ISO/IEC 42001:2023 sets requirements for an AI management system: the policies, roles, processes and controls an organisation uses to develop, provide or use AI systems responsibly.
A certification audit checks two things. First, that your system meets the standard. Second, that it works in practice for the AI systems in your scope. Certification bodies audit against ISO/IEC 17021-1 and the AI-specific requirements of ISO/IEC 42006.
What does stage 1 check?
Stage 1 confirms that your system is ready for a full audit. Auditors review:
- Your scope, including your role in the AI life cycle (for example developer, provider or user) and the AI systems covered.
- Your AI policy and AI objectives.
- How you identify and assess AI risks, and how you assess the impact of AI systems on individuals, groups and society.
- Your Statement of Applicability, showing which Annex A controls apply and why any are excluded.
- Evidence that internal audit and management review have taken place.
Stage 1 ends with a report of any areas that could become nonconformities at stage 2, so you can address them first.
What does stage 2 check?
Stage 2 tests whether the system is implemented and effective. Auditors interview people, observe work and sample records across the AI systems in scope. The main areas are:
Risk and impact
Risk assessments and AI system impact assessments carried out as planned, treatment decisions recorded, and both reviewed when a system or its use changes.
The AI system life cycle
For AI systems you develop or provide: requirements, design, verification and validation, deployment, operation and monitoring, with records showing each stage was controlled.
Data for AI systems
How data used in AI systems is acquired, how its quality and provenance are assessed, and how its use is controlled.
Use of AI and human oversight
How AI systems are used as intended, who oversees them, and how people can intervene when needed.
Third parties
How you manage suppliers of AI systems, models or data, and what you agree with customers about AI you provide to them.
Information for interested parties
What you tell users and others affected by your AI systems, and how they can report concerns.
Monitoring and improvement
Performance monitoring, incident handling, internal audit, management review and corrective action.
What does the audit not do?
It does not certify an AI model, product or output, and it does not test your algorithms for accuracy. Certification is a statement about your management system within its certified scope. It also does not confirm compliance with any law; that responsibility stays with you.
Which gaps most often delay certification?
- No complete inventory of the AI systems in scope, including AI built into third-party software.
- Impact assessments that were planned but not carried out, or not repeated after a change.
- A Statement of Applicability that excludes controls without a justification.
- AI suppliers managed through general procurement, with no AI-specific requirements.
- Human oversight described in policy but not visible in practice.
Discuss your proposed scope
Tell us which AI systems you develop, provide or use, and whether you already hold ISO/IEC 27001. We will propose a scope, the audit time and one fixed three-year price.
Related information:
- ISO/IEC 42001 certification
- ISO 42001 for businesses using AI tools
- ISO 42001 vs ISO 27001: do you need both?
- Start an enquiry