The ISO 42001 certification process runs from an AI system inventory and a gap review to scope, operated controls, an internal audit, then Stage 1 and Stage 2. Surveillance follows the certificate. A focused firm with a small inventory can be ready for the documentation review in about 90 days. Most builds take three to six months.

Boards ask for a date. The ISO 42001 certification process is a sequence of records, not a logo you book for next quarter. If leadership skips the inventory, the ISO 42001 certification process stalls before any policy is written. People search ISO 42001 steps and find either a clause list or a sales page. The ISO 42001 steps below are the order an Indian project actually runs.

ISO 42001 implementation is the work between the gap and the certificate: scope, documents, controls and records. Treat ISO 42001 implementation as a management system, not as a binder copied from ISO 27001. Seven Step Consulting is a consultancy in Gurugram. It prepares the AI management system, the AIMS. It does not issue the certificate. A certification body does.

What the ISO 42001 certification process covers before an auditor is booked

Skip a step and the later ISO 42001 steps become rework. The early ISO 42001 steps are inventory, gap and scope. The middle ISO 42001 steps are policies, the Statement of Applicability, risk and impact, and controls that run. The late ISO 42001 steps are internal audit, management review, Stage 1 and Stage 2. ISO 42001 steps are not the 38 Annex A controls. Controls sit inside the operate step.

Nine-step ISO 42001 certification process from gap review to the Stage 2 audit in India
Step What you produce Who signs
1. Inventory System list with owner, purpose and status Product or risk lead
2. Gap Clause 4 to 10 and Annex A gaps Your lead, with the consultant
3. Scope Legal entity, sites, systems, exclusions Top management
4. Policies and SoA AIMS policy and Statement of Applicability Top management
5. Risk and impact AI risk assessment and AI impact assessment System owner
6. Operate controls Records of testing, oversight, suppliers Control owners
7. Internal audit and review Audit report and management review minutes Internal auditor and top management
8. Stage 1 Documentation review Certification body
9. Stage 2 Implementation audit and the certificate decision Certification body

A Gantt chart of ISO 42001 steps that has no named owners is a picture. Share the ISO 42001 steps with the people who will be in the room for Stage 2. If your ISO 42001 steps start with “select a certification body”, you have started too late to fix the inventory.

1. Inventory the AI systems

Step one of the ISO 42001 certification process is a list of AI systems that are actually in production, not a list of tools the IT policy mentions. Write the name, the purpose, the owner, the data it touches, and whether a vendor runs it. A customer chatbot, a credit model and a copilot in a browser are three rows. A spreadsheet named Final_v7 with no owner column is not finished. Shadow AI usually appears here: a team pasting customer text into a public tool nobody briefed.

An AI system that is already in production needs an owner, a purpose, and a record of how it was tested. If you cannot say those three things, the later steps are fiction.

2. Compare the file to the standard

Step two of the ISO 42001 certification process is a gap against clauses 4 to 10 and Annex A. Annex A has 38 controls, grouped from A.2 to A.10. The gap is a list of what would fail an auditor next month, not a maturity poster. Score what exists, not what a template promises.

ISO 42001 implementation fails when the Statement of Applicability is finished and the controls are not running. Do the gap before you write a stack of policies you will have to retract.

3. Freeze the scope

Step three of the ISO 42001 certification process fixes the legal entity, the sites, the headcount and the systems the certificate will name. One legal entity on the certificate is the usual starting point. A second city is a scope decision, not a detail you mention at Stage 2. Exclusions need a reason. “The organization” is not a scope. Name the boundary a stranger could draw on a map and on a system list.

If a new model goes live mid-project, ISO 42001 implementation needs a change to scope, not a footnote. NABCB scope is a check you do during the ISO 42001 certification process, not a logo you paste on the kickoff slide. NABCB, under QCI, accredits management-system certification bodies in India. Check the body’s current scope on the NABCB or IAF directory. This article does not name bodies. An accredited mark for ISO 27001 is not an AIMS mark.

4. Write policies and the Statement of Applicability

Step four of the ISO 42001 certification process is the policy set and the Statement of Applicability. The AIMS policy says what top management wants. The Statement of Applicability says which Annex A controls apply, which do not, and why. A one-line “not applicable” with no reason will not survive a sampling. Keep the policy short enough that a system owner will read it. Put the detail in procedures and in records.

A vendor who sells ISO 42001 implementation as a template pack will leave you with policies and no owners. Ask who writes. If the answer is only your team, you are buying advice. If the answer is a shared draft you will edit, say who owns the final text.

5. Assess risk and impact

Step five of the ISO 42001 certification process is the AI risk assessment and the AI impact assessment, with an owner on each. ISO/IEC 23894:2023 is the risk guidance. ISO/IEC 42005 is the impact-assessment guidance. You do not need a new slogan. You need a method: the system, the people affected, the foreseeable misuse, the control, the record.

Banks, NBFCs and other regulated entities should read the RBI FREE-AI committee report of 13 August 2025 as a board framework, not as a clause that makes ISO/IEC 42001 mandatory. Seven sutras, six pillars, 26 recommendations. Insurers are expected to govern AI in underwriting, pricing and claims. A hospital file will be asked about patient safety, clinical validation and consent. Banks should expect ISO 42001 implementation to include legal review of use cases. The FREE-AI report does not make the standard mandatory.

