Key facts
- Realistic first-time SME estimate: roughly 3–6 months of gap assessment and implementation.
- Certification itself follows a two-stage external audit: Stage 1 (documentation review) and Stage 2 (certification audit).
- Organisations with an existing ISO management system typically certify faster than those starting from scratch.
- Timelines vary by certification body availability and audit scheduling, not just your own readiness.
- Use the free readiness checklist to estimate your own starting gap.
The two phases
Certification has two distinct phases: your own internal work to build the AI management system (policies, risk assessment, Annex A controls, documentation, internal audit, management review), and the external certification audit run by an accredited certification body. The internal phase is the one most within your control to speed up or slow down.
What affects the internal timeline
Organisations with an existing ISO management system (commonly ISO 27001) tend to move faster because much of the operating structure — document control, internal audit process, management review cadence — already exists and can be extended. Organisations starting from nothing typically need the fuller 3–6 month range, sometimes longer if governance is genuinely immature.
The external audit stages
Stage 1 is a documentation review: the certification body checks your management system documentation is complete and ready for a full audit. Stage 2 is the certification audit itself, testing whether the system operates as documented in practice. Scheduling both stages depends on certification body availability, which can add lead time beyond your own internal readiness.
Realistic overall expectation
For a typical SME with no existing ISO management system, six months to a year end-to-end (internal work plus audit scheduling) is a realistic planning assumption, though faster outcomes are possible with strong existing governance and a responsive certification body.
Frequently asked questions
How long does ISO 42001 certification take for a small business?
Roughly 3 to 6 months of internal gap assessment and implementation, plus several more weeks for the two-stage external audit.
What are the two stages of ISO 42001 certification audit?
Stage 1, a documentation review, and Stage 2, the certification audit testing the system in practice.
Does having ISO 27001 speed up ISO 42001 certification?
Usually, yes — much of the operating structure already exists and can be extended rather than built from scratch.
What is the realistic end-to-end timeline?
For a typical SME without an existing ISO management system, six months to a year is a realistic planning assumption.
What is the first step to estimate our own timeline?
A gap assessment against Annex A and the standard's main clauses — the free readiness checklist is designed for this first pass.
Related pages
Sources
Last updated 19 June 2026.