The ISO 42001 certification process
You go through six steps from decision to certificate. Count on nine to eighteen months, depending on your starting position and AI complexity.
The six steps to certification
- Determine scope - Which AI systems, processes and departments are covered by the AIMS? If necessary, start with your most important AI applications.
- AI inventory and risk analysis - Take an overview of all AI systems and identify the risks. This is the heart of ISO 42001.
- Set up AIMS - Implement controls, establish policies, train employees, and document processes.
- Complete Evidence Period - Work under your AIMS for a minimum of three months. Auditors want proof that the system works in practice.
- Internal audit and management review - Verify that everything is working and have management formally assess the AIMS.
- External audit - The certification body carries out the audit in two phases. If successful you will receive the certificate.
Who does what?
You
AI inventory, risk analysis, setting up AIMS, internal audits
IT/Data team
Documenting AI systems, technical measures
Consultant (optional)
Guidance, gap analysis, templates, training
Certification body
Perform audit, issue certificate
Accreditation body
Checks the certification body (the Dutch body, UKAS, etc.)
Good to know: A consultant is not mandatory. Organisations with experienced IT and compliance people can do it themselves. However, guidance can speed up the process.
Preparation for ISO 42001
Good preparation is half the battle. Most of the time is spent on the AI inventory and setting up your AIMS, not on the audit itself.
What do you need to arrange internally?
Then follow these steps:
- Appoint project leader - Someone with a mandate, AI knowledge and time to spare
- Create AI inventory - What AI systems do you have? What are they used for?
- Determine scope - Which systems and processes are covered by the AIMS?
- Perform risk analysis - Identify risks per AI system
- Implement measures - Technical and organizational, based on the risk analysis
- Create awareness - Train employees on responsible AI use
- Start proof period - Work for at least three months according to the AIMS
What documentation is needed?
The standard requires at least:
AI Policy
Your vision and goals for responsible AI use
Scope of the AIMS
Which AI systems and processes are being certified
AI inventory
Overview of all AI systems with classification
Risk analysis and treatment plan
Identified risks and chosen measures
SoA
Statement of Applicability
Which controls you apply and which you do not, with substantiation
Data governance documentation
How to handle data for AI systems
Process descriptions
Lifecycle of AI systems
No need for a thick manual. Many organisations work with a digital system or compact documents. The form is free, as long as it is current and accessible.
Three common mistakes
Mistake 2: Paper tiger
Your documents must correspond with practice. If you write down that you evaluate AI risks monthly, you really should do that. Auditors ask for evidence.
Mistake 3: Starting the proof period too late
You must have worked under your AIMS for at least three months before the external audit can take place. Plan this, otherwise your certification date will be postponed.