What Happens When AI Can Actually Understand Your Audit? Join us 11/4 to find out
Reserve my seat
ISO 42001

Independent Assessment of AI Management

ISO 42001 certification evaluates whether an organization’s Artificial Intelligence Management System (AIMS) meets the standard’s requirements within a defined scope. It provides an independent assessment of the processes used to govern AI-related activities.

Thoropass Certification LLC provides independent ISO 42001 certification audits, helping organizations demonstrate that their AIMS meets internationally recognized standards.

We perform objective, third-party evaluations, focused solely on certification. 

Get Started with Thoropass

The certification process

Certification begins with an initial audit and continues through surveillance and recertification. The audit considers both the design of the management system and evidence of its operation.

Certification planning and Stage 1 audit

  • Confirm the AIMS scope and audit arrangements.
  • Review management system documentation and readiness for Stage 2.
  • Identify areas requiring attention before the certification audit.

Stage 2 certification audit

  • Evaluate implementation and effectiveness of the AIMS.
  • Examine operational evidence and interview relevant personnel.
  • Review internal audit, management review, and corrective action activities.

Certification decision

  • Audit findings undergo a review separate from the audit team.
  • Required actions relating to nonconformities are evaluated.
  • Certification is granted when the applicable requirements are satisfied.

Maintaining certification

  • Surveillance audits take place during the certification cycle.
  • Reviews assess continued conformity and management system effectiveness.
  • Changes affecting the scope or operation of the AIMS are considered.

Recertification

  • A recertification audit takes place before the certificate expires.
  • Continued conformity and effectiveness are evaluated for renewal.
Certification scope

Unmatched experience through technology, people, and processes

Certification confirms that the AI management system within the stated scope has been assessed against ISO 42001. The certificate identifies the organizational activities covered, which should be considered when evaluating its relevance.

Certification applies to the management system. It does not certify every individual AI product or guarantee the accuracy of every AI-generated output.

AUDIT COORDINATION

Managing ISO 42001 alongside existing assessments

Organizations with established management systems may already have processes and evidence relevant to ISO 42001. Existing governance and audit activities can provide a foundation, with additional work needed to address AI-specific requirements.

The Thoropass Audit Lifecycle Platform provides the ability to capture evidence for use across multiple frameworks.Overlapping documentation can be leveraged across frameworks, while each assessment retains its own requirements.

Frequently asked questions

What is ISO 42001?

ISO/IEC 42001:2023 is an international standard for establishing, operating, maintaining, and continually improving an AI management system. It applies to organizations that develop, provide, or use AI-based products and services.

The standard addresses how organizations assign responsibility, manage AI-related risks and opportunities, and evaluate their management system over time. Its application reflects the organization’s role, operating context, and use of AI. 

Who can pursue ISO 42001 certification?

Organizations of any size or industry that develop, provide, or use AI can apply the standard. This includes organizations using third-party AI services in their operations.

What is an AI management system?

An AIMS brings together policies, objectives, responsibilities, and processes for managing AI-related activities. It provides a structure for evaluating risks and reviewing whether the organization’s approach remains effective.

Does ISO 27001 certification cover ISO 42001?

Each standard requires its own assessment. Existing information security and governance practices can support an AIMS, but additional AI-related requirements must be addressed. 

What determines the certification timeline?

Timing depends on the agreed scope, management system readiness, evidence availability, and audit findings. Planning should account for both audit stages and any corrective actions required before the certification decision.