What ISO/IEC 42001 certification really involves

ISO/IEC 42001 is the international standard for an AI management system (AIMS). It does not tell you which AI to build or buy. It tells you how to govern the AI you have: who is responsible, how risks and impacts are assessed, and what evidence shows the system works.

Certification means an independent certification body has audited your AIMS and confirmed that it meets the standard. For most organisations the real value is not the certificate itself. It is being able to answer hard questions from customers, boards and regulators with evidence instead of promises.

The four phases

Think of the work as four phases: define, build, prove and sustain.

1. Define

Most delays in certification come from weak foundations. Before you write a single policy, get these things right:

• An AI inventory. List every AI system you build, buy or embed, with its purpose, owner, data and status.
• Your scope. Decide which business units, locations, products and AI systems the management system covers, and justify anything you exclude.
• Your role. Are you a provider, a customer, a partner? The answer shapes your obligations.
• A gap assessment against the standard's clauses and controls.
• Leadership commitment. Top management must own the AIMS, not just approve it.

2. Build

With the foundation in place you write and put in place the management system itself:

• An AI policy and measurable AI objectives.
• A risk method, a risk assessment and an AI impact assessment.
• A Statement of Applicability that records which Annex A controls apply, and why any are excluded.
• Roles, competence and training, and documented procedures for the controls you include.

3. Prove

A management system that exists only on paper will not pass. You need to run it for long enough to produce evidence, then test it yourself with an internal audit and a management review before the certification body arrives.

The external audit comes in two stages. Stage 1 reviews your documentation and readiness. Stage 2 checks that the system is really operating and effective. Any nonconformities found must be corrected, and the correction verified, before a certificate is issued.

4. Sustain

A certificate is the start of an ongoing cycle, not the end of a project. Certification bodies typically carry out surveillance audits between full audits, so evidence, reviews and risk assessments have to stay current as your AI changes.

Where organisations lose time

• Starting with documents instead of scope. Policies written before the boundary is clear get rewritten.
• An incomplete inventory. Teams use AI tools that nobody declared. Discovering them late reopens risk assessments.
• Evidence collected at the last minute. Auditors look for records over time, not a folder assembled the week before.
• No clear owners. Every control needs a named person.

Where to start

If you are unsure where you stand, the quickest first step is a readiness check against the standard. LeadAI's free check takes about 25 minutes and shows a section-by-section picture of where you are strong and where the gaps are. For the full detail, read our ISO 42001 certification guide.

This article gives general information and is not a substitute for the text of ISO/IEC 42001:2023 or for professional advice.