ISO 42001 renewal: how to keep your certificate valid

The certificate runs for 3 years from the day it is issued. For a purchasing department or a customer audit, the term alone says little. What matters is that the certificate is confirmed each year and that the reader can check it without asking you.

Every certificate carries a number and a QR code on the PDF. Anyone who scans the code or enters the number reaches the public verification page. You do not have to send proof to each customer separately.

Term

3 years from issue.

Yearly confirmation

A short online re-audit, completed once a year.

Cost of the confirmation

Covered by the yearly fee. No separate audit invoice.

• ISO 42001 certificate at Zertify

The re-audit takes place online, like the first assessment. No auditor visits your office and nobody schedules audit days with you. You answer for the situation in your company today, not for the day you first certified.

This matters for AI in particular. Models are retrained, suppliers change their terms and a pilot becomes a production system within a few months. If the re-audit asks about your AI policy, risk assessment or controls, the answers have to match what is actually running.

• How Zertify works

Set a date a few weeks before the re-audit and go through the points below. Most of them are short checks if you keep your records up to date during the year.

1. 01

   Your role and your AI systems

   Check whether you are still AI provider, producer or user for each system. List new tools, retired tools and systems whose purpose has changed.

2. 02

   AI policy and responsibilities

   Confirm that the policy is still valid and that every named owner is still in the company and still in that role.

3. 03

   Risk assessment and treatment

   Review the risks for every new or modified AI system. Check whether the measures you planned have actually been carried out (clause 6, Planning).

4. 04

   Impact assessments

   Update the assessment of effects on the people affected wherever a system, its data or its use has changed.

5. 05

   Statement of Applicability

   Compare the Annex A controls you declared with what you really apply. Correct any entry that no longer fits.

6. 06

   Data, development and operation

   Check how training data, changes to models and live operation are controlled (clause 8, Operation). Look at incidents and complaints from the past year (clauses 9 and 10).

• Overview of all standards

The yearly confirmation is what keeps the certificate current. A certificate without it should not be presented to customers as confirmed, and a customer who checks the verification page expects the certificate to be in order.

Do not let the due date pass quietly. Complete the re-audit as soon as you notice, and contact Zertify through your customer account if you need to clarify the status of your certificate.

One case is simple: if you cancel the subscription in your customer account, the certificate ends with the year you have paid for. Cancellation is possible at any time, effective at the end of the current year.

On the classic route, a certification body checks the management system on site. The usual cycle has a surveillance audit in each of the first two years and a recertification audit at the end of the three-year term. Each audit means auditor days, a schedule and an invoice quoted for the size of your organisation.

Zertify replaces the on-site visits with a yearly online re-audit. The rhythm is similar, the format and the cost model are different.

• Compare the certification routes
• Certification without an on-site audit

The Zertify ISO 42001 certificate costs CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. Swiss and Liechtenstein customers pay 8.1% VAT, which is included in these prices. If you hold two standards, the yearly fee falls by 20%, with three or more by 30%.

The certificate is based on an online self-assessment with 40 yes/no questions. 13 of them are mandatory requirements of the standard and must all be answered yes. Of the other 27, at least 18 must be yes. G6 Agency AG issues the certificate under licence from SICE, and SICE reviews every assessment before issue. After you pass and pay, the certificate arrives within 4 hours.

The subscription renews automatically each year. You can cancel it at any time in your customer account.

• Start the free self-assessment
• See pricing
• About ISO 42001 at Zertify