The short answer
Three to six months if you already hold ISO 27001. Six to twelve months starting from no management system. The difference is not the AI work — that is roughly constant — but whether clauses 4 to 10 already exist and have survived an audit.
| Starting point | Typical timeline | Why |
|---|---|---|
| ISO 27001 certified | 3–6 months | Extending an audited management system |
| ISO 27001 in progress | 4–8 months | Running both scopes through one build |
| No management system | 6–12 months | Building clauses 4–10 as well as the AI content |
Stage by stage
| Stage | Duration | What decides it |
|---|---|---|
| AI inventory and scoping | 2–4 weeks | How much undocumented AI turns up |
| Impact assessments | 2–6 weeks | Number of AI systems, not headcount |
| Gap assessment | 2–3 weeks | Whether a management system already exists |
| Implementation | 1–4 months | Data provenance maturity is the usual bottleneck |
| Internal audit and management review | 2–3 weeks | Mandatory, must precede certification |
| Stage 1 | 1 day, plus scheduling | Certification body availability |
| Stage 2 | 2–5 days, plus scheduling | AIMS scope and number of systems |
| Certificate issued | 2–4 weeks after Stage 2 | Technical review at the certification body |
The constraint that is not about you
The pool of certification bodies accredited for ISO 42001 is still small relative to demand. The standard was published in December 2023 and accreditation for it has been building since, which means scheduling Stage 1 and Stage 2 frequently takes longer than any part of your own preparation.
The practical consequence: approach a certification body early, before you are ready, to understand their lead time. A team that finishes implementation in month four and then discovers a three-month audit queue has an eight-month project regardless of how efficiently it worked.
This is different from ISO 27001, where the accredited pool is mature and scheduling is rarely the binding constraint.
What actually slows projects down
Discovering AI mid-project. The inventory finds models in features nobody catalogued, scope changes, and impact assessments multiply. Do the inventory first and thoroughly.
Data provenance. Area A.7 cannot be reconstructed retroactively. Organizations that never tracked where training data came from face real work, not documentation.
Impact assessments treated as risk assessments. Teams produce something that looks complete, an auditor points out it examines risk to the business rather than consequences for people, and the work is redone.
Internal audit deferred. Mandatory and a prerequisite. Scheduling it after certification is a Stage 1 finding.
How to compress it
Do the AI inventory in week one, before scoping. It is the input everything else depends on.
Approach certification bodies before you are ready, to get their lead time into your plan rather than discovering it late.
Run ISO 27001 and ISO 42001 together if you hold neither. One management system build, two scopes, and often a combined audit.
Start data provenance immediately if you train models. It has the longest lead time of any control area.
See ISO 42001 certification cost for what these stages cost, and ISO 27001 to ISO 42001 for the integrated route.
FAQs
How long does ISO 42001 certification take?
Typically three to six months for an organization already certified to ISO 27001, and six to twelve months starting from no management system. The AI-specific work is roughly constant; the difference is whether clauses 4 to 10 already exist and have been audited.
What is the biggest delay in ISO 42001 certification?
Certification body scheduling. The pool accredited for ISO 42001 is still small relative to demand since the standard was published in December 2023, so booking Stage 1 and Stage 2 frequently takes longer than preparation. Approach a body early to get their lead time into your plan.
How long do ISO 42001 impact assessments take?
Typically two to six weeks, driven by the number of AI systems in scope rather than by headcount. Each system in the AIMS needs its own documented assessment of consequences for affected people, and they must be revisited when systems change materially.
Can ISO 42001 be done faster if I have ISO 27001?
Yes, substantially. Both share the Annex SL structure, so the management system, internal audit programme and management review already exist and have survived an audit. You are adding AI-specific scope, impact assessments and life cycle controls rather than building a system from nothing.
What should I do first for ISO 42001?
An inventory of every AI system you develop, provide or use, including third-party models embedded in existing features. Scope, impact assessment and control applicability all depend on it, and an incomplete inventory is the most common cause of a project expanding mid-flight.
Where to go next
See what ISO 42001 costs, work through the checklist, or read ISO 42001 certification services.