The ISO 42001 audit process

You have set up your AI management system according to ISO 42001 . Now the certification audit by an accredited body follows. How does that process work? What can you expect? And how do you prepare?

Certifying bodies for ISO 42001

In the Netherlands you can turn to several accredited certification bodies (CBs):

DNV - Issued the first ISO 42001 certificate in the Netherlands
BSI - Recognised by the Raad voor Accreditatie (RvA, Dutch Accreditation Council)
TÜV - Known from automotive and industry, also active in AI
Kiwa - Dutch CB with broad experience
LRQA - Operates internationally

The choice depends on factors such as price, availability, sector knowledge and whether you already have a relationship with a CB through other certifications. Read more about certifying bodies.

Choose a CB that is accredited for ISO 42001. Accreditation means that an independent body (in the Netherlands the RvA) has checked that the CB is competent to carry out these audits.

The ISO 42001 audit process in brief

Phase	Duration	What happens?
Quotation request and planning	2-6 weeks	Define scope, buy audit days, schedule the date
Stage 1: documentation review	1-3 days	Auditor checks whether the AIMS is complete on paper
Stage 2: on-site audit	2-8 days	Interviews, evidence and observation on location
Findings and correction	30-90 days	Resolve non-conformities, submit evidence
Certificate issue	One-off	Certificate valid for 3 years
Annual surveillance	1-2 days per year	Check that the AIMS stays current and effective
Recertification audit	After 3 years	Full re-audit, comparable to the initial audit

The ISO 42001 audit process step by step

Quotation request and planning

You request quotes from one or more CBs. They want to know:

What is the scope of your AIMS?
How many staff do you have?
How many AI systems do you have?
Which locations?
Do you already hold other ISO certifications?

Based on this, they determine the number of audit days and the costs. Once you agree, you schedule the audit date.

Stage 1: documentation review

The first stage is a documentation check. The auditor assesses whether your management system is complete on paper.

What does the auditor check?

Is the scope clearly defined?
Is there an AI policy?
Are roles and responsibilities recorded?
Has a risk assessment been carried out?
Is there an impact analysis?
Is there a Statement of Applicability?
Are the mandatory procedures in place?

How does it work? Stage 1 can take place remotely (document review) or on site. Duration: 1-3 days, depending on complexity.

What is the output? A report with findings. If there are major shortcomings, you must correct them before you can move on to stage 2.

Stage 2: on-site audit

The second stage is the on-site audit. The auditor visits and checks whether you do what you have written down.

What does the auditor do?

Interviews: Conversations with staff at different levels. Management on commitment and policy. AI developers on how they assess risks. Operational staff on awareness.

Evidence: The auditor asks for evidence. “Show me the impact analysis for this AI system.” “What does the logging look like?” “Where is the approval for this risk?”

Observation: How do processes work in practice? Is the policy followed?

How long does it take? Stage 2 takes 2-8 days, depending on the size of your organisation and the number of AI systems. The auditor plans interviews, visits locations and reviews systems.

Findings and conclusion

At the end of stage 2 the auditor presents the findings. There are three categories:

Major non-conformities: Serious deviations. A core requirement of the standard is not met. You must correct a major non-conformity before you receive the certificate.

Example: No impact analysis has been carried out for an AI system that makes decisions about people.

Minor non-conformities: Less serious deviations. A requirement is not fully met, but the system still functions. You must correct a minor non-conformity, but this can be done within an agreed period after the audit.

Example: The risk analysis has been carried out, but is not well documented.

Observations: No deviations, but points for improvement. You do not have to act on them, but they are advice.

Correcting findings

If there are non-conformities, you are given time to correct them. Usually 90 days for majors, sometimes longer for minors.

You send evidence of the correction to the auditor. They assess whether the correction is adequate. For majors, a verification audit may be needed.

Certificate issue

If everything is in order, you receive the certificate. It is valid for three years.

