ISO 42001

How Long Does ISO 42001 Certification Take? A Realistic Timeline

A realistic, stage-by-stage timeline for ISO 42001 certification based on organization size and maturity, with the factors that speed up or slow down each phase.

Zofia Kubiak

April 25, 2026 · 7 min read

ISO 42001

Vendor marketing tends to quote the fastest possible timeline. Reality depends heavily on one factor most estimates gloss over: how long you actually operate the management system before the external audit, since auditors want evidence of real operation, not just documentation.

TL;DR

A realistic timeline breaks into five stages: gap analysis, building the AIMS, operating it, internal audit, and the external Stage 1/2 audits.
The 'operate' stage is the one most underestimated — auditors expect genuine operating history, not policies written the week before Stage 2.
Startups with no existing management system typically need 4-7 months; organizations with existing ISO 27001 often complete in 2-4 months.
Software shortens the gap analysis and documentation stages significantly, but cannot shorten the operating history stage — that time has to actually pass.
Rushing straight to Stage 1 without a genuine operating period is the most common reason for Stage 2 nonconformities.

Five Stages, Realistic Durations

Five stages, each with its own realistic duration — 'operate' is the one most timelines underestimate.

Timeline by Organization Type

Organization profile	Realistic timeline
Startup, no existing management system	4-7 months
Mid-size, existing ISO 27001	2-4 months
Enterprise, multiple business units	6-12 months

Why 'Operate' Is the Stage Everyone Underestimates

You can write a policy in a day. You cannot manufacture three months of internal audit history, management review minutes, and training records in a day. Auditors specifically check for evidence the AIMS has been running, not just documented — this is why the operating period can't be compressed the way documentation work can.

What Software Can and Can't Shorten

Can shorten: Gap analysis, document drafting, evidence organization, Statement of Applicability maintenance.
Cannot shorten: The operating period itself — time has to actually pass with the AIMS genuinely running.

What Actually Speeds Things Up

An existing ISO 27001 (or similar) management system to build on
A dedicated compliance lead rather than a part-time, shared responsibility
Starting the operating period early — even before documentation is 100% complete
Software that keeps evidence organized so nothing has to be reconstructed later

Primary Sources

ISO — ISO/IEC 42001:2023
NIST — AI Risk Management Framework

Running Stages in Parallel Where Possible

Not every stage has to be strictly sequential. Documentation drafting can often start before the gap analysis is 100% complete, and training can run alongside early operating-period activities rather than waiting for every policy to be finalized first. The stages that genuinely can't be compressed or parallelized are the operating period itself and the two external audit stages, which depend on real time passing and a certification body's schedule.

What Actually Extends the Timeline

No single owner — responsibility split across multiple people without one accountable lead
Waiting for perfect documentation before starting the operating period
Certification body scheduling delays, especially for less common accreditation combinations
Scope creep — adding more AI systems to the certification scope mid-project

A Milestone Checklist to Track Against

Gap analysis complete and signed off by the executive sponsor
AI policy, risk assessment and Statement of Applicability drafted and reviewed
Operating period begins — training run, first internal audit scheduled
Internal audit complete with findings remediated
Stage 1 scheduled and documentation package sent to the certification body
Stage 2 scheduled after a genuine operating history has accumulated

Where Unorma Fits

Speeding up what can be sped up

Unorma’s gap analysis and evidence vault compress the documentation stages so you can start your operating period sooner. See the complete ISO 42001 requirements checklist for what has to be in place.

Frequently asked questions

What's the fastest realistic ISO 42001 certification timeline?

Around 2-4 months for a mid-size organization with an existing ISO 27001 management system to build on — faster claims usually skip a genuine operating period.

Can software make certification happen faster than the operating period allows?

No — software speeds up gap analysis and documentation, but the operating period, where auditors expect real evidence of the AIMS running, can't be compressed since time has to actually pass.

Why do organizations fail Stage 2 audits on timeline-related issues?

Usually because they rushed to Stage 1 without a genuine operating history — internal audits, management reviews and training records need real time to accumulate, not just exist on paper.

Does having ISO 27001 already speed up ISO 42001 certification?

Significantly — much of the clause 4-10 infrastructure (policies, internal audit programs, management review) can be extended rather than rebuilt from scratch.

Can documentation and the operating period run at the same time?

Partially — training and early operating-period activities can start before every policy document is finalized, but the operating period itself still needs real time to pass regardless of how fast documentation is drafted.

What's the most common avoidable cause of timeline delays?

No single accountable owner — when responsibility is split across multiple people without one lead driving the project, momentum stalls even when the underlying work isn't actually that large.

What milestones should we track across the project?

Gap analysis sign-off, documentation drafted and reviewed, the operating period beginning, internal audit completion, Stage 1 scheduling, and Stage 2 scheduling once genuine operating history exists.

Does adding more AI systems mid-project always extend the timeline?

It usually adds some time for the new system's own gap analysis and evidence, but it doesn't have to derail the overall project if it's absorbed into the existing process rather than treated as a separate effort.

Should we set an internal deadline separate from the certification body's schedule?

Yes — an internal target date for completing documentation and starting the operating period keeps momentum independent of when you eventually book Stage 1 and 2 with the certification body.

Key terms in this article

About the author

Zofia Kubiak

Compliance Specialist

Compliance specialist focused on management-system standards and risk frameworks, helping teams turn certification requirements into working programs.

View full profile

Keep reading