Recertification and Handling Major Changes to AI Systems
Recertification is the process of renewing your ISO 42001 certificate at the end of the three-year validity period. Recertification involves another full Stage 1 and Stage 2 audit with the same certification body (or a different body if you choose to switch). The scope of your recertification audit can remain the same as your existing certificate or can be updated to reflect changes in your operations.
Most organisations choose to recertify with the same certification body because the auditor already understands your business, your control framework and any issues that have arisen during surveillance audits. However, you are free to switch to a different certification body if you prefer.
Recertification audits follow the same process as your original certification. You will complete a readiness review, undergo Stage 1 (documentation) and Stage 2 (evidence) audits and close any findings. Some certification bodies reduce the scope of the readiness review for recertification because your basic structure is already in place. However, a full Stage 1 and Stage 2 audit is standard.
During recertification, the auditor will assess whether your management system remains effective and whether it has evolved appropriately. They will review all clauses of the standard again. They will examine your control evidence and test whether controls continue to operate. If your AI systems, organisational structure or regulatory environment have changed significantly, your recertification audit will be more substantial than a surveillance audit.
Scope Changes During Recertification
Recertification is an opportunity to expand or refine your scope. If you have deployed new AI systems since your original certification, you can include them in your recertification scope. If you have acquired other organisations, you can include their systems. If you have decided that some systems in your original scope no longer need to be covered (e.g., you have retired a system), you can remove them.
When you plan your recertification scope, be realistic about what you can demonstrate. A scope that includes many new systems or new regulatory domains may require a longer Stage 1 and Stage 2 audit than your original certification. Budget time and resources accordingly.
Handling Major Changes Between Certifications
Major changes to your AI systems can occur between surveillance audits or between your current certificate and recertification. Major changes might include deploying a significantly new type of AI system, changing a system’s purpose or user base, upgrading a system’s model or training data substantially or moving a system from development to production. If a major change occurs, you should notify your certification body and discuss whether an interim audit or scope extension is needed.
Some changes may not require immediate auditing if your existing controls are strong enough to address the new systems. For example, if you have been certified for generative AI systems and you deploy another generative AI system using the same methodology and governance process, your existing controls may apply. However, if you deploy a system that operates in a new regulatory domain or with fundamentally different data flows, you should request a scope extension audit to bring the system under certification.
If you discover during a surveillance audit that your controls have not kept pace with changes in your systems, the auditor will issue findings and require corrective action. This emphasises the importance of maintaining your management system proactively rather than waiting for audits to identify gaps.
Planning the Recertification Timeline
Plan your recertification 12 months before your certificate expires. This gives you time to address any issues identified during surveillance audits, to update your scope if needed and to schedule the recertification audit. Start discussions with your certification body about 9 months before expiration to confirm dates and to discuss scope changes.
If you are considering switching certification bodies for recertification, start that process even earlier. Interviewing new bodies, reviewing their quotations and setting up an engagement takes time. If you switch bodies, ensure that the new body’s auditor is familiar with ISO 42001 and ideally has experience with your sector or AI system types.
A key advantage of recertification planning is that you can reset and simplify your management system if you find that areas have become overly complicated or redundant. During the recertification process, you have an opportunity to retire outdated controls, consolidate procedures that have become duplicative or align your system more closely with your actual business operations. This is distinct from surveillance audits, which maintain continuity with your existing system.