ISO 42001 Audit and Certification Readiness

ISO/IEC 42001 certification readiness means being able to demonstrate that an AI management system is defined, operating and capable of addressing the organisation's actual AI activities. A folder of newly approved policies is a starting point. Readiness also requires credible evidence of decisions, responsibilities, implementation, review and improvement within the proposed certification scope.

This guide is for Saudi organisations preparing for an external certification process, especially groups with several business units and shared technology. It explains how to examine readiness without promising certification or inventing an official scoring system. The worked example is a hypothetical organisation whose customer operations and procurement teams use AI while a central technology function provides common model services.

Understand what the standard and certification address

ISO/IEC 42001:2023 specifies requirements for an AI management system. Its subject is how an organisation manages AI within scope. A readiness review should therefore examine the management system and its operation, while commissioning separate technical tests where evidence about a particular application is needed.

ISO explains that certification is voluntary and performed by independent certification bodies; ISO itself does not certify organisations. OpenForAI's readiness work should not be represented as issuing an ISO certificate. The certification body's assessment and decision remain separate from any preparatory review or remediation support.

Use a licensed copy of the standard and qualified interpretation for the organisation's detailed requirements assessment. The procedures below are original preparation suggestions, not a reproduction of the standard or a complete clause checklist. Do not invent clause wording from a public summary. Record the actual criteria used so a reviewer can distinguish a requirement from a consultant's recommended practice.

Write a scope statement that survives real operating questions

A scope should identify the organisational activities, locations and boundaries covered by the AI management system. In the hypothetical group, customer operations and procurement are proposed for inclusion. A research unit is initially excluded. However, the central technology team supplies a shared model gateway to all three. The exclusion of research does not make the shared gateway irrelevant to the included activities.

Map which services and decisions cross the boundary. Who selects model providers? Who approves a new use? Who manages incidents, data access and supplier changes? If those functions sit in a central department, explain how they support the scoped business units. A scope that names only the end-user teams can omit the people who control the most important dependencies.

Challenge exclusions using concrete scenarios. If research releases a shared component that procurement adopts, how does the management system assess that change? If an acquired subsidiary starts using the central gateway, who determines whether it falls inside the scope? The readiness review should examine the boundary decision and the process for revisiting it, rather than assume the original wording remains accurate indefinitely.

Keep the scope understandable to a customer reading the eventual certificate. Avoid an ambitious corporate description that implies coverage of every AI product when only a limited organisational activity is included. AI audit versus ISO 42001 certification explains how a certificate's scope differs from a technical audit conclusion about a named system.

Turn the AI inventory into evidence of management coverage

An inventory supports readiness only when it connects to decisions. For each scoped use, identify its purpose, owner, users, affected parties, data dependencies, suppliers, lifecycle status and relevant risk assessment. Include purchased AI features and embedded capabilities where they fall within the organisation's definition and scope. A list limited to projects with “AI” in their budget name can miss operational uses.

Reconcile the inventory against several authorised sources, such as procurement records, platform access, approved project registers and business-owner interviews. Differences need investigation. A subscription record is not proof that a tool is actively used, while an owner saying “we do not use AI” may overlook an enabled feature in an existing service. Document the evidence that resolves each discrepancy.

Then test whether an inventory change triggers the appropriate management activity. A newly added supplier capability may require a purpose decision, an assessment of affected people, staff competence or revised operating controls. The inventory should not be a passive spreadsheet updated just before the certification visit. The audit question is whether it helps the organisation recognise and govern relevant change.

Use an evidence ladder without turning it into a certificate score

The following original review tool distinguishes types of evidence. It is not an ISO maturity model or a certification pass threshold. A readiness assessor can use it to explain why an approved document may be necessary but insufficient for a claim about actual operation.

Original evidence ladder for an AI management-system readiness review

Evidence state	Example	What it supports	What remains to examine
Defined	A documented process for approving new AI uses	The intended method and responsibilities	Whether staff understand and follow it
Implemented	A configured intake route and assigned decision owners	The process has been put in place	Whether real cases use the route
Operated	Dated decisions for actual scoped use cases	The process was used in the examined cases	Coverage, consistency and exception handling
Evaluated	A review identifies delayed or incomplete decisions	Someone examined how the process performed	Whether the evaluation is credible and leads to action
Improved	A correction is implemented and its effect checked	The examined issue prompted verified change	Whether the change remains effective in relevant conditions

Do not require identical evidence volumes for every process. A recently introduced activity may have few operating records, which should be disclosed and assessed rather than manufactured. A mature process may have many records but still omit important use cases. The assessor should explain the evidence needed for the specific conclusion, and the certification body determines its own assessment requirements.

