ISO 42001
ISO42k
On this page
Step by step

Implementation guide

A practical roadmap to ISO 42001 certification

Reviewed by the ISO42k editorial team — compliance and AI governance professionals

Timeline overview[1]

6–12 months
Starting from scratch
4–6 months
With existing ISO 27001
3–4 months
Small organizations

Seven phases to certification

Getting ISO 42001 certified is a structured process. Each phase builds on the previous one.[1]

Phase 12–4 weeks

Leadership buy-in & scoping

  • Get stakeholder buy-in across legal, IT, product, and executive teams
  • Define which business units, products, or AI systems the AIMS will cover
  • Certification doesn't have to cover the entire organization — start focused
  • Allocate budget, assign a project lead, and form a governance committee
Phase 22–4 weeks

Gap analysis

  • Compare current AI practices against all ISO 42001 requirements
  • Identify what exists, what's partially in place, and what's missing
  • Map existing ISO 27001 or ISO 9001 controls that carry over
  • Create a prioritized remediation roadmap with clear ownership
Phase 34–8 weeks

Build the AIMS foundation

  • Draft your AI policy — the high-level commitment to responsible AI
  • Establish roles (e.g. AI Ethics Officer, Model Validator, Data Steward, AIMS Manager)
  • Document the context of your organization and interested parties (Clause 4)
  • Secure top management commitment with formal sign-off (Clause 5)
Phase 44–6 weeks

Risk assessment & controls

  • Conduct AI-specific risk assessments across all in-scope systems
  • Evaluate risks: bias, fairness, transparency, safety, data quality, security
  • Select applicable controls from Annex A's AI-specific controls
  • Create the Statement of Applicability (SoA) documenting which controls apply
  • Develop a risk treatment plan with mitigation strategies and timelines
Phase 58–16 weeks

Implement & document

  • Implement selected Annex A controls (data management, model validation, human oversight)
  • Create required documentation: impact assessments, data procedures, incident response
  • Establish monitoring processes for AI system performance and model drift
  • Train all relevant staff on AIMS policies and their responsibilities
  • Integrate with existing management systems (ISO 27001, ISO 9001) where applicable
Phase 62–4 weeks

Internal audit & management review

  • Conduct a full internal audit against ISO 42001 requirements
  • Document nonconformities and create corrective action plans
  • Hold a management review meeting to evaluate AIMS effectiveness (Clause 9)
  • Address all findings before proceeding to the external certification audit
Phase 72–4 weeks

Certification audit

  • Stage 1 (Document Review): 1–2 days — auditor verifies your AIMS documentation
  • Address any Stage 1 findings before Stage 2
  • Stage 2 (Implementation Review): typically 3–9+ days depending on scope — auditor verifies AIMS is working in practice
  • Certificate issued (valid for 3 years with annual surveillance audits)

What does it cost?

Costs vary by organization size, scope, and complexity. Here are typical ranges:[1][2][3]

ItemTypical range
Standard document (ISO)~$250
Consulting services$10,000–$80,000
Training (per person)$2,000–$5,000
Certification audit fees$15,000–$50,000
Internal labor (50-person co.)300–600 hours
Annual surveillance audits25–40% of initial fees

Total direct costs for a mid-size organization typically range from $40,000–$100,000.

Required documentation

ISO 42001 requires specific documented information. Your AIMS must include:[1]

●AIMS scope statement
●AI policy
●AI objectives
●AI risk assessment methodology
●AI risk treatment plan
●Statement of Applicability (SoA)
●AI impact assessment process
●Internal audit program
●Corrective action records
●Documented operational control procedures

Tips for a smoother implementation

  • ✓Start with a clear scope — you don't need to cover every AI system on day one
  • ✓Leverage existing ISO certifications — ISO 27001's shared Harmonized Structure can significantly reduce effort
  • ✓Involve AI practitioners early — engineers and data scientists understand the real risks
  • ✓Choose a registrar experienced with AI standards — not all certification bodies have this expertise yet
  • ✓Treat it as a business improvement program, not a compliance exercise
  • ✓You can implement without a consultant, but experienced help accelerates timelines significantly

Who performs the audit?

ISO itself does not certify organizations. Certification is performed by independent, accredited certification bodies (registrars) such as Schellman, BSI, A-LIGN, Bureau Veritas, SGS, and others.[2][3]

15 accredited certification bodies

Compare registrars by specialties, accreditation, and notable clients.

View certifiers

How ready are you?

Take our free Readiness Check to assess your organization across all 40 ISO 42001 requirements.

Readiness Check

After certification: the 3-year cycle[1]

  • Year 0: Initial certification audit
  • Year 1: Surveillance audit (shorter, focused)
  • Year 2: Surveillance audit
  • Year 3: Full recertification audit (cycle repeats)

Surveillance audits verify you're maintaining your AIMS, tracking improvements, and adapting to new AI risks.

← BenefitsCommon questions →
Last reviewed: May 10, 2026