In brief
How long ISO 42001 certification takes: readiness depends on your AI inventory and any ISO 27001 you hold; the two-stage audit follows the certifier.
How long does ISO 42001 certification take? It depends on your readiness work, building the AI Management System (AIMS), and on a two-stage audit that the certification body schedules. The biggest variables are whether you already have a documented AI system inventory and whether you already run an ISO management system such as ISO 27001.
How long does ISO 42001 certification take, and where does the time go?
ISO/IEC 42001:2023, published in December 2023, sets requirements for an AI Management System. It shares the ISO management-system structure with ISO 27001, so certification follows the same path: readiness, internal audit and management review, Stage 1, remediation, Stage 2, and the certification decision. Certification bodies audit an AIMS under ISO/IEC 17021-1 plus ISO/IEC 42006:2025, published in July 2025, which adds competence requirements for bodies that certify AI management systems. There is no standard duration; a useful estimate starts from how many AI systems fall inside your scope.
| Phase | Who controls the time | What drives it |
|---|---|---|
| AI system inventory and AIMS scope | Your team | Number of AI systems, in-house models vs third-party APIs, existing documentation |
| AI policy, risk assessment, AI impact assessment, Statement of Applicability | Your team | Risk level of each system, input from engineering, product and legal |
| Operating controls and collecting evidence | Your team | Which Annex A controls already exist and which are new |
| Internal audit and management review | Your team | Required before the certification audit |
| Stage 1, remediation, Stage 2 | Certification body | Availability of auditors with AI competence, number of Stage 1 findings |
How much faster is ISO 42001 if you already have ISO 27001?
ISO 27001 holders skip most of the management-system build: document control, internal audit, management review, supplier and incident processes already exist. What does not carry over is the AI-specific content: the AI system inventory, AI impact assessments, and the 38 Annex A controls of ISO 42001 (groups A.2 to A.10). A Statement of Applicability is still required under clause 6.1.3. How to run both without duplicating work is covered in integrating ISO 27001 and ISO 42001.
What usually slows ISO 42001 down?
The slowest item is usually the AI system inventory. Many companies use AI in their product or internally without having documented intended use, data inputs, affected people and known limitations, and the list tends to grow once you start.
- Inventory every AI system: in-house models, third-party APIs (OpenAI, Anthropic, Gemini) and AI features inside tools you already use. See AI system inventory and risk register for ISO 42001.
- AI impact assessment: assess effects on individuals and society, not only technical risk.
- Model changes: retraining or swapping a model needs change management, like a software deployment.
- AI suppliers: using a third-party model still requires supplier assessment and suitable contract terms.
- Certification body availability: ISO 42001 is new and auditors with AI competence are fewer; contact certification bodies early and check their accreditation scope.
The ISO 42001 implementation checklist for AI companies in Vietnam turns these into an ordered plan.
Does ISO 42001 certification prove EU AI Act compliance?
No. ISO 42001 certification is not by itself proof of EU AI Act compliance. The Act classifies AI systems by risk and sets obligations per category, applying in stages from 2025 to 2028 (the Digital Omnibus on AI moved stand-alone high-risk obligations to 2 December 2027 and Annex I systems to 2 August 2028). An AIMS built to ISO 42001 gives you governance processes, documentation and evidence that many Act obligations rely on, but each obligation still has to be mapped and met separately. The ISO 42001 certification guide maps Articles 9 to 17 to the relevant ISO 42001 clauses and controls.
What happens after ISO 42001 certification?
ISO 42001 certification follows the same model as ISO 27001: a 3-year cycle, surveillance audits at least once a year in years 1 and 2, and a recertification audit before the cycle ends. The AI inventory and risk assessment must be updated when you add systems or change models, because surveillance auditors check that the AIMS is still operating.
Where does pTrackly fit, and what stays with you?
pTrackly includes the ISO 42001 framework with policy templates tailored to your company, recurring evidence tasks with reminders before they are due, a risk register scored by likelihood × impact, and setup guides for connecting AI platforms such as Google Vertex AI, Azure OpenAI, AWS Bedrock, Hugging Face and MLflow. Controls are shared with ISO 27001, so overlapping work is not repeated. pTrackly does not certify anyone; the AI inventory, impact assessments and risk decisions are made and approved by your team. See pTrackly for ISO 42001.
Frequently asked questions
Is ISO 42001 mandatory?
No. ISO 42001 is a voluntary standard. Companies pursue it because enterprise buyers ask for evidence of AI governance or to prepare for obligations such as the EU AI Act.
Can we get ISO 42001 without ISO 27001?
Yes. ISO 42001 does not require ISO 27001. Without it you also build the management-system foundations, so readiness usually takes longer.
How many controls does ISO 42001 have?
Annex A of ISO/IEC 42001:2023 has 38 controls in 9 groups, A.2 to A.10. You decide which apply and justify exclusions in the Statement of Applicability.
How often is ISO 42001 audited?
After initial certification there are surveillance audits at least once a year in years 1 and 2, then a recertification audit before the 3-year cycle ends.
