Step-by-step guide to ISO 42001 certification

Step 1: AI inventory

Start with an inventory of all AI systems in your organisation. This is broader than you might think. You will find a detailed guide, including an example register table and an approach for shadow AI, on the page Inventorying AI systems.

What counts as AI? Not only ChatGPT or self-built machine learning models. Also recommendation algorithms, automated decision systems, predictive analytics, chatbots, image recognition and speech recognition.

Document per system:

• What does it do?
• Who is the owner?
• Which data does it use?
• Who are the users?
• Which decisions does it influence?
• Is it built in-house or purchased?

Step 2: Gap analysis

Now that you know which AI you have, you determine where you stand against the standard.

The gap analysis compares your current situation with the requirements of ISO 42001. For each clause and each control, you check: do we have this? Partly? Not at all?

This produces a list of gaps: the things you need to set up or improve. Prioritise based on risk and effort.

You can carry out the gap analysis yourself with the standard at hand, or you can hire a consultant. Certification bodies also offer gap analysis services.

Step 3: Set up the management system

Now you build the structure. The AI management system consists of:

Policy. An AI policy that describes the intentions and direction of the organisation. What are your principles for responsible AI?

Governance. Who is responsible for what? Roles, authorities, escalation paths.

Processes. How do you make decisions about AI? How do you assess new AI systems? How do you monitor existing systems?

Documentation. The standard requires certain documents. Policy, roles, risk analyses, Statement of Applicability. Read more about the required documentation. Start with a gap analysis to see which documents you already have.

This does not have to become a bureaucratic monster. Describe what you do in a way that suits your organisation. A start-up of 20 people needs different documentation from a bank with 10,000 employees.

Step 4: Risk and impact assessment

This is the heart of ISO 42001. For each AI system you carry out two analyses.

The risk analysis identifies what could go wrong. Technical risks (outages, errors), organisational risks (misuse, lack of knowledge), external risks (regulation, reputation). Read more about AI risk management.

The impact analysis looks at the consequences for people. What happens if the AI makes a wrong decision? Who is affected by it? How serious is that?

The impact analysis is unique to ISO 42001. You look not only at technical matters but at societal effects. Does your AI discriminate? Can people understand and challenge the decisions? Is someone’s privacy harmed?

Read more about the AI impact assessment.

Step 5: Implement controls

Based on your risk and impact analysis, you select controls from Annex A.

ISO 42001 has 38 controls divided over nine domains:

1. AI policies
2. Internal organisation
3. Resources for AI systems
4. AI system lifecycle
5. Data for AI systems
6. Information for interested parties
7. Use of AI systems
8. Third-party relationships
9. Impact assessment

You do not have to implement all 38 controls. You choose what fits your risks. But you must be able to explain why you did not select certain controls.

Record this in the Statement of Applicability. For each control: applicable or not, and why.

Read more about the Annex A controls.

Step 6: Internal audit

Before you request the certification audit, you test your own system.

The internal audit checks whether you meet the requirements of the standard and your own policy. An internal auditor, or someone independent of the process being audited, assesses the documentation and the practice.

What do you typically find? Procedures that are not followed. Documentation that is out of date. Risks that have not been identified. Controls that do not work.

This is not a moment of failure but a learning opportunity. Every finding is a chance to improve before the external auditor arrives.

After the internal audit, you carry out corrective actions. You fix what is not right. Read more about internal audits.

Step 7: Certification audit

Now you are ready for the external audit. You request the certification audit from an accredited certification body.

The audit runs in two stages.

Stage 1 is a documentation review. The auditor assesses whether your management system is complete on paper. Are all required documents there? Is the policy coherent? Are the roles clear?

Stage 2 is the on-site audit. The auditor visits and checks whether you do what you have written down. Interviews with employees, review of evidence, observation of processes.

After stage 2 you receive a report with findings. If the result is sufficient, you receive the certificate. If there are shortcomings, you get time to correct them.

Read more about the audit process.