Digital Lexicon Hub

The independent audit, run in two stages by an accredited certification body, that decides whether a management system such as ISO/IEC 42001 or ISO/IEC 27001 can be certified.

A certificate from an accredited body is the evidence customers, tenders and partners usually ask for, and it is renewed only while the system keeps working, so knowing what each stage checks helps companies plan evidence, budget and dates realistically.

A company preparing for ISO/IEC 42001 completes an internal audit and a management review, passes a Stage 1 review of its scope, policies and Statement of Applicability, fixes two areas of concern, and passes the Stage 2 audit eight weeks later.

Auditors sample evidence, so a certificate shows the system conformed when it was audited, not that every AI system or control works at all times. Certificates from bodies that are not accredited for the standard carry little weight with buyers.

Certification bodies follow ISO/IEC 17021-1 and, for AI management systems, the additional requirements of ISO/IEC 42006. Stage 1 reviews the design of the system: scope, required policies, risk and impact assessment methods and the Statement of Applicability (SoA). Stage 2 tests whether the system operates effectively, including in-scope Annex A controls, monitoring, internal audit, management review and corrective action. Nonconformities must be resolved before a reviewer independent of the audit team decides on certification. The certificate is valid for three years, with surveillance audits in the intervening years and a recertification audit before it expires.