ISO/IEC 42001 FAQ Certification

Choose the assurance outcome first: self-assessment, a customer-requested second-party review, or independent third-party certification. Only the third option can produce an independent ISO/IEC 42001 management-system certificate, and accreditation is a separate attestation of the certification body's competence for a stated certification scope.

Define the exact AIMS boundary before requesting proposals. Record the legal entity, organisational units, locations, products, services, AI activities, shared processes, outsourced work, and interfaces included in or excluded from the scope. ISO/IEC 42001 applies to organisations of any size or type that provide or use products or services involving AI systems, but a certificate reaches only the documented and audited boundary.

Operate the AIMS long enough to produce representative evidence. Readiness requires more than approved policies: auditors need records showing risk and impact assessment, treatment, competence, operational controls, monitoring, internal audit, management review, and correction of nonconformities in practice.

Build a traceable evidence set for the complete audited boundary. It should cover context and scope, interested-party requirements, policy and roles, objectives, AI risk criteria, system inventory, risk and impact assessments, the statement of applicability, approved treatment plans and residual risks, competence, controlled documents, operational samples, supplier controls, monitoring results, internal audits, management reviews, nonconformities, and corrective-action effectiveness.

For each sample, retain the system or process covered, owner, version, period, criteria, result, exception, approval, and follow-up. Evidence from outside the proposed scope may provide context, but it cannot substitute for records from the sites and activities the certificate will name.

Top management should approve the scope and assurance objective because it is accountable for the AIMS, resources, integration into business processes, and intended results. An AIMS owner can coordinate readiness, while process, system, risk, and control owners provide evidence and correct gaps.

Internal auditors must remain objective and impartial. Procurement or assurance teams can check the external body's proposed scope, competence, impartiality, and credentials, but the organisation should verify accreditation with the named accreditation body or authoritative register rather than relying on a proposal, sales statement, or logo.

The external body makes the certification decision. Consultants, internal auditors, customers, and the organisation's management can assess readiness or conformity, but they do not issue the independent certificate.

Review the certified scope whenever organisational boundaries, legal entities, sites, AI activities, products, services, outsourced processes, major suppliers, or interested-party requirements change. Assess planned changes before representing the new activity as certified, and tell the certification body when the certification agreement requires notification.

Follow the audit and certificate cycle stated by the certification body, including any surveillance, recertification, special-audit, suspension, or withdrawal conditions. ISO/IEC 42001 itself requires internal audits and management reviews at planned intervals but does not prescribe one universal external audit frequency or certificate term.

Before making a public claim, verify that certificate wording, legal entity, sites, activities, exclusions, standard edition, validity dates, certificate status, and certification-body details match the current certificate and actual AIMS boundary. Do not wait for an external audit to address a known nonconformity or ineffective control.