ISO/IEC 42001
Management system standard for responsible AI, with Annex A controls and independent certification.
Service availabilityLinford & Company LLP is not currently accredited to perform third-party certification audits against ISO/IEC 42001:2023. This page describes the certification process Linford & Company will follow once accreditation is in place. We are in the process of completing the required steps toward accreditation. Until then, the service we offer for this standard is a gap assessment, and we do not issue unaccredited certificates. A gap assessment compares your management system with the standard and reports what we find. It does not include advice on how to close the gaps, and it is not a certification audit. Linford & Company LLP is an ANAB-accredited certification body for ISO/IEC 27001:2022 and ISO/IEC 27701:2025.
A holistic approach
The AI lifecycle
ISO/IEC 42001:2023 provides a framework for responsible AI management across the entire lifecycle. Our audits assess how your organization governs, manages, and controls AI risks at every stage, from planning through post-deployment monitoring.
Clauses 4 to 10 set out the required management system clauses, from context and leadership through performance evaluation and improvement. The standard's Annex A sets out 38 AI-specific reference controls, with implementation guidance in Annex B and AI-related objectives and risk sources in Annex C.
A broader context
Aligned with a global regulatory landscape
ISO/IEC 42001:2023 complements emerging frameworks and regulations, giving you one management system to show responsible AI governance.
EU AI Act
Regulatory requirements for AI systems in the EU, including risk management, data governance, transparency, human oversight, and monitoring.
NIST AI RMF
US risk management framework for trustworthy AI, organized around Govern, Map, Measure, and Manage.
Certification to ISO/IEC 42001:2023 does not, by itself, establish legal compliance with the EU AI Act, NIST AI RMF, or any other regulation.
A clear path forward
How certification will work once we're accredited
A structured, transparent two-stage audit, maintained through annual surveillance over a three-year cycle. Certification evaluates your AI governance and does not endorse any particular AI system, model, or vendor.
- 1
Application
Request an assessment and complete the application with Linford & Company.
- 2
Pre-certification and scoping
Confirm AIMS scope, AI systems in scope, and the audit start date.
- 3
Stage 1 audit
We evaluate the design of your AIMS, including the AI system inventory and impact assessment.
- 4
Stage 2 audit
We test lifecycle, data, oversight, and monitoring controls in operation.
- 5
Certification decision
Independent review and, when requirements are met, issuance of the certificate.
- 6
Surveillance and recertification
Annual surveillance audits, then recertification at the end of year three.
Certification details
Certification details and resources.
The certification activities Linford & Company performs, and the public information we make available.
Initial and Continuing Certification Activity
Based on the requirements of ISO/IEC 17021-1 and ISO/IEC 42006.
InitialApplication and pre-certification
Enter your organization's details in the form on this page. We then send you an application that gathers the scope information we use to determine technology expertise, staffing, level of effort (including auditor hours) and other scoping details. Return the completed application to isocompliance@linfordco.com or to your primary contact at Linford & Company. We perform client acceptance and impartiality review activities and, based on the results, you enter into an executed certification agreement with us.
InitialInitial audit planning
We request the necessary artifacts and confirm with you that the initial audit is ready to begin. The audit plan is communicated to you and audit dates are agreed in advance. The initial certification audit has two stages.
InitialStage 1 audit: design of the AIMS
We audit the documentation supporting the design of your AIMS and review its scope: personnel, AI systems in scope, your roles across the AI value chain, sites, and connected third parties. We confirm you have performed an internal audit, completed management reviews, and carried out AI risk assessment and AI system impact assessment consistent with the requirements of the standard. We then determine whether you are ready for Stage 2.
InitialStage 2 audit: implementation of the AIMS
Performed at your site(s) or through virtual meetings that show your development, deployment, and monitoring environments. We test AI policies, lifecycle controls, data quality, transparency, and information for interested parties, oversight of third-party AI components, and incident management. At the end of Stage 2 we determine whether to issue certification.
InitialGranting or refusing certification
When all certification steps are completed satisfactorily, we grant certification in the form of a certificate. The initial three-year certification cycle starts on, or reasonably soon after, the date of the certification decision.
