What to expect from an audit
Purpose and scope
An audit examines evidence against agreed criteria and within a defined scope. This guide describes management-system certification, for example an AIMS under ISO/IEC 42001. It is not a universal AI Act procedure or a certificate awarded to a course participant. Certification does not guarantee that every AI system is legally compliant.
Typical certification stages
Stage 1: documentation and readiness
The auditor reviews the defined scope, documentation, understanding of requirements and readiness for Stage 2. Prepare the AI policy, system inventory, risk assessments, relevant training records, incident procedures and management review records. The output identifies readiness and issues to address before the next stage.
Stage 2: implementation and effectiveness
The auditor interviews relevant people, examines sampled records and observes whether the documented processes work. Expect questions about actual changes, incidents, decisions and corrective action. The output is an audit report containing findings against the criteria.
Illustrative planning ranges are 1–2 days for Stage 1 and 2–5 days for Stage 2, with preparation and remediation over weeks or months. They are not a quotation or certification guarantee; the certification body determines the actual programme from scope, complexity and applicable rules.
Findings and certification decision
| Finding | Meaning and next step |
|---|---|
| Major nonconformity | A significant management-system failure; correction and corrective action must be reviewed, accepted and verified before a positive certification decision |
| Minor nonconformity | A smaller departure; before a positive decision, the body must review and accept the plan for correction and corrective action; neither acceptance nor certificate issuance is automatic |
| Opportunity for improvement | Advice that is not itself a requirement or nonconformity |
| Positive finding | Effective practice observed within the audit scope |
The audit report and the certification decision are separate steps. A typical three-year certification cycle includes surveillance and recertification, subject to the scheme and maintaining requirements.
Prepare useful evidence
- Conduct an internal readiness review sufficiently early to remedy real gaps.
- Confirm document versions, scope, owners and links to operational evidence.
- Ensure relevant staff are available and understand their actual roles.
- Provide proportionate, controlled access to records and confidential information.
- Keep a record of findings, clarification and agreed follow-up.
Do not invent records or conceal gaps. Explain what works, what has not yet been implemented and how corrective action will be verified.
After the audit
Implement corrective actions within agreed dates, retain evidence of their effectiveness, complete required surveillance and reassess after material changes. A certificate does not replace ongoing management, regulatory assessment or system-specific conformity work.
Audit readiness · ISO/IEC 42001
Content reviewed: 6 September 2026. Primary sources: ISO/IEC 42001, Commission — standards and AI Act, AI Act.