How long does ISO 42001 certification actually take, and what does it cost?
The certification body sets the fee and runs the audit, not us. What we can give you is a realistic view of the stages, the timeline, and the factors that actually drive duration and cost.
Last reviewed:
Sound familiar?
- Vendors quote fixed prices before knowing the scope, the number of AI systems, or the state of your management system.
- Nobody explains the difference between stage 1 and stage 2, so teams show up unprepared for what each one actually checks.
- Surveillance audits get forgotten in the budget — certification isn't a one-time event, it's a three-year cycle.
- Timelines get compressed to fit a marketing deadline, then collapse under audit findings that needed real fixes.
What we do
Stage 1 readiness review
A documentation-focused audit checking whether your AIMS is designed correctly and ready for the operational audit — we prepare you to pass it the first time.
Stage 2 audit support
The operational audit, checking whether the management system is actually implemented and followed. We support evidence gathering and interview prep.
Cost and timeline drivers
An honest breakdown of what drives duration and price: number of sites, number of AI systems in scope, headcount, and how much of the AIMS already exists.
Surveillance planning
A plan for the annual surveillance audits over the three-year certification cycle, so the work doesn't stop the day the certificate is issued.
Questions we get
How long does the whole process take?
From a standing start, most organisations need several months to build the AIMS before the stage 1 audit, then a stage 1 and stage 2 audit typically a few weeks to a couple of months apart. Total elapsed time varies widely with scope and starting point.
What does certification cost?
We don't quote a number here because the certification body sets its own fee, driven mainly by the number of sites, the size of the organisation, and the number of AI systems in scope. Expect it to scale similarly to an ISO 27001 certification of comparable size.
Can we fail stage 2 after passing stage 1?
Yes. Stage 1 checks the design of your management system; stage 2 checks whether it's actually followed. A well-documented AIMS that nobody uses fails stage 2.
Is the certificate valid forever once issued?
No. It's valid for a fixed cycle with annual surveillance audits and a recertification audit at the end, usually after three years.
Tell us what's running in production.
We'll tell you what we'd check first — and what we wouldn't bother with.
Book a call