Skip to content
Free tool · ISO/IEC 42001 certification

ISO/IEC 42001 Certification Readiness Countdown

Pick the date you want your certificate. The countdown works backward to show when each step typically has to happen: choose a certification body, sign the contract, get the documentation ready, run at least one internal audit and one management review before Stage 1, then Stage 1, Stage 2, closing findings and the certificate decision. A typical plan runs around seven months once your AI management system is in place.

All durations are typical and indicative; your certification body sets its own. Planning aid, not certification advice.

The date your certification body decides to grant the certificate. Your date and ticks are saved in this browser only.

Days to target

273

1 Aug 2027

Typical plan starts

26 Dec 2026

55 days of slack before the first step.

Checklist

0/29

Every duration below is typical and indicative. Your certification body sets its own lead times, audit days and deadlines for closing findings.

  1. Select a certification body

    Upcoming

    26 Dec 2026 to 23 Jan 2027

    Duration (indicative): typically 3 to 6 weeks.

    Shortlist accredited certification bodies, check their ISO/IEC 42001 accreditation and scope, and compare proposals.

  2. Documentation readiness

    Upcoming

    1 Jan 2027 to 26 Feb 2027

    Duration (indicative): typically 6 to 12 weeks for the final push; the system also needs to have run long enough to produce records.

    Finish the documented information the AIMS needs: scope, AI policy, objectives, risk assessment and treatment, Statement of Applicability, impact assessments, and the records that show controls running.

  3. Application and contract

    Upcoming

    23 Jan 2027 to 13 Feb 2027

    Duration (indicative): typically 2 to 4 weeks; bodies often book auditors 2 to 3 months ahead.

    Submit the application (scope, sites, headcount, AI systems), receive the audit programme and quote, sign the contract and book Stage 1 and Stage 2 dates.

  4. Internal audit cycle

    Upcoming

    26 Feb 2027 to 19 Mar 2027

    Duration (indicative): typically 2 to 4 weeks including the report.

    Run at least one full internal audit of the AIMS against the clauses and the applicable Annex A controls, report the findings and raise nonconformities.

  5. Management review

    Upcoming

    2 Apr 2027 to 3 Apr 2027

    Duration (indicative): typically one meeting, prepared over 1 to 2 weeks.

    Top management reviews the AIMS, including internal audit results, nonconformities, objectives and risks, and records its decisions.

  6. Stage 1 audit (documentation review and readiness)

    Upcoming

    17 Apr 2027 to 20 Apr 2027

    Duration (indicative): typically 1 to 3 audit days, depending on scope.

    The certification body reviews your documented information and checks you are ready for Stage 2. Areas of concern are reported.

  7. Close Stage 1 findings

    Upcoming

    20 Apr 2027 to 1 Jun 2027

    Duration (indicative): typically 4 to 8 weeks between Stage 1 and Stage 2.

    Fix the areas of concern from Stage 1 before the auditor returns. Unresolved concerns can become nonconformities at Stage 2.

  8. Stage 2 audit (implementation)

    Upcoming

    1 Jun 2027 to 6 Jun 2027

    Duration (indicative): typically several audit days, set by the certification body from scope and headcount.

    The auditor tests that the AIMS is implemented and effective: interviews, sampled records and sampled AI systems followed end to end.

  9. Close Stage 2 nonconformities

    Upcoming

    6 Jun 2027 to 18 Jul 2027

    Duration (indicative): typically 30 to 90 days, deadline set by your certification body.

    Submit corrections and corrective actions for each nonconformity. Majors usually have to be resolved, and minors covered by an accepted action plan, before certification is recommended.

  10. Certificate decision

    Upcoming

    18 Jul 2027 to 1 Aug 2027

    Duration (indicative): typically 2 to 4 weeks after the corrective actions are accepted.

    Someone at the certification body who did not audit you reviews the audit report and decides whether to grant certification. The certificate follows.

After the certificate: the typical three-year cycle

Indicative dates from your target. Your certification body confirms the actual audit programme.

  • First surveillance audit

    1 Jul 2028

    Typically due within 12 months of the certification decision, so plan it about a month early to leave time to close findings.

  • Second surveillance audit

    1 Jul 2029

    Typically annual. Each surveillance audit samples part of the AIMS and always checks internal audit, management review and corrective actions.

  • Recertification audit

    1 May 2030

    Typically held in the months before expiry so the new certificate can be issued before the old one lapses.

  • Certificate expiry

    1 Aug 2030

    Certificates typically run on a three-year cycle. Check the exact expiry date on your certificate.