If the client does not meet the requirements for certification, we communicate the refusal with enough detail on the rationale for the decision and the available next steps.
ContinuingSurveillance audits
Maintaining certification requires continuing certification activity, carried out through surveillance audits. We conduct surveillance audits at least once a year, except in recertification years. The first surveillance audit after initial certification must take place within 12 months of the certification decision date.
ContinuingMaintaining certification and recertification
Along with the surveillance audits, you are expected to operate your AIMS controls and processes in the manner understood during the initial audit. You retain certification by demonstrating ongoing conformity with the requirements of the management system standard. Recertification is performed at the end of the three-year cycle.
Public Information
In accordance with ISO/IEC 17021-1 §8.1, Linford & Company makes additional details publicly available in the companion “ISO/IEC 42001:2023 Certification: Detailed Public Information” PDF. It covers:
- Procedures for modifying the scope of certification
- Process for renewing and recertification
- Process for restoring certification
- Process for withdrawing certification
- Complaints process
- Appeals process
- Process for handling information requests
- Interested parties and impartiality policies
- Use of Linford & Company's name, certification mark, and references to certification
- Status of granted, suspended, and withdrawn certifications
Our leadership
Experienced. Independent. Focused on what matters.
- Ben Burkett
Partner
CPA, CISA, CISSP, CRISC, ISO 27001 Senior Lead Auditor, ISO 42001 Lead Auditor
More than twenty years of technology and audit experience that began at KPMG, focused on efficient, risk-based audits across SOC, HIPAA, and ISO.
- Lois Colby
Partner
CPA, CIA, CISA, CCSK, CMMC Lead Certified Assessor (Lead CCA), ISO 42001 Lead Auditor, ISO 27001 Lead Auditor
Partner since 2020 with a career that began at Ernst & Young in 1989, specializing in SOC, HIPAA, ISO, CMMC, and CSA STAR audits.
Frequently asked questions
Common questions
What is ISO/IEC 42001:2023?
ISO/IEC 42001:2023 specifies the requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). It is the first certifiable international standard for the governance of AI and applies to organizations of any size that provide or use AI-based products or services.
Is Linford & Company accredited to certify against ISO 42001?
Not yet. Linford & Company is not currently accredited to perform third-party certification audits against ISO/IEC 42001:2023. We are in the process of completing the required steps toward accreditation. Until then, the service we offer for this standard is a gap assessment, and we do not issue unaccredited certificates. A gap assessment compares your management system with the standard and reports what we find. It does not include advice on how to close the gaps, and it is not a certification audit. Linford & Company is an ANAB-accredited certification body for ISO/IEC 27001:2022 and ISO/IEC 27701:2025.
Does certification ensure legal compliance?
No. Certification does not, by itself, establish compliance with the EU AI Act or any other law. An AIMS that conforms to ISO/IEC 42001 can provide evidence that governance practices such as risk management, data governance, transparency, human oversight, and monitoring are in place.
Does certification endorse our AI models?
No. Certification does not endorse any particular AI system, model, or vendor. It evaluates how your AI management system governs the AI systems you build, buy, deploy, and depend on.
Do we need ISO 27001 before ISO 42001?
No. ISO/IEC 42001 is a standalone management system standard. Because it follows ISO's Harmonized Structure, it can be integrated with management systems you already operate, such as an ISO/IEC 27001 ISMS.
How do you maintain independence?
As a certification body, Linford & Company audits your AI management system and does not design, build, or operate it for you. Client acceptance includes an impartiality review, and certification decisions are made by people independent of the audit team.
How long is an ISO 42001 certificate valid?
Three years. Surveillance audits take place at least once a year, and recertification is performed at the end of the three-year cycle.
What affects the fee for an ISO 42001 audit?
The scope of the AIMS, the number of people working within it, the number and risk profile of AI systems in scope, your role across the AI value chain, the number of physical and virtual locations, and integration with other management systems already in place. We give you a specific quote before any audit engagement begins.
Ready to get started?
Talk with us about ISO/IEC 42001.
Register your interest and talk with a partner about your AI systems, your scope, and your timeline.