ISO 42001 Certification: Requirements, Cost, Timeline and Step-by-Step Process

ISO/IEC 42001:2023 certifies an AI Management System (AIMS) — the governance, risk and lifecycle processes your organisation uses to develop, provide or use AI systems. It does not certify a model, an algorithm or an accuracy figure. Auditors assess whether you can demonstrate, with evidence, that AI risks and impacts are identified, treated, monitored and improved over time.

That distinction matters commercially. When an enterprise customer asks "is your AI governed?", ISO 42001 is the only accredited, internationally recognised answer available today.

ISO 42001 follows the Annex SL high-level structure, so if you hold ISO 27001 the shape will feel familiar.

• Clause 4 — Context: define the AI systems in scope, your role (developer, provider, deployer, user), interested parties and AIMS boundaries.
• Clause 5 — Leadership: AI policy, accountability for AI outcomes, defined roles for AI risk owners.
• Clause 6 — Planning: AI risk assessment, AI system impact assessment (the clause that has no ISO 27001 equivalent), objectives and treatment plans.
• Clause 7 — Support: competence for data science and review roles, documented information, awareness.
• Clause 8 — Operation: lifecycle controls — data management, design, verification and validation, deployment, monitoring, third-party and supplier AI.
• Clause 9 — Performance evaluation: monitoring, internal audit, management review.
• Clause 10 — Improvement: nonconformity handling, corrective action, continual improvement.

Annex A contains 38 controls across nine objectives. The ones that most often cause findings:

1. AI policy and governance structure — a policy that names accountable owners, not a generic statement.
2. AI system impact assessment — documented assessment of impact on individuals, groups and society, refreshed when the system changes materially.
3. Data for AI — provenance, quality, labelling, bias evaluation and retention of training and evaluation datasets.
4. Lifecycle documentation — objectives, design choices, known limitations and intended use recorded per system.
5. Verification and validation — evidence of pre-release testing, including robustness, fairness and, for generative systems, safety and prompt-injection testing.
6. Human oversight — where humans can review, override or escalate, and proof it happens.
7. Transparency to users — disclosure that AI is used, its limitations and how to contest an outcome.
8. Monitoring in production — drift, incident and complaint monitoring with defined thresholds.
9. Third-party AI — due diligence on model and API providers, and allocation of responsibilities in contracts.

1. Scope definition (1-2 weeks) — list every AI system and your role for each. Over-broad scope is the single biggest cost driver.
2. Gap assessment (2-3 weeks) — clause and Annex A gap analysis with a prioritised remediation plan.
3. Risk and impact assessment (2-4 weeks) — AI risk register plus impact assessments for in-scope systems.
4. Documentation and control build (6-10 weeks) — AI policy, lifecycle procedures, data governance, model cards, oversight and incident processes.
5. Implementation and evidence generation (4-8 weeks) — controls must run long enough to produce records auditors can sample.
6. Internal audit and management review (2 weeks) — mandatory before Stage 2; findings must be closed or in treatment.
7. Stage 1 audit — documentation and readiness review by the certification body.
8. Stage 2 audit — effectiveness audit against clauses and applicable Annex A controls.
9. Certification decision and surveillance — three-year cycle with annual surveillance audits and recertification in year three.

Evidence maturity, not document writing, sets the floor. Most Stage 2 delays come from controls that were documented but had not operated long enough to be sampled.

Certification spend splits into three buckets:

• Certification body fees — driven by audit days, which follow headcount, number of sites and number of AI systems in scope.
• Implementation effort — internal time plus consulting support for risk and impact assessments, documentation and validation evidence.
• Tooling — model registries, evaluation and monitoring tooling, GRC platform if you do not already have one.

Cost control levers that actually work: start with a narrow, defensible scope; reuse ISO 27001 processes for audit, management review, supplier management, incident response and training; and integrate AIMS records into the systems your engineers already use rather than building a parallel paper trail.

For the EU AI Act, ISO 42001 is not a conformity presumption on its own, but the AIMS, risk management, data governance, logging, human oversight and post-market monitoring requirements map closely onto Articles 9-17 obligations for high-risk systems. Organisations that certify first typically find AI Act readiness a delta, not a restart.

• Impact assessments written once and never updated after model or use-case changes.
• No record of pre-release evaluation for generative features shipped "behind a flag".
• Human oversight claimed in policy with no reviewer logs to prove it.
• Third-party model providers accepted with no due diligence or contractual allocation of AI responsibilities.
• Training data provenance unknown for models inherited from an acquisition or open-source base.

If you take one thing from this guide, let it be this: ISO 42001 certification is about proving your AI governance works, not about certifying a model. Start with the AI risk and impact assessment, since that's the part ISO 27001 doesn't cover. Keep your scope narrow, reuse what you already run for ISO 27001, and give your controls enough time to produce records before Stage 2, because documents alone won't pass. Timelines range from about 3 to 4 months for a startup that already holds ISO 27001 to 8 to 12 months for a large enterprise with several business units.

Planning ISO 42001 certification? CyberWave GRC provides gap assessment, AI risk and impact assessment, AIMS documentation and certification audit support, integrated with ISO 27001 and ISO 27701 where you already hold them.