An ISO 42001 certification timeline is often 3 to 6 months, depending on size, AI maturity and how many systems are in scope. A startup with a small inventory can be audit-ready for Stage 1 in about 90 days if leadership shows up. That is not a certificate. Banks and multi-site firms take longer.

People ask how long ISO 42001 takes and expect one number of weeks. There is not one. The ISO 42001 duration most proposals use is 3 to 6 months for the build. The certificate date also waits on a certification body. Seven Step Consulting does not issue ISO certificates. A consultant does not control the certificate date.

How long ISO 42001 takes is a function of system count, not of how polished the policy reads. A chatbot, a credit model and a vendor copilot are three systems. A spreadsheet named Final_v7 with no owner is not an inventory yet, and it will eat the ISO 42001 certification timeline until someone names it.

An ISO 42001 certification timeline by company size

Read the row that matches the systems you actually run. Do not average a startup with a bank and call that your ISO 42001 certification timeline.

ISO 42001 certification timeline by company size from gap review to Stage 2
Profile Calendar you can defend What usually slips it
Startup, one product, one site About 90 days to Stage 1 readiness if leadership shows up. The certificate often lands inside 3 to 6 months. The founder skips the inventory week
Mid-market, several AI systems Often 4 to 6 months Missing owners and extra impact notes
Bank, insurer, GCC, multi-site Often 6 months, and sometimes longer Sites, legal review, model risk

For a startup, how long ISO 42001 takes to reach Stage 1 readiness can be about 90 days. That sentence is readiness, not a certificate. Stage 1 is the documentation review. Stage 2 is the implementation audit. Both have to happen on the ISO 42001 certification timeline. For a bank, how long ISO 42001 takes is often longer than six months, because model risk, more sites and counsel show up before the auditor does.

ISO 42001 duration stretches when the inventory grows during the project. Freeze the system list at kickoff or the ISO 42001 certification timeline moves. A fixed ISO 42001 duration on a sales slide, with no system count, is not a plan.

What the weeks are actually for

ISO/IEC 42001:2023 is the AI management system, the AIMS. Clauses 4 to 10 are the cycle. Annex A has 38 controls, from A.2 through A.10. The Statement of Applicability records which apply and why. An AI risk assessment and an AI impact assessment are tasks with owners. ISO/IEC 23894:2023 guides the risk work. ISO/IEC 42005 guides the impact work. None of that is a weekend if the model is already in production.

An AI system that is already in production needs an owner, a purpose, and a record of how it was tested. If the model has no owner, the ISO 42001 certification timeline has not started. You are still making a list.

A sensible sequence is a gap review, then the build, then an internal audit, then Stage 1, then Stage 2. A gap review in 2026 India market ranges often sits between ₹1.5 lakh and ₹4 lakh. That is not a Seven Step fee. The build for a startup or single-product firm often sits between ₹4 lakh and ₹8 lakh in the same market ranges. Mid-market work with several systems often sits between ₹8 lakh and ₹15 lakh. A bank, insurer, GCC or multi-site firm often sits between ₹15 lakh and ₹30 lakh, and sometimes more. The certification body invoices Stage 1 and Stage 2 separately, about ₹2 lakh to ₹8 lakh, driven by headcount and sites. Staff time is the cost people forget.

Do not quote an ISO 42001 duration that ignores those staff weeks. Engineers who cannot attend the sample will move the ISO 42001 certification timeline.

What pushes an ISO 42001 certification timeline past six months

Scope creep is the usual slip. Someone adds a model in month four and the Statement of Applicability is stale. Shadow tools do the same job quietly. The copilot bought on a card, used on customer text, belongs on the list. Leaving it off makes the ISO 42001 certification timeline look short and fail Stage 2.

Leadership absence is the second slip. A focused firm can be audit-ready for Stage 1 in about 90 days only if leadership shows up. If the sponsor reads the pack the night before, the ISO 42001 certification timeline was a wish.

The body’s diary is the third slip. You can be ready and still wait for audit days. Check current scope on the NABCB or IAF directory before you book. NABCB, under QCI, accredits management-system certification bodies in India. This article names no bodies. An accredited ISO 27001 mark is not an AIMS mark, and an ISO 27001 program does not set the AI calendar by itself.

Ask how long ISO 42001 stays in surveillance after the certificate, and also how long the build runs. A surveillance audit is often around 40 percent of the initial audit fee, for two years, then recertification around year three. That is a market pattern, not a Seven Step fee. Surveillance is part of the real ISO 42001 duration even though it sits after the certificate.

The DPDP Act, 2023, can add preparation if personal data sits in training sets, prompts or outputs. As of 31 October 2026, Rules 1, 2 and 17 to 21 are in force. Rules 3, 5 to 16, 22 and 23 commence on 13 May 2027. Do not treat the full rulebook as already in force, and do not pretend it has no effect on the file. The EU AI Act is a separate clock for exporters. It does not, by itself, lengthen every Indian project. It does lengthen the evidence pack when a European buyer is the reason you started.

Get a plan tied to your system count

Get your project plan before you put a month on the board slide. We will mark Stage 1 readiness, Stage 2, and the weeks your own people must attend, so the ISO 42001 certification timeline matches the inventory. Write through the contact page: https://www.sevenstepconsulting.com/contact-us/

Put the date next to the system list

If the board wants a month, give them the row that matches your size. Get your project plan. We will write the ISO 42001 certification timeline against the systems in scope, not against a generic 90-day poster.