ISO 42001 Certification:
Stage 1, Stage 2 & Surveillance

Certification by an accredited body has two formal stages. Stage 1 is a documentation and readiness audit — the auditor reviews your AIMS scope, Statement of Applicability, AI risk and impact assessments, internal audit, and management review, and identifies gaps. Stage 2 is the certification audit, where the auditor tests whether the AIMS is implemented and effective by sampling evidence and interviewing staff. Before either stage, you complete the preparatory work: gap assessment, AIMS implementation, internal audit, and management review.

An ISO/IEC 42001 certificate is valid for three years. During that period the certification body conducts surveillance audits — typically annually — to confirm the AIMS remains effective. At the end of the three-year cycle, a recertification audit renews the certificate. This mirrors the certification lifecycle used for ISO 27001 and other ISO management-system standards under ISO/IEC 17021-1.

For an organization with basic AI governance already in place, 8–12 weeks of preparation is typical before the certification audit: AI system inventory (about two weeks), risk and impact assessment (two to three weeks), controls implementation (about four weeks), and internal audit (one to two weeks). The timeline lengthens with the number and risk level of AI systems and shortens when you already run an ISO 27001 ISMS you can extend.

Three areas consistently draw the most scrutiny: the completeness of the AI system inventory (including foundation models and shadow AI); the AI impact assessment under Annex A.5 (real affected parties, harms, and mitigations — not a box-ticking document); and demonstrable human oversight (a defined trigger, an able human, and a log proving intervention is possible and recorded). Data governance (A.7) and a risk-traceable Statement of Applicability follow close behind.

At Tranquility, consulting engagements are scoped to the number and risk level of AI systems and your existing maturity. The engagement covers gap analysis, AIMS documentation, AI risk and impact assessments, and internal audit — request a scoped quote via our contact page. Accredited certification-body fees for Stage 1, Stage 2, and surveillance audits are billed separately by the registrar and depend on organization size and audit duration.

For a certificate that carries weight with customers and regulators, yes — use a certification body accredited for ISO/IEC 42001 by a national accreditation body (ANAB, UKAS, RvA, NABCB, and peers) under ISO/IEC 17021-1 and the AIMS-specific requirements of ISO/IEC 42006:2025. Accreditation for 42001 is recent — the first accreditations landed through 2025–2026 — so some certificates in the market were issued before any accreditation existed. You can verify any certificate and its issuing body on the IAF CertSearch database. A consultant helps you build and prepare the AIMS but must remain independent of the body that audits it; the same firm cannot both consult and certify. Tranquility coordinates with accredited bodies on your behalf and prepares you for their audit.

ISO/IEC 42006:2025, published in July 2025, sets the requirements a certification body must meet to audit and certify AI management systems — auditor competence in AI, audit-time calculation, and AIMS-specific audit methods — on top of the general ISO/IEC 17021-1 rules. It exists because AI auditing requires competences classic ISMS auditors may not have. Practically: a 42001 certificate from a body accredited against ISO/IEC 42006 is the defensible kind; an unaccredited certificate may not survive scrutiny in enterprise procurement or regulatory contexts. When selecting a certification body, ask which accreditation body granted its ISO 42001 scope and when.