How to get ISO 42001 certified: the process step by step

The ISO 42001 certification process

1. Gap assessment — measure your current state against the standard and get a prioritised list of gaps.
2. Build the management system — scope, AI policy, risk and impact assessments, Annex A controls, roles and documentation. Use the ISO 42001 checklist.
3. Operate and generate evidence — run the system long enough to produce real records (assessments, reviews, corrective actions).
4. Internal audit and management review — test yourself and have leadership sign off readiness.
5. Choose an accredited certification body — select one whose accreditation and reputation your customers will recognise.
6. Stage 1 audit — the body reviews your documentation and readiness and flags gaps.
7. Stage 2 audit — the main audit: the body tests that your management system operates in practice, then recommends certification.
8. Certification and surveillance — you receive the certificate (typically valid three years), with annual surveillance audits and recertification at the end.

How long does it take?

For most organisations, several months to a year — driven by how much of the management system you need to build and how long you operate it to generate evidence. Organisations with an existing ISO 27001 system move faster.

How to choose a certification body

Pick an accredited body (accreditation is what makes the certificate credible), with AI-management experience, and recognition in the markets you sell to. The cheapest option isn't worth much if your enterprise buyers don't trust the accreditation behind it.

Set yourself up to pass

The organisations that pass smoothly are the ones that went in with a strong gap assessment and internal audit behind them, so non-conformities are caught before the certification body finds them. Read the requirements and what it costs.

How AramGRC helps

AramGRC's ISO/IEC 42001 internal audit and gap assessment gets you audit-ready — you walk into Stage 2 knowing you'll pass, not hoping.