AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor organizations that build, provide or use AI systems and run, or plan, an AI management system that an accredited certification body will audit.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Organizations of any size that develop, provide or use AI-based products or services and choose a management system to govern AI risk, often to answer customer and procurement questions.
Auditors from accredited certification bodies, whose AI-specific competence and audit requirements are set by ISO/IEC 42006:2025; customers then review the certificate and scope.
Two-stage initial certification audit, surveillance audits each year, recertification every three years
ISO/IEC 42001:2023 (Edition 1), 2023-12-18. Paid standard (CHF 225 for English PDF + ePub on the ISO Store).
| Date | What happens | Status |
|---|---|---|
| 2025-05-28 | ISO/IEC 42005:2025 AI system impact assessment guidance published | Done |
| 2025-07-07 | ISO/IEC 42006:2025 requirements for bodies auditing and certifying AI management systems published | Done |
| 2026-01-01 | Global Accreditation Cooperation Incorporated replaces IAF and ILAC as the international accreditation body | Done |
Each one needs an owner, an approval, and proof it reached the people it covers.
Clause 5.2 and Annex A.2.2
Top management sets an AI policy suited to the organization's purpose that frames AI objectives, commits to meeting requirements and improvement, and is communicated internally.
Annex A.2.3 and A.2.4
The AI policy is checked against other organizational policies it touches and reviewed at planned intervals, or sooner when changes affect its suitability.
Clause 5.3 and Annex A.3.2, A.3.3
Roles and responsibilities for AI are defined and assigned, and a process lets people raise concerns about the organization's role with AI systems.
Clauses 6.1.2 and 6.1.3
Documented AI risk criteria and assessment results, a treatment plan, and a Statement of Applicability justifying included and excluded controls.
Clauses 6.1.4 and 8.4
A documented process assesses potential consequences of AI systems for individuals, groups and society, with results retained and repeated at planned intervals or on significant change.
Clause 7.3
People doing work under the organization's control know the AI policy, their contribution to the AI management system and the implications of not conforming.
Citations are to the standard or regulation; wording is ours.
Inferred from the clauses and general audit practice.
Auditors ask for the approved AI policy, evidence of top management sign-off and records showing it reached the people who build, buy or use AI systems.
They sample AI systems in scope and ask for each impact assessment, its date and what triggered any reassessment.
Auditors read control selections and exclusion justifications in the SoA against the AI risk assessment results.
Interviews check that staff know the AI policy, their responsibilities and how to raise a concern about an AI system.
No public auditor checklist exists for ISO/IEC 42001 yet. These points are inferred from the clauses and from general audit practice, and will be replaced with published guidance when it appears.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of ISO/IEC 42001? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
Both use the ISO harmonized structure, so clauses 4 to 10 line up and one document control process can serve both systems. Annex A differs: ISO/IEC 42001 centers on AI policy, impact assessment, data, the AI life cycle and third-party relationships.
Published in July 2025, ISO/IEC 42006 adds AI-specific requirements for bodies that audit and certify AI management systems, on top of ISO/IEC 17021-1. It governs auditor competence and audit conduct and adds no requirements for the audited organization.
ISO/IEC 42005:2025, published in May 2025, gives guidance on carrying out AI system impact assessments. It can be used to structure the impact assessment process that clause 6.1.4 asks for.
Clause 5.2 asks for the AI policy to be communicated within the organization, and clause 7.3 asks for awareness of it. A dated, version-specific acknowledgment is a common way to evidence both, though the form is left to the organization.
As of October 2026, ISO lists the 2023 edition as current with no amendment or revision under development. The standard was first published in December 2023.
Industries that hear about ISO/IEC 42001 most.
free for 30 days