ISO 42001 duration: how long certification takes

It depends on the route. On the classic route, a certification body audits your AI management system on site in two stages. Indicatively, that takes 4 to 12 months from the first gap analysis to the certificate. Most of that time goes into your own preparation, not into the audit days.

A company that already runs ISO 27001 or ISO 9001 sits at the short end. Policies, internal audits and a management review exist, and only the AI-specific parts are missing. A software vendor starting from zero, with several AI features and no inventory of them, sits at the long end.

Zertify works differently. The assessment takes about an hour, and the certificate follows within 4 hours after you have passed and paid.

• What ISO 42001 certification costs

The durations for the classic route are indicative ranges. They vary with company size, the number of AI systems in scope and the calendar of the certification body.

The phases follow one another, and the audit itself is the shortest part.

1. 01

   Preparation

   You determine whether you act as AI provider, producer or user, list every AI system in scope and compare your current practice with the standard. This gap analysis sets the plan for the following months.

2. 02

   Documentation

   You write the AI policy, assign responsibilities, carry out the risk assessment and treatment (clause 6) and prepare the AI system impact assessments. The Statement of Applicability records which Annex A controls apply and why.

3. 03

   Stage 1 audit

   The auditor reviews your documents, your scope and your readiness. The result is a report with findings that you correct before the next stage.

4. 04

   Stage 2 audit

   The auditor comes on site and checks whether the system works in practice: interviews, records and samples across the life cycle of your AI systems, from training data to operation. An internal audit and a management review (clause 9) must have taken place beforehand.

5. 05

   Certificate decision

   The certification body reviews the audit report and the closed findings, then issues the certificate. This step alone can take several weeks.

Projects rarely slip because of the audit. They slip for these reasons.

No AI inventory

If nobody knows which AI features, models and external tools are in use, the scope cannot be fixed. Compiling the list often takes longer than expected.

Impact assessments

The assessments for the people affected by your AI systems need input from product, legal and operations. Each system needs its own.

Missing operating records

An auditor wants to see that the system has been running. The internal audit and the management review must be done and documented before stage 2.

Third-party AI

When you use models or tools from suppliers, you still have to document who is responsible for what. Waiting for supplier information stalls many projects.

Auditor availability

Stage 2 slots are booked in advance. A correction that misses a slot can cost weeks.

You answer 40 yes/no questions online. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 27, at least 18 need a yes. Anyone who knows their AI systems and their own processes finishes in about an hour. No account is needed to start.

SICE reviews every assessment. Once you have passed and paid, the certificate is issued by G6 Agency AG under licence from SICE, within 4 hours. It carries a number and a QR code, so a purchasing department can check it on the public verification page.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years and is confirmed each year by that short online re-audit. The subscription renews automatically and can be cancelled at any time in your customer account, to the end of the current year.

• ISO 42001 at Zertify
• Pricing
• Start the free self-assessment

Some customers and tenders ask explicitly for an on-site audit by a certification body. Read the requirement in the tender text or the supplier questionnaire before you decide. If it names an on-site audit, the classic route is the one to plan for, with the months it takes.

If a customer only asks for an ISO 42001 certificate that can be verified, the online route covers it, and you have the document in hand the same day. The guides below compare both routes.

• Compare the certification routes
• Certification without an on-site audit