Worked trace: follow one AI change through the management system

Assume procurement wants to add an AI function that summarises supplier technical submissions. The central platform team proposes a model service already used by customer operations. The readiness review follows this single change across the management system. It asks whether the organisation connects purpose, responsibilities, risk, supplier decisions, testing, staff preparation and ongoing review in practice.

1. Identify the request and the approved intended use, including decisions the summary must not make.
2. Find the accountable business owner and the people responsible for assessing impacts and technical risks.
3. Trace the supplier and data decisions to the actual service configuration proposed for procurement.
4. Inspect the acceptance evidence and how unresolved limitations were presented to the decision-maker.
5. Confirm that staff received task-relevant instructions and know how to challenge an inaccurate summary.
6. Examine the release decision, subsequent feedback and any resulting corrective action.

The purpose of this trace is not to require one document per step. A well-designed record can connect several decisions. The important property is that a reviewer can see who decided what, using which information, before the relevant activity occurred. Retrospective meeting notes may explain an event but should not be backdated or presented as contemporaneous approval.

Suppose the supplier assessment covers customer conversations, while the new use involves confidential technical submissions and different users. The existing assessment may provide reusable information, but it does not automatically establish suitability for the new purpose. The readiness finding should identify the missing contextual decision rather than demand a completely new document merely for administrative consistency.

Follow a second, contrasting case if the first was selected by management as its best example. A rejected request, an urgent exception or a discontinued use can reveal whether the process works when the decision is difficult. Record the selection rationale and avoid describing two traced cases as proof of uniform operation across a large portfolio.

Examine risk and impact decisions for specificity

A risk record should explain a plausible event, the people or objectives affected, the conditions that make it possible and the controls intended to address it. “AI may hallucinate” is too broad to guide this procurement use. A more actionable scenario is that a summary omits a supplier's limitation, and a reviewer relies on the summary without checking the source before making a comparison.

The review should connect that scenario to evidence: source-linked summaries, clear limitations, reviewer access and a tested correction route. Ask whether the risk owner understood what the test demonstrated and what remained unknown. An accepted residual risk should identify the authorised decision-maker and the conditions for reconsideration. It should not be a signature attached to an unexplained score.

Impact considerations may extend beyond technical failure. Determine who could be affected by the system and how the organisation considered those effects in its own assessment. The readiness review can evaluate the completeness and operation of that process without claiming that it has independently resolved every legal, ethical or sector-specific question. Specialist reviews should have explicit owners and links to the management decisions they inform.

Look for competence at the point of responsibility

A training attendance list shows participation, not necessarily the ability to perform an assigned task. Ask a procurement reviewer to explain how they handle an unsupported summary. Ask a platform owner how they recognise a supplier change that affects scoped uses. Ask a decision-maker what evidence is required before accepting a limitation. Use these conversations to identify where supporting evidence is needed.

Competence should match responsibility. A person approving a business use need not reproduce every model test, but should understand its decision implications. A technical tester needs the relevant method and environment knowledge. The organisation should know when external expertise is necessary and how the resulting work is reviewed. Generic AI awareness alone does not establish every specialised capability.

Where a gap is found, define the expected capability and a way to verify it after support or training. For example, a reviewer might demonstrate that they can locate the underlying supplier passage, identify a contradiction and record a justified correction using a controlled case. This is a proposed practical exercise, not an ISO-prescribed examination or a universal training requirement.

Make internal review and management review decision-oriented

Readiness should include evidence that the organisation evaluates its own management system and that responsible leaders act on the results. Review the planned coverage, reviewer competence and any conflicts of interest. A team that wrote a process should not simply mark its own document complete and call that a comprehensive independent assessment. Independence and self-review need an explicit response appropriate to the purpose.

Examine whether review findings reflect the real scope. If every finding concerns document formatting while operating exceptions remain unexplored, ask how the review selected its evidence. If the portfolio changed significantly, ask whether the programme considered the new activities. The objective is meaningful challenge, not a large number of findings for its own sake.

