ISO 42001 certification is a project, not a weekend policy refresh. Timelines depend on AI maturity, scope size, and whether you already run ISO 27001 or SOC 2.
Related: Checklist · Cost guide
Key takeaways
- Typical range: 4–12+ months from kickoff to initial certificate (varies widely).
- Stage 1 reviews AIMS design; Stage 2 tests operation.
- Reuse security program evidence to compress early phases.
- Plan surveillance audits after certification.
Sample timelines
| Maturity | Rough duration |
|---|---|
| Strong ISO 27001 + documented AI | 4–7 months |
| SOC 2 + informal AI practices | 6–9 months |
| Early AI governance | 9–15 months |
Before you start: a readiness check
Answer these questions to see where you stand. Each "no" adds time to your plan.
- Do you have a complete list of the AI systems you build, provide and use?
- Is there a written AI policy approved by leadership?
- Is someone named as accountable for AI governance?
- Do you assess risks and impacts before releasing or adopting an AI system?
- Can you show test and validation results for your models?
- Do you monitor AI systems in production for errors, drift or misuse?
- Do you review AI suppliers before using them?
- Do you already run ISO 27001 or another management system with internal audits?
Teams that can answer yes to most of these often reach certification in four to seven months. Teams answering no to most should plan for nine months or more.
Who needs to be involved
| Role | Contribution |
|---|---|
| Executive sponsor | Approves the AI policy, scope, resources and risk acceptance |
| AI governance lead | Runs the project, the SoA, internal audit and the certification body relationship |
| Engineering and data science | Life cycle controls, testing, monitoring and data quality evidence |
| Product | Intended use, user information and transparency |
| Legal and privacy | Impact assessments, regulatory obligations such as the EU AI Act, contracts |
| Security | Overlap with ISO 27001, supplier security, incident handling |
A small company may combine several of these roles, but each responsibility should still have a named person.
What happens in each step
1. Scope the AI management system (2 to 4 weeks). Decide which AI systems, products, teams and locations are covered. List every AI system you develop, provide or use within that scope.
2. Gap assessment (3 to 6 weeks). Compare your current practices with clauses 4 to 10 of ISO 42001 and the 38 Annex A controls. Record each gap with an owner.
3. Implement (2 to 6 months). Write the AI policy, define roles, set up the AI risk assessment and AI system impact assessment processes, prepare the Statement of Applicability and put the selected controls in place across the AI life cycle.
4. Operate and collect evidence (2 to 3 months). Run the system for long enough to produce records: completed impact assessments, monitoring results, supplier reviews, training and incident handling.
5. Internal audit and management review (2 to 4 weeks). An independent internal auditor checks the system against the standard, and leadership reviews performance, risks and improvements.
6. Certification audit. In Stage 1, the certification body reviews your documentation and readiness. In Stage 2, typically a few weeks later, it tests whether the system operates as described. Fix any findings before the certificate is issued.
7. Maintain. The certificate lasts three years, with surveillance audits in years two and three and a recertification audit before it expires.
Sample plan for a 30-person AI company
| Month | Main work |
|---|---|
| 1 | Scope, AI system inventory, gap assessment |
| 2 | AI policy, roles, risk and impact assessment methods |
| 3 | Impact assessments for each AI system, Statement of Applicability |
| 4 | Life cycle, data and supplier controls in place, staff awareness |
| 5 | Operate controls and collect records |
| 6 | Internal audit, management review, Stage 1 audit |
| 7 | Close Stage 1 findings, Stage 2 audit, certificate |
This assumes the company already holds ISO 27001 and has some documented AI practices. Without ISO 27001, add two to four months for the management system foundations.
What the certification body looks at
In Stage 1, auditors check that the AI management system is designed properly: the scope, AI policy, roles, AI system inventory, risk assessment and impact assessment methods, Statement of Applicability, internal audit and management review. They also confirm you are ready for Stage 2.
In Stage 2, auditors test whether the system works in practice. Expect them to pick one or two AI systems and follow them through the life cycle: requirements, data, testing, deployment approval, monitoring and incident handling. They interview owners and sample records such as completed impact assessments and supplier reviews. Nonconformities must be corrected, or have an accepted correction plan, before the certificate is issued.
Budgeting time and cost
The main cost drivers are the number of AI systems in scope, how many staff are involved, whether you already hold ISO 27001, and the number of audit days the certification body sets. Ask two or three accredited bodies for quotes, and see our guide to ISO 42001 certification costs for a full breakdown.
How to move faster
- Reuse ISO 27001. Document control, internal audit, management review, competence and supplier processes can serve both standards, and many certification bodies offer combined audits.
- Start with a tight scope. Certify the AI systems customers ask about first, and extend scope later.
- Run the inventory and impact assessments early. They drive most of the control decisions.
- Book the certification body early. Auditor availability for ISO 42001 can be limited.
- Collect evidence automatically from code, cloud and ticketing tools instead of writing it up by hand.
Common reasons for delay
- AI systems discovered late, after the scope was set
- No clear owner for AI governance across engineering, data, product and legal
- Impact assessments started only weeks before the audit
- Not enough operating records for the Stage 2 auditor to sample
FAQ
How long does ISO 42001 certification take?
Typically 4 to 15 months from kickoff to certificate. Organizations with ISO 27001 and documented AI practices often finish in 4 to 7 months, while those starting AI governance from scratch should plan for 9 to 15 months.
How long is the gap between Stage 1 and Stage 2?
Often a few weeks to two months, depending on how many issues Stage 1 finds and the certification body's schedule.
Can we get ISO 42001 and ISO 27001 at the same time?
Yes. Running both together is common and efficient, because the management system clauses overlap. Ask your certification body about an integrated audit.
Do we need an internal audit before the certification audit?
Yes. ISO 42001 requires an internal audit and a management review, and the certification body will check that both were completed before Stage 2. The internal auditor must be objective, so it is often an external consultant or someone from outside the AI team.
What happens after we get certified?
You keep the AI management system running: new AI systems are added to the inventory and assessed, controls keep operating, and the certification body returns for surveillance audits in years two and three.
Disclaimer (legal note)
Timelines are estimates only. Informational, not guaranteed outcomes.
Need compliance without the complexity?
SecureSlate automates ISO 27001, SOC 2, GDPR, HIPAA, and more. Built for growing teams. See it in action.
Find compliance gaps in 30 seconds
