ISO 42001 certification timeline

A realistic 6–12 month path from first AI inventory to certificate. Ranges, not promises.

1. Months 1–2: AI inventory & gap assessment. Catalog AI systems, assess against ISO 42001 Annex A, produce a remediation plan.
2. Months 3–5: Build the AIMS. AI policy, risk assessment, objectives, controls, documentation, training.
3. Months 5–7: Operate & internal audit. Run the system, collect evidence, internal audit and management review.
4. Months 7–9: Stage 1 audit. The certification body reviews documentation and readiness (typically 2–4 audit days).
5. Months 9–12: Stage 2 audit & certification. Full effectiveness audit; remediate nonconformities; certificate issued — valid 3 years with annual surveillance.

Companies with an existing ISO 27001 ISMS often compress this to 4–8 months, because the management-system machinery already exists.

Get quotes and firm timelines