ISO 42001 certification: how the audit runs and where it goes wrong

ISO 42001 is certifiable: a certification body audits your AI management system (AIMS) and issues a certificate when the outcome is positive. What the body tests is not whether every AI model works well, but whether your organization demonstrably governs AI: scope, risk assessment, impact assessment, controls, internal audit and management review. This article describes how that audit runs and where organizations get stuck in practice.

What gets certified

The object of the audit is the management system, within a scope you define yourself. The scope states which AI systems and AI activities fall under it and what role you play: provider, supplier of components or user. Whatever is outside the scope is not on the certificate. The certificate therefore says nothing about the quality of an individual model. It says that the system you use to govern AI conforms to ISO/IEC 42001:2023, the only edition of the standard. The requirements for bodies that certify AI management systems are in ISO/IEC 42006, published in 2025.

Certifying and advising are separate roles. A certification body that advised you on setting up the AIMS may not also issue the certificate. A gap analysis or internal audit by an adviser is common, as long as that party is not the certification body.

How the certification audit runs

The audit usually runs in two stages. Stage 1 assesses the design: is the scope clear, does the documented information the standard requires exist, is the Statement of Applicability in place, and are the internal audit and management review planned? Stage 2 tests operation. The auditor looks at day-to-day execution, requests records, takes samples and speaks to people who build, buy or use AI systems. Certification bodies generally expect the first internal audit (clause 9.2) and the first management review (clause 9.3) to have been carried out before stage 2 begins.

Findings are classified as nonconformities or observations. A major nonconformity stands in the way of a certificate until the corrective action has been reviewed. The certificate is usually valid for three years, with surveillance audits in between and a recertification afterwards. The exact arrangement is set by your certification body, so ask for it up front.

Where it goes wrong in practice

These are the points an auditor looks at first, because they cannot be filled without real work.

The AI inventory is incomplete

An AIMS starts with the question of which AI falls under the scope. Organizations list their own models and the license for a chat assistant, but forget the AI inside existing software: lead scoring in a sales platform, CV screening in HR software, features a supplier added later. If an auditor finds an application in a sample that is not in the register, you have a problem with the scope and with the risk assessment that rests on it. So ask marketing, finance and HR as well, not just IT. How to approach that is covered in the article on shadow AI inventory. Purchased AI belongs in it too: Annex A.10 deals with relationships with suppliers and customers.

Risk and impact stay too generic

Clause 6.1.2 requires a risk assessment for AI and clause 6.1.4 an assessment of the impact of the AI system on individuals and groups. A scale of high, medium and low without criteria quickly turns everything into medium, and no decision can be based on that. Describe a scenario per system: what happens if the model makes a wrong decision, who is affected and which control goes with it. For the impact assessment itself, ISO 42005 is the guidance. That standard cannot be certified, but the auditor expects the assessment to have a method.

Policy nobody follows

A strict AI policy that practice cannot meet leads to employees using personal accounts or uploading data to external services. That is a problem with the policy, not with the employees. In stage 2 the auditor speaks to people in the line organization. If they do not know the policy or work around it, a well-written document does not help. Involve the business in drafting it, so that it is workable within the risk tolerance management has set.

Ownership sits with the wrong department

Clause 5.3 requires assigned roles and responsibilities. A common choice is to place all AI risk with security. Then every new AI initiative becomes a blocking advice, and the line manager cannot answer an auditor's question for their own system. A workable split is that security and compliance advise, while the system owner, the line manager, manages the risks in their domain and can be held to account for them.

The Statement of Applicability justifies nothing

Annex A contains 38 controls. The standard requires a Statement of Applicability stating for each control whether it applies, and a justification for what you exclude. A SoA where nearly everything says "applicable" with no implementation status, or where exclusions have no reason, stands out in stage 1. See the Statement of Applicability for ISO 42001.

Internal audit and management review are paper exercises

The internal audit must be independent of the area being audited, and the management review must contain the inputs listed in clause 9.3. A review that only confirms everything is fine produces no decisions and no improvement actions. How to set this up is covered in the internal audit of an AIMS.

What a certificate does not prove

An ISO 42001 certificate is not proof of compliance with the EU AI Act. The standard is not a harmonised standard and gives no presumption of conformity with the regulation. What the certificate does and does not cover is described in ISO 42001 and the EU AI Act. For a customer or procurement team, the certificate is an externally tested answer to the question about AI governance. It does not automatically deliver more than that.

After the certificate

The certificate is not an endpoint. Models are updated, suppliers change their services and new applications appear. Each of these should enter the AIMS through change management and risk assessment. At the surveillance audits the auditor checks whether that happened. If no internal audit and management review are planned in between, the documentation goes stale and it shows at the next audit.

To get started, follow the implementation roadmap. For a gap analysis or internal audit beforehand, see our compliance services.