What actually happens in a twelve-to-eighteen month ISO 42001 certification

A guided walk through the certification journey from decision to certificate. What artefacts you produce at each stage, what the two audit stages actually look like, and what happens in Year 1, Year 2 and Year 3 of the three-year certification cycle.

Free preview 12 min read Under review

Legal basis

ISO/IEC 42001 primary-source stack current to 19 September 2026. Core: ISO/IEC 42001:2023 first edition December 2023 (ten clauses 0-10 plus Annex A with 38 controls across groups A.2 Policies related to AI, A.3 Internal organisation, A.4 Resources for AI systems, A.5 Assessing impacts of AI systems on individuals or groups and societies, A.6 AI system lifecycle, A.7 Data for AI systems, A.8 Information for interested parties of AI systems, A.9 Use of AI systems, A.10 Third-party and customer relationships, plus Annex B implementation guidance, Annex C AI-related organisational objectives, Annex D use of AIMS across domains). Companion standards: ISO/IEC 23894:2023 (guidance on AI risk management), ISO/IEC 23053:2022 (framework for AI systems using machine learning), ISO/IEC 42005:2025 (AI system impact assessment), ISO/IEC 22989:2022 (AI concepts and terminology), ISO/IEC TR 24028:2020 (trustworthiness in AI). Integration standards: ISO/IEC 27001:2022 for the AIMS-on-top-of-ISMS pattern, ISO/IEC 27701:2025 for the PIMS integration. India-specific stack: India AI Governance Guidelines released by MeitY in November 2025 (seven sutras Trust / People-first / Innovation over restraint / Fairness and equity / Accountability / Understandability by design / Safety resilience sustainability, across six pillars Infrastructure / Capacity building / Policy and regulation / Risk mitigation / Accountability / Institutions, with Annexure 6 recommending ISO/IEC 42001), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026 notified 10 February 2026 effective 20 February 2026 introducing Synthetically Generated Information as a due-diligence category with visual labelling audio disclosure metadata embedding and 2 to 3 hour takedown for deepfake harm, MeitY AI Advisory dated March 2024 on labelling AI-generated content operative until superseded on labelling by the 2026 Rules, SEBI Circular No. HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 dated 5 May 2026 (Advisory on emerging advanced AI tools for vulnerability detection, Cyber-suraksha.ai task force, applies to every regulated entity in the Indian securities market), Report of the RBI Committee on FREE-AI (Framework for Responsible and Ethical Enablement of Artificial Intelligence) chaired by Professor Pushpak Bhattacharyya of IIT Bombay released 13 August 2025 (seven sutras 26 recommendations six pillars Infrastructure Policy Capacity Governance Protection Assurance), DPDP Act 2023 and DPDP Rules 2025 notified November 2025 with phased commencement (no equivalent to GDPR Article 22, no right to explanation), BIS adoption as IS/ISO/IEC 42001:2023 identical to ISO text, IndiaAI Mission approved March 2024 with ₹10,371 crore outlay over five years across seven pillars including Safe & Trusted AI (13 projects funded as of July 2026 on deepfake and bias), IndiaAI Safety Institute announced January 2025. Global adjacent regulation for extraterritorial reach and crosswalk: EU AI Act Regulation (EU) 2024/1689 phased application 2 February 2025 prohibited practices and AI literacy live, 2 August 2025 GPAI transparency for new models, 2 August 2026 general application and Article 50 transparency, 2 December 2026 new prohibited practices on synthetic intimate content and CSAM, 2 December 2027 Annex III high-risk (pushed back from August 2026 by Digital Omnibus), 2 August 2028 Annex I product-embedded high-risk. NIST AI Risk Management Framework 1.0 (January 2023) four functions Govern Map Measure Manage with official crosswalk to ISO/IEC 42001 published by NIST AIRC. OECD AI Principles (2019 updated 2024). UNESCO Recommendation on the Ethics of AI (2021). Council of Europe AI Framework Convention (opened for signature September 2024). Certification body landscape referenced: A-LIGN, BSI India, Bureau Veritas India, DNV Business Assurance India, Schellman, SGS India, TÜV SÜD South Asia, TÜV Nord India, Intertek India (accredited under ANAB, UKAS, RvA pending NABCB scheme extension). Personal certification schemes referenced (not primary): PECB Lead Implementer and Lead Auditor for ISO 42001, BSI ISO 42001 Lead Implementer, operating under ISO/IEC 17024. India first-mover organisational certifications referenced: Mphasis (first Indian IT services company to certify, 2025) and KPMG India (certified by SGS December 2025). Items requiring ongoing verification and flagged inside the relevant lessons: NABCB scheme extension timeline for ISO 42001; any ISO/IEC 42001 amendment beyond first edition; Digital India Act draft status and eventual enactment; RBI conversion of FREE-AI Report recommendations into binding master directions; DPDP Board of India Chairperson appointment status; new India AI-specific legislation.

Now that you know what ISO 42001 is, what is in it, and how it sits against NIST AI RMF and the EU AI Act, let me walk you through what a certification project actually looks like on the calendar. I have deliberately not put this at the end of the course. I want you to see the whole path in outline early, so that as we walk each clause and each Annex A control in Modules 2 through 8, you know where each piece fits in the journey. The…

Free The rest of Module 1 is free with your email

Keep reading, free

Add your name and email. We send a one-click link that brings you straight back to this lesson, signed in. No password, no payment.

We use your name and email only to send your access link and course emails. Unsubscribe from any email at any time. Privacy notice.

Already signed up? Get a fresh link.

