Get ready for your ISO/IEC 42001 audit — starting with a list of your AI.

No. It adds to them, and assumes your information security baseline lives elsewhere. 42001 governs how AI systems are chosen, built, deployed, monitored and retired, and what they do to the people they affect. It says almost nothing about patching, access control or cryptography. If you already hold 27001, clauses 4, 5, 7, 9 and 10 carry over and your calendar shortens. If you hold nothing, you build the management system and the AI governance together.

Six to twelve months from kick-off to certificate for a mid-sized company. We quote nine when we know nothing else about you. Roughly four to eight weeks on inventory and scope, then eight to sixteen weeks writing and starting to operate the AIMS, then a stretch where it simply runs and produces records. You need at least one internal audit and one management review before Stage 2, because you cannot certify a management system that has never operated.

Yes. The standard covers organizations that only deploy AI, not just those that build it. Your Statement of Applicability looks different: most of A.6.2, the development, verification and validation controls, can be excluded with written justification. A.5 impact assessment and A.10 third-party and customer relationships cannot. In practice the harder part is the inventory: nobody has written down the vendor APIs and the AI features switched on inside existing SaaS.

No, and no consultancy can. We implement, you operate, and an independent certification body accredited for ISO/IEC 42001 audits and issues. Ask any prospective body to show 42001 explicitly on its accreditation scope, since 27001 accreditation does not extend to it, and verify on the accreditation body's public register or IAF CertSearch. Book that body early, alongside implementation, not after it. Accredited auditor supply is the external bottleneck on this standard and Stage 2 slots have run months out.

No. 42001 is a voluntary international management system standard. The AI Act is binding law with its own conformity assessment route. CEN-CENELEC adopted the identical text as EN ISO/IEC 42001:2026 on 18 March 2026, but presumption of conformity under Article 40 requires a reference published in the Official Journal, and there isn't one. EN 18286:2026, the quality management system standard written for Article 17 (approved 12 July 2026, available from 22 July 2026), isn't cited there either. A provider of a high-risk system keeps the full evidentiary burden. What the certificate does buy you is a credible governance record to build the Article 17 work on.

No. A certificate from a body accredited by any IAF MLA signatory is recognized internationally, which is what your buyer's third-party risk team is checking. What it does affect is cost, auditor scheduling and lead time, so confirm current scheme status with the accreditation body before you commit. SecWiz is India-based and delivers remotely, so working across time zones with your chosen body is normal for us.

Who the system decides about or affects, what could go wrong for them, how likely and how severe, what evidence supports each conclusion, what you changed as a result, and when you will look again. Groups matter as much as individuals, and societal effects are a named control, A.5.5. We structure ours to ISO/IEC 42005:2025. The test an auditor applies is simple: does this document analyze consequences for people, or has it slipped back into risk to the business?

Three things. A Statement of Applicability with all 38 controls marked applicable, which turns every control you cannot evidence into a finding. Policies that restate the clause text with no operating records behind them, when auditors sample event logs under A.6.2.8, incident records under A.8.4 and closed corrective actions with effectiveness verification. And a merged risk and impact assessment. The fourth, arriving a year later at surveillance, is a risk register nobody refreshed because no re-assessment triggers were ever defined.