Management review records should show inputs, decisions, responsibilities and follow-up. A slide stating that all risks are managed is less useful than a documented decision to restrict one use, fund a missing control or revise a supplier arrangement. Trace at least one decision forward to its action and evidence of completion. An unresolved item can be managed openly; concealing it damages the credibility of the readiness assessment.

Close gaps with evidence, and preserve unfinished work honestly

Classify readiness gaps by their practical effect: unclear scope, absent process, weak implementation, missing operating evidence or ineffective corrective action. This original classification helps choose the remedy. Writing a new policy will not by itself fix a process that staff cannot use. Collecting more screenshots will not resolve an ambiguous accountability decision.

Give each action an owner, intended result, dependency and closure evidence. A supplier-control gap may depend on procurement negotiation; a review-process gap may depend on assigning competent reviewers. Distinguish work completed from evidence awaiting evaluation. Where timing is uncertain, identify the dependency rather than promise certification within an arbitrary number of weeks.

Use remediation planning to sequence work and retesting where a behavioural claim needs verification. For management-system actions, the follow-up might examine subsequent decisions or review records rather than run a model benchmark. The method should fit the original gap, and the report should preserve the period over which the improved process has actually been observed.

Challenge management indicators with their underlying population

A readiness dashboard should help leaders understand the management system, not merely display completed documents. Suppose a hypothetical report says that all nine registered AI requests received an approval decision. Procurement records identify three further requests that should have entered the same process. The first percentage describes the registered subset, while the completeness question concerns twelve eligible requests. Resolve whether the extra three were genuinely in scope before changing the denominator, and retain the evidence for that decision.

This example does not prescribe a target approval rate. Some requests should be rejected or deferred, and a high approval percentage can be a poor measure of governance quality. More useful questions include whether eligible requests entered the process, whether the right decision-makers considered the relevant evidence, and whether unresolved conditions were respected after approval. Define each indicator so leaders know what it measures and what it omits.

Check how exceptions reach management. A report may show all actions closed because owners changed their status, while verification remains outstanding. Another may exclude overdue supplier-dependent work from its total. Ask for the rules used to produce the indicator and reconcile a selected set of items to their underlying records. A defensible report can show unfinished work openly while explaining its consequences and next decisions.

Finally, examine whether management used the information. A repeated indicator with no decision may be appropriate when performance is stable, but unexplained deterioration should prompt enquiry. Trace a material change in the indicator to the discussion and resulting action. The readiness conclusion then concerns a functioning management feedback process rather than the existence of a dashboard.

Select the certification body and agree the assessment conditions

Check the proposed certification body's relevant competence, scheme scope and accreditation claims with the appropriate source. ISO/IEC 42006:2025 concerns bodies auditing and certifying AI management systems. It should not be confused with a certificate for an individual model or a claim that any technical AI assessor is automatically a certification body.

Ask the body how it will determine assessment scope, required evidence, stages, locations, language arrangements and treatment of unresolved findings. Confirm the terms directly instead of assuming a generic timetable applies. The readiness provider can help organise evidence, but should not promise the certification body's decision or represent a preparatory review as that body's formal assessment.

For a bilingual Saudi organisation, ensure Arabic operating evidence is accessible to the assessment team and that translated summaries preserve meaning. The original decision record should remain identifiable. A polished English policy should not conceal that the actual Arabic procedure assigns different responsibilities. Resolve substantive inconsistencies before the assessment rather than treating translation as a cosmetic final step.

Prepare a readiness pack that reflects the real system

The pack should connect the proposed scope, AI inventory, responsibilities, applicable requirements, risk and impact decisions, operating procedures, review results and corrective actions. Use an evidence index with owners and dates instead of copying every record into an uncontrolled folder. Include known limitations and recent changes so the assessor can understand the organisation as it currently operates.

Conduct a final trace from a selected use case to its management decisions and back to the inventory. Check that the scope statement, supplier arrangement and actual configuration describe the same activity. Resolve contradictions or disclose them. Readiness is stronger when an organisation can explain a real exception and its response than when it presents a flawless-looking but disconnected document set.

An AI auditing and readiness engagement can examine this evidence before the external certification process. Request an ISO 42001 readiness scoping discussion with the proposed organisational scope, current inventory and assessment objective. The useful deliverable is a supported view of gaps and evidence readiness, with a practical route to improvement and a clear separation from the certification decision.