Every claim in this lesson is cited. Yellow markers like [L1-C1] are clickable. Click any to see the verbatim text of the Section, Rule or judgment we're relying on. Learn how we verify content ›

Citations

ISO/IEC 42001:2023, Clause 4.3 Scope of the AIMS (AIMS scope statement) L4-C1

Clause 4.3 requires the organisation to determine the boundaries and applicability of the AIMS to establish its scope. The scope shall be documented and available. For AI, the scope statement must specifically identify the AI systems in scope which is significantly harder than an ISMS scope because AI capabilities are often embedded in wider products rather than run as separate systems.

ISO/IEC 42001:2023, Annex A A.2.2 AI Policy (AI policy documented) L4-C2

Annex A control A.2.2 requires the organisation to document, review, communicate and enforce an AI policy that expresses management commitment to responsible AI, aligns with the organisational context and other policies, and is available to relevant interested parties. This is not the same as Clause 5.2 which requires a policy in principle. A.2.2 controls what has to be inside that policy.

ISO/IEC 42001:2023, Annex A A.5.2 AI Impact Assessment (AIIA process required) L4-C3

Annex A control A.5.2 requires the organisation to establish a process for assessing the impact of AI systems on individuals, groups and societies. Impact must cover both intended and reasonably foreseeable unintended use. This is the AI Impact Assessment (AIIA). ISO/IEC 42005:2025 is the companion standard providing methodology.

ISO/IEC 23894:2023, ISO/IEC 23894:2023 AI risk management (AI risk management guidance) L4-C4

Guidance on managing risk for organisations that develop, produce, deploy or use AI. Builds on ISO 31000. A companion to ISO/IEC 42001 and not mandatory under it. Whether Clause 6.1.2 refers to it must be checked in the licensed text.

ISO/IEC 42005:2025, ISO/IEC 42005:2025 AI impact assessment (AI system impact assessment) L4-C5

ISO/IEC 42005:2025 provides guidance on conducting an AI system impact assessment (AIIA). Companion to ISO 42001 Annex A control A.5.2. Methodology covers stakeholder identification, impact identification across fairness, safety, transparency, privacy, security, human oversight, environmental impact and society-level impact; scoring; documentation; and lifecycle re-assessment.

Free preview

The first lesson is open. Add your email to read the rest of Module 1 free.

Module 1: What ISO/IEC 42001 actually is, and why it turned into a procurement gate in 2026

Module 2: Reading Clauses 4, 5 and 6: Context, Leadership and Planning

Clauses 4.1 and 4.2: understanding your context and identifying interested parties
Clause 4.3: writing an AIMS Scope Statement that a certification body will accept
Clause 5: Leadership, AI Policy and Roles — where an AIMS becomes real
Clause 6.1: the AI risk assessment methodology — the beating heart of the AIMS
Clauses 6.2 and 6.3: AI objectives and planning of changes

Module 3: Reading Clauses 7, 8, 9 and 10: Support, Operation, Performance evaluation, Improvement

Clauses 7.1 to 7.4: Resources, Competence, Awareness, Communication
Clause 7.5: Documented information — what must be in writing, and how it is controlled
Clause 8: Operation — executing the risk methodology and running the AIIA
Clause 9: Performance evaluation — monitoring, internal audit, management review
Clause 10: Continual improvement, nonconformity and the CAPA process

Module 4: Annex A controls Part 1: A.2 Policies, A.3 Internal organisation, A.4 Resources, A.5 Impact assessment

Annex A.2 — Policies related to AI: three controls that anchor the AIMS
Annex A.3 — Internal organisation: AI roles and the concerns-reporting channel
Annex A.4 Part 1 — Resource documentation, data and tooling resources (A.4.2 to A.4.4)
Annex A.4 Part 2 — System and computing, and human resources (A.4.5 and A.4.6)
Annex A.5 — AI Impact Assessment: the four controls that decide whether an AIMS is real

Module 5: Annex A controls Part 2: A.6 AI lifecycle, A.7 Data, A.8 Information, A.9 Use, A.10 Third-party

Annex A.6 Part 1 — AI lifecycle: requirements, design and development
Annex A.6 Part 2 — Verification, deployment, operation, monitoring and event logs
Annex A.7 — Data for AI systems: five controls with the DPDP overlay
Annex A.8 — Information for interested parties: where the IT Rules 2026 SGI obligations land
Annex A.9 and A.10 — Responsible use of AI systems and third-party relationships

Module 6: Building the AIMS end-to-end: inventory, impact assessment, risk assessment, Statement of Applicability, tooling

Building the AI system inventory — the foundation everything else hangs on
Running an AI Impact Assessment per ISO/IEC 42005:2025 — the operational template
Running the AI risk assessment methodology per ISO/IEC 23894:2023
Building the Statement of Applicability — the single most-audited document
GRC tooling landscape — buy versus build for an AIMS

Module 7: Certification body selection, Stage 1 audit, Stage 2 audit, certificate issuance

The accreditation chain — why the certificate means anything, and where NABCB stands on ISO 42001
CB selection — the RFP process, scoring criteria and negotiation
Stage 1 — the documentation review: what the auditor tests and how to pass first time
Stage 2 — the operating-effectiveness audit: sampling, interviews, evidence
The three-year sustain cycle — surveillance, recertification and living with the certificate

Module 8: The India overlay + the next five years: AI Governance Guidelines, IT Rules 2026, SEBI, RBI FREE-AI, DPDP, EU AI Act, NIST AI RMF

The India AI Governance Guidelines in operational depth — the seven sutras and six pillars, clause by clause
IT Amendment Rules 2026 SGI obligations in operational depth — the first binding AI law in India
Sector-specific overlays — SEBI 5-May-2026, RBI FREE-AI, and the wider sectoral picture
DPDP intersection with AI, and EU AI Act extraterritorial reach on Indian exporters
NIST AI RMF crosswalk and the next five years — closing the course