TL;DR

Key facts about the 42001 certification timeline

5 points
  • Enter the date you want your ISO/IEC 42001 certificate and the countdown plans backward: certification body selection, application and contract, documentation readiness, an internal audit and a management review, Stage 1, closing Stage 1 findings, Stage 2, closing nonconformities and the certificate decision.
  • A typical plan from choosing a certification body to the certificate decision takes around seven months. Every duration is labelled as typical or indicative, because certification bodies set their own lead times.
  • At least one internal audit cycle (clause 9.2) and one management review (clause 9.3) are planned before Stage 1.
  • After certification the plan shows the typical cycle: annual surveillance audits and recertification before the certificate expires at three years.
  • Each milestone has a checklist linked to the PlayCISO tool that produces the evidence. Free, including .ics calendar and Markdown export.

How to choose and verify an accredited certification body

Only a certification body accredited for ISO/IEC 42001 can issue an accredited certificate. Check these points before you sign a contract:

  1. Accreditation to ISO/IEC 17021-1. A national accreditation body assesses the certification body against ISO/IEC 17021-1, the general requirements for bodies that audit and certify management systems.
  2. ISO/IEC 42006 for AI management systems. ISO published ISO/IEC 42006 in July 2025. It adds requirements specific to bodies that audit and certify AI management systems, such as auditor competence and audit time, and accreditation bodies are bringing it into their programmes. Accreditation for 42001 is new: UKAS announced its first AI management system accreditation on 15 January 2026, and ANAB runs a 42001 accreditation programme.
  3. An IAF MLA signatory. For the certificate to be recognised across borders, the accreditation body should be a signatory of the IAF Multilateral Recognition Arrangement (MLA). Check IAF’s current list.
  4. ISO/IEC 42001 on the accreditation scope. Accreditation is granted standard by standard. A body accredited for ISO/IEC 27001 is not automatically accredited for 42001, and some bodies issue unaccredited 42001 certificates. Ask which accreditation body accredited it for 42001 and check the schedule in that body’s directory.
  5. Verify certificates on IAF CertSearch. Search IAF CertSearch by company name or certificate number and check the status, scope, certification body and accreditation body. Not every certificate is uploaded; if one is missing, ask the certification body or the accreditation body to confirm it.

National accreditation bodies that are IAF MLA signatories include:

Signatory status and scopes change; check the registers before relying on any one body. More on certification versus attestation: can you be certified to ISO 27090?

What slows certification down

  • Booking a certification body late. Auditor calendars fill up, so the contract step often sets the earliest possible Stage 1.
  • No complete internal audit and management review before Stage 1. Without them the system cannot show it monitors and improves itself.
  • A Statement of Applicability that does not match the risk treatment plan. Use the Annex A guide and the SoA builder together.
  • Too few operating records. Stage 2 samples what actually happened, so controls need time to produce evidence.
  • Corrective actions that fix the symptom, not the cause. Track them in the nonconformity tracker.

Frequently asked questions

How long does ISO/IEC 42001 certification take?

It depends mostly on how far along your AI management system already is. Once the system is in place, the certification steps in this countdown (choosing a certification body, contracting, final documentation, an internal audit, a management review, Stage 1, Stage 2, closing findings and the decision) typically take around seven months end to end. Organisations starting from nothing usually need longer to build the system first. All durations here are indicative.

What is the difference between Stage 1 and Stage 2?

Stage 1 is a documentation review and readiness check: the auditor reviews your documented information, scope and planning and reports areas of concern. Stage 2 is the implementation audit: the auditor tests that the management system is running and effective, through interviews, sampled records and sampled AI systems. Concerns left open after Stage 1 can become nonconformities at Stage 2.

Do I need an internal audit and management review before Stage 1?

Yes, plan for it. ISO/IEC 42001 requires internal audits (clause 9.2) and management review (clause 9.3), and certification bodies expect to see at least one complete cycle of each before they can confirm the management system is running. This countdown places both before Stage 1.

How often are surveillance audits after certification?

Typically once a year. The first surveillance audit is typically due within 12 months of the certification decision, a second follows a year later, and a recertification audit takes place before the certificate expires at the end of its typical three-year cycle. Your certification body confirms the exact programme.

How do I choose an accredited ISO/IEC 42001 certification body?

Choose a body accredited for ISO/IEC 42001 by a national accreditation body that is an IAF MLA signatory. The accreditation assesses the certification body against ISO/IEC 17021-1, and accreditation bodies are adopting ISO/IEC 42006 for bodies that audit AI management systems. Check that ISO/IEC 42001 appears on the body's accreditation scope, and verify issued certificates on IAF CertSearch.

Is this tool free?

Yes. The countdown, the checklist and the .ics and Markdown exports are all free. Your target date and ticks are saved in your browser only.

Sources

Accreditation facts checked 1 November 2026. The standards’ own texts and the accreditation bodies’ registers are authoritative. Timeline durations are PlayCISO planning assumptions, not requirements of any standard.

More security tools

The tools people use most on PlayCISO.

All tools
Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.

🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →