How to Get ISO 42001 Certification

The decision to embrace AI is already being made by employees using it daily in many organisations. What’s changing, though, is the question customers are asking: “they don’t want to know whether you’re using AI. They want to know how you’re governing it,” Muzaffar Mirza, Lead Auditor, explained during our webinar, What Does Good AI Governance Look Like?

That question is appearing in tenders and contracts too. Buyers want to know how you’re governing AI use, which could include answering questions like:

• What AI tools do you use?
• How do you stop confidential information being entered into them?
• What human oversight do you have in place?

ISO 42001 certification is one of the clearest ways to govern AI use, supporting answers to the growing number of questions around a business’ use of AI. You may have some questions of your own: what does it actually take to get certified, how long does it take, what does it cost, and how does it fit with the standards you may already hold?

This guide answers those questions from a certification body’s perspective, walking through the ISO 42001 certification process step by step.

“A lot of clients are now being asked how they control and govern AI, which makes them stop and think: how do we actually do that? That’s usually how they come across the [ISO 42001] standard – a tried and tested framework for it.” Gareth Parker, Head of Operational Compliance, Amtivo. 

ISO 42001 is the world’s first management system standard for artificial intelligence. First published in December 2023, it sets out requirements for establishing, implementing, maintaining and continually improving an AI Management System (AIMS). It’s designed to support a consistent and auditable approach to AI governance.

ISO 42001 is a certifiable standard, which means organisations can have their AIMS independently audited against it. Put simply:

• ISO 42001 is the standard containing the auditable requirements an organisation’s AIMS is expected to meet to be certified.
• An AIMS is the organisation’s management system, established, implemented and operated against the requirements of ISO 42001.
• Certification provides third-party confirmation that the organisation’s AIMS has been audited against ISO 42001.

To get ISO 42001 certified, you’ll need to first build and test your AIMS internally, then book a certification body to audit it in two stages. This is followed by annual surveillance audits to maintain certification.

Preparation

1. Understand the standard’s requirements

   As a useful starting point, get familiar with what ISO 42001 asks for, and make sure the people who will own the AIMS do too. We offer ISO 42001 awareness training courses, which can help build that knowledge across your team.

2. Define your scope

   Decide which parts of the organisation, sites and AI systems the AIMS will cover, as well as the AI role or roles your organisation performs. Depending on whether you’re building AI, integrating AI into products or services you sell, buying in and using AI tools, or supporting someone else’s AI as an integrator or data supplier, it’s a different role. Many organisations operate with more than one, which impacts the expected scope of your AIMS.

3. Review where you stand

   Identify your AI systems, their risks and impacts, and where your current AI practices may not yet meet the standard’s requirements. “A good place to start is an AI inventory – what tools you have, and what impact or damage they could cause,” Muzaffar Mirza, Lead Auditor at Amtivo, explained on our webinar. Other speakers emphasised how this should be a “blame-free” exercise.

4. Plan and get your AIMS in place

   Set up oversight, policies, controls and procedures to manage AI risks across the lifecycle, with documented processes behind them.

5. Train your staff

   Make sure everyone with a role in the AIMS understands their responsibilities and is equipped with the knowledge they need. This includes anyone using AI.

   This is important, as Parker explained, because: “With ISO 27001, a lot of it can be implemented by your IT department. With AI, it’s about making sure your whole workforce is trained and understands the implications. Everyone plays a part.”

6. Run internal audits

   As one of your final preparation steps, check that the AIMS is working as intended before the external audit does. It’s worth noting, though, that this is something you should map into your processes as “AI governance is not a one-off exercise,” says Mirza. “It’s best conducted through periodic reassessment, risk reviews, internal audits and management reviews.”

7. Complete a management review

   Senior leadership should review how the AIMS is performing and confirm its direction.

The audit

8. Stage 1 audit: An auditor checks readiness, scope and documentation. The stage 1 requirements are quite specific for ISO 42001, so the audit may be more in-depth than any audits you’ve had for standards such as ISO 9001. Typically, stage 1 assessments are described as readiness assessments, where Areas of Concern are raised to assess preparedness for full stage 2 assessments.

9. Stage 2 audit: An auditor assesses how the AIMS works in practice.

10. Certification: Upon successful completion, you gain ISO 42001 certification – with clear audit findings and improvement opportunities along the way.

11. Keep improving: Annual surveillance audits provide continued independent review to maintain certification, as part of the three-year certification cycle.

“In terms of smooth sailing, it’s the organisations that have adhered to the Annex SL structure of the standard and are driven right from the leader. There’s clear accountability, defined controls in place, and effective oversight from top management and from the people developing the AI.” Muzaffar Mirza, Lead Auditor, Amtivo 

ISO 42001’s requirements are set out in Clauses 4 to 10, following the same Harmonised Structure as ISO 27001 and ISO 9001. Clauses 1 to 3 set out the standard’s scope, normative references, and terms and definitions, rather than requirements.

At a top level, the requirements ask you to:

• Understand the context your AI operates in and define the scope of your AIMS.
• Show leadership commitment, with an AI policy and clearly assigned roles.
• Plan for AI risks, impacts and objectives.
• Put the right resources, competence and documented information in place.
• Control how AI is managed in day-to-day operations.
• Evaluate performance through monitoring, internal audit and management review.
• Continually improve.

For more information, check out our ISO 42001 standards page or contact the team.

What auditors look for

In our webinar, Mirza outlined what the strongest AI governance setups have in common, which can be used as a useful checklist for preparation.

• An AI inventory and risk register: Each AI system’s purpose, owner and review dates are clearly documented.
• Clear accountability: Every AI system has a named owner, with no ambiguity over who approves risks, monitors them or responds to incidents.
• Impact assessments: Completed before the risk assessment.
• Staff awareness: People know which tools are approved and what data can be used.
• Integrated governance: AI is built into existing information security, data protection, supplier management, incident management and business continuity arrangements, rather than run as a separate structure.
• Scheduled reviews: Periodic reassessments, internal audits and management reviews actually happen.
• Incident management: A plan for incorrect outputs, data leakage, bias, hallucinations and near misses.

For many organisations, the push comes from outside: buyers are increasingly asking how AI is governed, and ISO 42001 gives a recognised, independently audited answer.

With certification comes recognition; achieving ISO 42001 certification demonstrates your organisation’s commitment to responsible AI governance. This may support industry reputation, strengthen customer and stakeholder trust, enhance operational consistency and help meet compliance obligations. All of this is useful for many companies, but particularly relevant if you work in regulated environments, complex supply chains, or anywhere trust and accountability matter.

In summary, common reasons organisations pursue certification include:

• Strengthening oversight and accountability for AI systems.
• Managing risks such as bias, security issues or misuse.
• Showing responsible and ethical use of AI.
• Building trust with customers, partners and regulators.
• Supporting innovation while keeping appropriate and proportionate control.

ISO 42001 may also support regulatory readiness, but it doesn’t replace any legal or regulatory obligations.

If you hold ISO 27001, you may be wondering if it already covers your AI use. The short answer is no: ISO 27001 alone doesn’t demonstrate responsible AI governance if your organisation uses AI. ISO 42001 is the standard which specifically addresses the AI-specific risks – such as bias, transparency and human oversight – that ISO 27001 doesn’t cover.

The good news is that the two are built to integrate. They share the same Harmonised Structure, meaning the same common structure, terminology, and definitions. This alignment means organisations certifying to ISO 27001 and ISO 42001 can integrate processes, use combined documents, and run joint training and audits. 

This can make it easier to manage both standards, saving time and allowing the business to focus more on continual improvement and less on paperwork. 

For businesses already certified to ISO 27001, you can build on the foundation already in place when certifying to ISO 42001. Or, if you’re new to certification, the Harmonised Structure is the foundation of effective multi-standard implementation, so you can potentially implement multiple standards and reduce audit costs. 

Together, ISO 27001 and ISO 42001 give broad, auditable coverage of both information security and AI governance.

The use of ISO 27001 also tells us something about what could happen with the adoption of ISO 42001, which is relatively new. Right now, it may feel unfamiliar to businesses; ISO 42001 was only published in December 2023, so it’s much newer than standards like ISO 27001 and ISO 9001.

While this means organisations are approaching certification with a less travelled route to follow, ISO 42001 fulfils an important role. Currently, there’s no single AI law in the UK and regulation is largely overseen by existing regulators within their own sectors.

In the same way ISO 27001 gave organisations a recognised way to show how they protected information well before GDPR raised the stakes, ISO 42001 is an incredibly useful rulebook for AI governance. With clear and auditable requirements, certification to the standard demonstrates conformity with a recognised framework.

As Caroline Plumb, CEO, Amtivo said: “AI is not the risk – AI without oversight is. Good AI governance helps you move faster, with more confidence.” ISO 42001 helps to put that oversight into practice – treating AI governance not as a single technical control, but as a responsibility that starts with leadership, runs through your strategy and is understood by every member of staff.

Because ISO 42001 certification is still relatively new, when choosing a certification body look for:

• Expert, impartial auditors experienced in management system certifications.
• Dedicated support throughout the process.
• Experience across related standards such as ISO 27001, ISO 27701 and ISO 22301, if you plan to integrate them.

Whether you’re just starting to look at AI governance or you already have an ISO management system to build on, start a conversation with us. You can request a quote, explore ISO 42001 training options, or watch relevant webinars on demand.