Auditing AI systems
ISO/IEC 42006:2025 — Information technology. Artificial intelligence. Requirements for bodies providing audit and certification of artificial intelligence management systems
ISO/IEC 42006:2025 states the requirements a body must meet to audit and certify an AI management system. It is not a standard organisations implement; it is the one that decides who may issue their certificate, and it answers the question people actually ask — what makes a certification body competent to certify ISO/IEC 42001.
§ 1 — Who it binds
Who this binds, and who only buys from them
Certification body
Bodies providing audit and certification of AI management systems. It states requirements for them and reaches nobody else directly — an organisation seeking certification is not assessed against it, and an internal audit function is not bound by it at all. It becomes relevant to both as the specification a buyer can hold a prospective certification body to.
§ 2 — In practice
Impartiality, competence, and who signs the decision
The first thing to be clear about is who the standard binds. Its title says so: requirements for bodies providing audit and certification of artificial intelligence management systems. An organisation building an AI management system does not implement 42006 and cannot be assessed against it. A certification body does, and an organisation choosing between certification bodies is choosing between organisations that either meet it or do not. That makes 42006 a procurement document for the buyer far more than a technical one, and the questions it licenses a buyer to ask are specific: who decides, who audits, what makes them competent, and what happens when the body has a commercial interest in the answer.
Clause 5 carries the general requirements, and 5.2, management of impartiality, is the one with commercial consequences. Where a body also advises on the management systems it certifies, the threat to impartiality is structural rather than a question of anyone’s integrity, and the clause does not let it be answered by declaration. What a body has to be able to show is an analysis naming the threats it faces and the safeguards applied to each — a different artefact from a policy asserting independence, and a much easier one for a buyer to test. Clause 5.1 covers legal and contractual arrangements and 5.3 liability and financing, which together answer a question buyers rarely ask: what stands behind the certificate if it turns out to be wrong.
Clause 7 is the resource clause and it is where the standard does its most specific work. Competence of personnel sits at 7.1; personnel involved in the certification activities at 7.2; external auditors and technical experts at 7.3; personnel records at 7.4; outsourcing at 7.5. The structure is worth reading whole, because it says that competence is held per role and evidenced per person, and that bringing in an outside expert is a recognised route rather than an admission. The same question, asked by an internal audit function that no standard obliges, is auditor competence for AI audits.
Clause 9 sets the process requirements, and reading its sub-clauses in order tells you what a certification consists of: 9.1 pre-certification activities, 9.2 planning audits, 9.3 initial certification, 9.4 conducting audits, 9.5 the certification decision, 9.6 maintaining certification, 9.7 appeals, 9.8 complaints, 9.9 client records. The separation to notice is between 9.4 and 9.5. Conducting the audit and deciding the certification are distinct activities, and the second is not a formality performed by whoever did the first. For a buyer that is the most testable item on the list — ask who signed the decision, and whether they were on the audit team. Clauses 9.7 and 9.8 matter for a different reason: a body that cannot describe how an appeal against its own decision is handled has not thought about being wrong.
Finally, the boundary. A certificate issued against ISO/IEC 42001 attests that a management system met the standard’s requirements at a point in time. It is not an audit of any particular model, it does not attest that a system performs as claimed, and it is not a conformity assessment under any regulation. The statutory route is separate and mostly involves no third party at all — under the EU AI Act most high-risk systems on the Annex III route are assessed by the provider itself, as Annex VII notified body evidence sets out. The two are commonly conflated, usually in the direction of believing a certificate discharges a regulatory obligation. It discharges none of them, which is not a criticism of certification — it is what certification is for.
§ 3 — What a weak answer looks like
An impartiality policy with no threats in it
An impartiality policy that names no threats. It is a page of principles, signed by a director, asserting that decisions are free from commercial influence, and it would read identically at a body with a large advisory practice and at one with none. What clause 5.2 contemplates is a body that has looked at its own arrangements, found the threats in them, and applied something specific to each. A buyer who reads only the policy learns whether the body can write; a buyer who asks for the analysis learns whether it has looked.
§ 4 — What discharges it
What a certification body has to be able to show
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
The impartiality threat analysis under 5.2, with named threats
Threats identified by relationship — advisory work, ownership, shared personnel, fee dependence on one client — each with the safeguard applied to it. A declaration of independence that names no threat cannot be tested by anyone.
02
A per-client justification of the audit time planned
Clause 9.2 covers planning audits. What a buyer looks for is the reasoning behind the days allocated to a specific client — scope, sites, and the complexity of the AI systems in scope — recorded before the audit rather than reconstructed after it.
03
A competence file per role, under 7.1
Held by role rather than by person, so a change of staff becomes a question about whether the role is still covered. For AI management systems the role definitions are where a body shows what it thinks the work requires.
04
External auditor and technical expert engagement records, under 7.3
Who was used, for what, and on what terms — including whether they may take part in a decision or only inform it. Relying on contracted expertise is not irregular, provided the reliance is bounded and written down.
05
The certification decision record, showing who decided
Under 9.5 the decision is its own step. The record that matters names the decision-maker and establishes that they did not conduct the audit under 9.4. This is the cheapest thing a buyer can ask for and the one most likely to be missing.
06
Outsourcing agreements under 7.5, and what they cover
Which parts of the certification activity are performed by another party, under what controls, and how their competence is assured. Outsourcing is permitted, and it is the arrangement least visible to the organisation buying the certificate.
§ 5 — Worked example
Worked example — advising and certifying the same client
A consultancy has spent nine months building a client’s AI management system: it wrote the policy, ran the risk and impact assessments, and trained the internal audit team. It also owns a certification arm, legally separate, with its own auditors and its own managing director. It offers the client a certification audit at a discount reflecting the work already done.
What would a body meeting 5.2 have to be able to show here?
Not a statement that the two entities are separate, which is the answer usually given and is a description of the arrangement rather than an assessment of it. Clause 5.2 is about managing threats to impartiality, so the artefact is an analysis naming the threats this specific engagement creates — self-review of work the group performed, financial interest in a continuing relationship, familiarity between teams that have worked alongside each other for nine months — and stating the safeguard applied to each. The discount is itself a fact the analysis has to address, because pricing that reflects the advisory work makes the two engagements commercially one. Whether the arrangement survives that analysis is a judgement for the body, and one it has to be able to defend. What is not open to it is treating legal separation as the whole answer. The client can ask to see the analysis, and the response to that request tells them most of what they need to know.
§ 6 — Elsewhere
Certification and conformity assessment are not one event
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
Certification against ISO/IEC 42001 is voluntary and addresses an organisation’s management system. The AI Act’s conformity assessment is statutory and addresses a system, and Article 6 is what determines whether it is engaged at all.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 7 — When it applies
Current edition, and what the date means
31 July 2025
BSI adoption, published as BS ISO/IEC 42006:2025 and identical to ISO/IEC 42006. A current-edition date for a voluntary standard, not a compliance deadline. ISO’s own publication date is not asserted here because it could not be verified.
§ 8 — provenance
The provision itself
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
§ 9 — Also read
Also read
Annex VII — notified body access to evidence
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.