI
• Risk Assessment: AI risk methodology and initial assessments
• Statement of Applicability: Annex A controls with justifications
• Objectives: Measurable AI objectives aligned with policy
• Internal Audit: Evidence of internal audit completion
• Management Review: Records of management review meetings

Stage 1 Duration

Typically 1-2 days depending on organization size and scope complexity. May be conducted on-site or remotely.

Stage 1 Outcomes

The auditor provides a report indicating:

• Proceed to Stage 2: Organization is ready for implementation audit
• Proceed with Concerns: Minor issues to address before/during Stage 2
• Delay Stage 2: Significant gaps requiring remediation first

Stage 2 Audit: Implementation Verification

Stage 2 is the main certification audit, verifying that your AIMS is not just documented but effectively implemented and operating.

Stage 2 Objectives

• Confirm AIMS conforms to all ISO 42001 requirements
• Verify controls are implemented and effective
• Assess AI risk assessments and treatments
• Evaluate AI impact assessments
• Verify operational effectiveness through evidence sampling
• Confirm continual improvement is occurring

Audit Methods

• Interviews: Discussions with management, AI teams, and operators
• Document Review: Examination of records and evidence
• Observation: Watching processes in action
• Technical Review: Assessment of AI systems and controls

Stage 2 Duration

Typically 2-5 days on-site, calculated based on:

• Number of employees in scope
• Number of AI systems in scope
• Complexity of AI operations
• Number of locations

Sampling Approach

Auditors cannot review everything, so they use risk-based sampling:

• High-risk AI systems receive more attention
• Recent changes and new deployments are prioritized
• Areas with Stage 1 concerns are thoroughly examined
• Random sampling verifies consistent implementation

Managing Audit Findings

Types of Findings

• Major Nonconformity: Absence or complete failure of required element. Must be resolved before certification.
• Minor Nonconformity: Single lapse that doesn't indicate systemic failure. Certificate can be issued with corrective action plan.
• Observation: Opportunity for improvement, not a conformity issue. No action required.

Corrective Action Process

1. Root Cause Analysis: Identify why the nonconformity occurred
2. Correction: Immediate action to address the specific issue
3. Corrective Action: Systematic fix to prevent recurrence
4. Evidence: Document actions taken and results
5. Verification: CB verifies closure (may require follow-up audit)

Major Nonconformity Resolution

For major findings, you must demonstrate effective corrective action before certification. Options include:

• Additional on-site audit days (within 90 days)
• Remote evidence review
• Document submission with verification

Surveillance Audits

After initial certification, surveillance audits occur annually to verify continued conformity. They are smaller than the initial audit but cover critical AIMS elements.

Surveillance Audit Scope

Each surveillance must cover:

• Internal audits and management review
• Actions taken on previous nonconformities
• Complaints and their handling
• AIMS effectiveness and achievement of objectives
• Progress on continual improvement
• Selected operational controls and AI systems
• Use of marks and references to certification

Surveillance Duration

Typically 30-50% of initial audit duration, conducted annually within 12 months of previous audit.

Maintaining Certification

Certification can be suspended or withdrawn if:

• Surveillance audits are not completed on schedule
• Major nonconformities are not resolved
• Significant AIMS failures are identified
• Certification fees are not paid

3-Year Recertification

Before the 3-year certificate expires, a recertification audit confirms continued suitability of the complete AIMS.

Recertification Scope

Similar to initial Stage 2 but considers:

• AIMS performance over the certification cycle
• Changes to AI systems, scope, or organization
• Effectiveness of the AIMS as a whole
• Commitment to continual improvement

Timing

Recertification must be completed before certificate expiry. Plan for the audit 2-3 months before expiration to allow time for any corrective actions.

Complete Certification Timeline