What auditors ask for in an ISO/IEC 42001 certification audit

ISO says organizations may choose certification by independent certification bodies. This article collects only what accreditation bodies and those certification bodies have published about what the audit looks at. It is not an auditor’s private checklist, and it is not a substitute for ISO/IEC 42001:2023 itself.

Status as of 14 October 2026: UKAS still dates the first accreditation for certification of artificial intelligence management systems to ISO/IEC 42001:2023 15 January 2026, granted to BSI. Directory listings whose official pages name ISO/IEC 42001 AIMS work include Optro AI Governance, ISMS.online, the AI Verify Testing Framework (mapped to ISO/IEC 42001 on 21 July 2025), Strike Graph, Arthur and Saidot. Those listings are not certification bodies.

Who is allowed to issue the certificate

UKAS granted BSI the first accreditation for certification of artificial intelligence management systems to ISO/IEC 42001:2023 on 15 January 2026. UKAS states that accreditation to ISO/IEC 17021-1 confirms that a certification body has the competence, impartiality and consistent approach needed to certify organisations against this new standard.

On 10 March 2026 BSI published that it had secured accreditation from the ANSI National Accreditation Board (ANAB) for the same standard, in addition to UKAS and the Netherlands’ RvA. BSI’s own words: accreditation confirms to regulators, stakeholders, and clients that BSI operates to the highest international standards of consistency, competence, and impartiality in AI certification.

The two standards those pages name for the auditor, not the auditee, are:

• ISO/IEC 17021-1:2015, which contains principles and requirements for the competence, consistency and impartiality of bodies providing audit and certification of all types of management systems.
• ISO/IEC 42006:2025 (published July 2025), which sets out the additional requirements for bodies that audit and certify artificial intelligence management systems (AIMS) according to ISO/IEC 42001. ISO’s public page says it does not replace ISO/IEC 17021-1; it supplements it. UKAS lists the same trio — 42001, 17021-1, and 42006 — on its AIMS programme page.

ISO’s 42006 page also says auditors themselves need specialised knowledge because AI systems present challenges in ethics, data quality, risk, and transparency. That is a statement about auditor competence, not a list of files you must upload.

What BSI says to have ready (ISO/IEC 42001-specific)

BSI’s ISO/IEC 42001 pre-certification page is the public, standard-specific list we found. The assessment is not a mandatory requirement before a formal audit. BSI says it clarifies what evidence will satisfy the documentation requirements of a formal audit and looks at change management processes, risk assessment, approval procedures, and implementation plans.

To prepare, BSI tells organisations to have:

• a description of their AI system(s) under the draft AIMS scope
• a list of services with descriptions
• a Statement of Applicability
• a list of sites with addresses and activities
• their AI policy and objectives
• the AI Management System Manual along with drafts of relevant procedures, policies, and work instructions

That is BSI’s published preparation list. It is not a claim that every accredited body uses the same filenames.

Stage 1 and Stage 2 (BSI’s published management-system process)

BSI’s Management Systems Certification Guidebook (PP168, May 2026) describes the audit BSI runs for accredited management-system schemes. The PDF says it is written around ISO 9001, ISO 14001 and ISO 45001, and that it also applies to management of other accredited Management System schemes however specific scheme requirements take precedence. Treat the steps below as BSI’s generic process, not as extra ISO/IEC 42001 clauses.

Stage 1 (preliminary assessment). BSI says the purpose is to assess your organisation’s readiness for certification. The assessor will review your management system documentation, including policies, procedures, and other relevant supporting materials to see that required documentation has been established, is appropriately controlled, and is being maintained and updated. Any areas of concern identified during the Stage 1 audit must be satisfactorily addressed prior to proceeding to the certification audit.

Stage 2 (certification audit). The purpose is to determine whether your organisation’s management system has been effectively implemented and complies with the requirements of the relevant standard, by reviewing actual practices, documentation, and records and checking that documented systems are understood by your organization and are being consistently and effectively applied in practice.

Findings. BSI classifies findings as Major, Minor, or Opportunities for Improvement. All major nonconformances must be fully addressed and closed prior to the recommendation of certification. A major finding needs to be closed or downgraded to a minor non-conformance before certification can be granted. Both major and minor findings require a corrective action plan with correction, root cause analysis, and proposed long-term actions, submitted within two weeks on BSI’s process.

Certification decision. Certification will be granted only after this independent review has been successfully completed. The audit team does not issue the certificate at the exit meeting.

After the certificate

BSI’s guidebook states that certification is maintained through an ongoing audit cycle, typically spanning three (3) years: two annual surveillance audits and a recertification audit, all completed prior to certificate expiry. Surveillance is at a minimum of 12-month intervals; the first must take place within ten (10) months of the initial certification audit. Recertification should be scheduled at least three (3) months prior to the certificate expiry date. The organisation must promptly notify BSI of any changes, including updates to address, ownership, key management personnel, management system changes, or operational capabilities.

What we are not listing

No accreditation or certification-body page we fetched publishes a numbered “questions the auditor will ask” script for ISO/IEC 42001. We did not invent one. Clause-level evidence still comes from the standard itself (ISO sells the full text) and from mappings such as the NIST AI RMF to ISO/IEC 42001 crosswalk. A printable set of cited artifacts is on the AI audit evidence checklist.

ISO also states that 42001 provides a practical way of managing AI-related risks and opportunities across an organization rather than looking at details of specific AI applications. An ISO/IEC 42001 certificate is not an airborne, CMMC, or EU AI Act conformity assessment on any official page cited here.