How to Get ISO 42001 Certified — Step by Step

ISO 42001 guides: Overview · Requirements · Cost · How to get certified

Last updated: 10 July 2026 · Reviewed by Ann Reyes, Lead Auditor (Davao)

Philippine organizations reach ISO/IEC 42001 certification in three to six months — fastest on top of an existing ISO 27001 system, longer where AI governance starts from a blank page.

The 7 steps

1. Inventory the AI. Every system in scope — built, bought or embedded in SaaS — with purpose, data and decision consequence. Most organizations find more AI than they expected; that discovery is the project’s first deliverable.
2. Gap assessment. Current governance against the 42001 requirements and Annex A controls, producing the plan and the honest budget.
3. Risk and impact assessments. Per consequential system: organizational risks, then effects on people — bias, transparency, safety, privacy. The workshops that make or break audit credibility.
4. Build the AIMS. AI policy, accountability assignments, life-cycle procedures, human-oversight arrangements, supplier AI requirements, Statement of Applicability.
5. Train and operate. AI owners and operators trained; the system run for two to three months, generating monitoring records, review decisions and — inevitably — the first governed incidents.
6. Internal audit and management review. Close gaps while they are cheap.
7. Certification audit. Stage 1 and Stage 2 with an accredited body — confirm your CB’s ISO 42001 accreditation status when scheduling, as capacity is still rolling out through 2026.

What auditors probe hardest

Whether the inventory is complete (shadow AI is the classic finding) · impact assessments with real analysis behind them · human oversight that demonstrably functions · supplier AI controls beyond contract boilerplate.

What the project feels like, week by week

What the ISO 42001 project actually feels like, week by week, is worth knowing before you start — because the calendar’s shape is where expectations and reality usually diverge. The opening weeks are diagnostic and fast: gap assessment, findings, a plan with names and dates on it. The middle stretch is the grind that determines everything: process owners closing gaps between their day jobs, documentation drafted and corrected against reality, training that has to land with people who have production targets. AI projects begin with discovery: most organizations find more AI in production than they knew, and governance of an incomplete inventory is fiction. The final weeks accelerate again — internal audit, findings closed, management review, then the external audit that feels almost routine because everything in it was rehearsed. Projects stall in the middle stretch, always: not from difficulty but from divided attention, which is why our engagement model keeps momentum with scheduled milestones rather than open-ended support.

The failure patterns — and the vaccine

Three failure patterns account for nearly every troubled ISO 42001 attempt we are called to rescue, and all three are preventable in week one. The audit-week system: built for inspection rather than operation, it collapses under the first real interview because staff cannot describe procedures they have never used. The orphaned project: launched with energy, starved of a genuine owner, drifting until the target quarter quietly slips — twice. The template transplant: documentation describing a fictional company, guaranteeing that records contradict procedures, which is precisely how nonconformities get written. The common vaccine is unglamorous: build on real practice, name a real owner, and audit yourselves honestly before anyone external does. That is our method stated plainly — and it starts with a gap assessment.

Running this alongside daily operations without breaking either

The question every Philippine SME asks before starting ISO 42001: can we absorb this without dropping production or clients? Yes — if the project respects three design rules our engagements enforce. Load follows the calendar’s shape: heavy consultant weeks are scheduled around your busy cycles, month-end closes and peak seasons named at kickoff, not discovered mid-project. Work packages fit into real diaries: two-hour process-owner workshops beat all-day marathons that get postponed twice and resented once held. And documentation drafting sits with us in first pass — your people correct reality into drafts rather than facing blank pages after their shifts. Under those rules, typical internal load runs a few hours weekly for the champion and less for everyone else, with two heavier pulses at gap-closing and internal-audit weeks. The alternative — an unmanaged project colliding with operations — is where timelines quietly die. Ask for the workload map with your gap assessment; you should see the whole cost, in hours, before you commit.

A final word from practice

After sixteen-plus years preparing Philippine organizations across every discipline this site covers, the pattern behind successful outcomes in ISO 42001 certification in the Philippines is unglamorous and consistent: start earlier than feels necessary, assess before deciding, build on real practice, and keep the system alive after the credential arrives. Organizations that follow it experience audits as formalities and revisions as calendar entries; organizations that don’t fund the rescue industry. Whichever category your current state resembles, the first step is identical — an honest assessment — and it is a week, not a commitment. +63 977 815 1204 reaches a consultant, not a call tree.

Start with certainty: a one-week gap assessment tells you the true distance, cost and timeline — request yours.