Annual ISO 42001 surveillance audits

After initial certification, annual surveillance audits follow. These are less extensive than the initial audit, but they cover all parts of the standard over the three-year cycle.

The auditor checks:

Is the AIMS still current?
Have there been any changes?
Have earlier findings been addressed?
Does the system still function?
Is there improvement?

After three years a recertification audit follows. It is comparable to the initial audit.

What does the ISO 42001 auditor expect?

The auditor looks at three things:

Conformity. Do you meet the requirements of the standard? Are the mandatory elements in place?

Effectiveness. Does the system work? Are you achieving your objectives? Are risks actually being controlled?

Improvement. Are you improving? Do you learn from incidents? Are internal audits followed up?

Specific to ISO 42001

Because ISO 42001 is new, the auditor pays extra attention to AI-specific elements:

The impact analysis. Have you genuinely considered the impact of your AI on people? Is this more than a tick box?

Explainability. Can you explain how your AI systems reach decisions? Not down to the last bit, but conceptually.

Bias and fairness. Have you investigated whether your AI discriminates? What have you done to prevent this?

The lifecycle. How do you monitor AI after deployment? What happens if a model degrades?

Data. How do you handle training data? Quality, provenance, privacy?

The auditor is not an AI expert who reviews your code. But the auditor does expect you to explain how your AI systems work and how you manage their risks. Technical jargon without understanding does not help.

Tips for a successful ISO 42001 audit

Preparation starts six weeks earlier. You can find a weekly plan on ISO 42001 audit preparation.

Preparation

Make sure documentation is up to date. Outdated procedures are a red flag. Update everything before the audit.

Do a pre-audit. Go through the requirements yourself and check that everything is in order. Or hire a consultant.

Prepare staff. Who can be interviewed? Do they know what the AIMS is? Do they know the policy?

Gather evidence. The auditor asks for evidence. Make sure you can find it. Risk analyses, training records, minutes, log files.

During the audit

Be honest. If you do not have something or do not know something, say so. Bluffing or making excuses backfires.

Give direct answers. Answer the question asked. Do not drift into other topics.

Show what you do. Do not just tell, show. Open screens, open documents.

Take your time. If you need to look something up, ask for a moment. It is better to deliver something good than to say something wrong under pressure.

Take notes. Write down what the auditor says. This helps with follow-up.

Common pitfalls

Only on paper. A perfectly documented system that nobody knows or uses. The auditor sees through that.

No evidence. “We always do this” without being able to show anything.

Unclear responsibilities. Nobody knows who owns which AI.

No impact analysis. This is new and specific to ISO 42001. Do not forget it.

Outdated risk analysis. An analysis from two years ago while your AI landscape has changed.

After the ISO 42001 audit

After a positive result

You receive the certificate. Celebrate the moment, but realise that the work continues.

Plan the first surveillance audit (usually after a year). Keep the AIMS alive: keep monitoring, auditing and improving.

After a negative result

Do not panic. Address the findings. You usually get a second chance through corrective actions or a re-audit.

Analyse what went wrong. Was it a documentation problem? An implementation problem? A commitment problem? The cause determines the solution.

What does the ISO 42001 audit cost?

Audit costs depend on the number of days. Expect €1,000-€2,000 per day.

Organisation type	Stage 1	Stage 2	Total
Small (10-50 FTE)	1 day	2-3 days	€3,000-€8,000
Medium (50-250 FTE)	1-2 days	3-5 days	€6,000-€14,000
Large (250+ FTE)	2-3 days	5-8 days	€10,000-€22,000

Annual surveillance audits are cheaper: 50-70% of the initial audit.

Combined ISO 42001 audits

If you already have ISO 27001, you can have a combined audit. The auditor assesses both systems at the same time. This is more efficient and cheaper than two separate audits.

The overlap between ISO 27001 and ISO 42001 is significant. Many processes (internal audit, management review, document control) apply to both.