The EU AI Act has been in force since 1 August 2024. Most Annex III high-risk obligations have applied since 2 August 2026. ISO 42001 does not by itself create a presumption of conformity. A buyer may still ask for an evidence pack.

The DPDP Act, 2023, and the DPDP Rules, 2025, sit on the same calendar. As of 31 October 2026, Rules 1, 2 and 17 to 21 are in force. Rules 3, 5 to 16, 22 and 23 commence on 13 May 2027. Do not treat the full rulebook as already in force. DPDP duties that are not yet in force still belong on the ISO 42001 certification process calendar, with the real commencement dates written down. MeitY’s India AI Governance Guidelines, released 5 November 2025, are non-binding. They are not a statute.

6. Operate the controls

Step six of the ISO 42001 certification process is operating the controls, which means records exist before the auditor asks. Human oversight, logging, supplier review, data handling and a way to change a model without losing the history. A control that lives only in the Statement of Applicability is a sentence. Stage 2 samples the record.

Between those steps, the ISO 42001 certification process needs a person who can find a record in the room, not a shared drive named Final_v7. Shadow AI found in month four changes the ISO 42001 certification process because the scope and the impact notes have to move with it. Add the system, name the owner, or take it out of production. Do not leave it as a verbal aside.

7. Internal audit and management review

Step seven of the ISO 42001 certification process is an internal audit and a management review. The internal audit is yours. It is not the certification body’s visit. The auditor should be independent of the work they are checking. Management review is a meeting with minutes: what the audit found, what incidents or near misses say, whether the scope still matches production, and what resources the next quarter needs.

ISO 42001 implementation includes the internal audit. It does not include the certificate. ISO 42001 implementation produces records you keep after the consultant leaves. Ask who writes during ISO 42001 implementation. If the answer is only your team, the fee is advice, not delivery.

8. Stage 1, the documentation review

Step eight of the ISO 42001 certification process is Stage 1, the documentation review by the certification body. The auditor reads the scope, the policy, the Statement of Applicability, the risk and impact work, and the internal audit. They check that you are ready for a sampling visit. They are not there to co-author the file. Findings at this point are cheaper than findings in front of a live system.

Book the Stage 1 Stage 2 audit only after internal audit and management review have dates. The Stage 1 Stage 2 audit is two visits, not one long meeting. The certification body plans the Stage 1 Stage 2 audit from headcount, sites and the system count. If Stage 1 finds the scope is wrong, the Stage 1 Stage 2 audit slips, and so does the board date.

9. Stage 2, the implementation audit

Step nine of the ISO 42001 certification process is Stage 2, the implementation audit. The auditor samples systems, talks to owners, and follows a control from the Statement of Applicability to a record. A model with no owner becomes a finding in the room, not in a follow-up email you can postpone. During the Stage 1 Stage 2 audit, Stage 1 checks documents and Stage 2 samples live controls.

You can support the Stage 1 Stage 2 audit. You cannot sit in the auditor’s decision. Do not let a project plan call the Stage 1 Stage 2 audit a single milestone named certificate. A consultant can attend and can explain the system. A consultant cannot issue the certificate. A cheap quote that bundles the Stage 1 Stage 2 audit into the consulting fee hides the body’s invoice. Travel and multi-site sampling sit on the Stage 1 Stage 2 audit plan. The fee split, including 2026 market ranges for consulting and for the body’s invoice, is set out in the cost article. Those ranges are not a Seven Step rate card.

How long the nine steps take

The ISO 42001 certification process often takes three to six months, depending on size, AI maturity and how many systems are in scope. A focused firm can be audit-ready for Stage 1 in about 90 days, which is a point inside the ISO 42001 certification process, not the certificate. Do not accept a plan that compresses the ISO 42001 certification process into a promise of a certificate in 90 days. Readiness for a documentation review is not a certificate date the body has agreed.

The service page describes ISO 42001 implementation as a build that often takes three to six months. That is elapsed time when leadership shows up, not a guarantee. A bank or a multi-site GCC sits at the long end. A single-product firm sits at the short end.

Where the ISO 42001 certification process continues after the certificate

After the certificate, the ISO 42001 certification process becomes surveillance, then recertification around year three. A surveillance audit is part of the ISO 42001 certification process even though it is not one of the nine steps. After a clear Stage 1 Stage 2 audit, surveillance is the next invoice, often the following year. Annual surveillance is often around 40 percent of the initial audit fee, for two years. That is a market pattern on proposals, not a Seven Step fee.

If system count doubles, the ISO 42001 certification process in year three looks like a new build, not a short visit. Recertification is closer to Stage 1 and Stage 2 than to a courtesy call. Keep the inventory alive in the months between visits. A system that entered production with no owner will be the first sample.

Book the sequence, not a certificate date

Book a roadmap call. We will put your systems, your sites and your board date on the nine steps and show which records are missing. Use the contact page: https://www.sevenstepconsulting.com/contact-us/

Talk through the nine steps

If your board date is real, the sequence has to be real. Book a roadmap call. We will walk the nine steps against your system list so the ISO 42001 certification process has owners and dates, not a single milestone called certificate.