ISO 42001 is the world's first AI Management System (AIMS) standard. For Indian AI teams selling into EU/UK/US enterprise, it is rapidly becoming the procurement gate. This is the step-by-step roadmap from zero to a certified AIMS — what to implement, in what order, and what each stage actually costs.
- ISO 42001 certification
- Third-party certification by an accredited body that an organisation operates an AI Management System conforming to ISO/IEC 42001:2023 — covering governance, AI risk, lifecycle controls, third-party AI, and impact assessment. Issued after a two-stage audit (Stage 1 documentation review, Stage 2 implementation audit).
- Realistic timeline: 4–7 months from kickoff to Stage 2 audit pass.
- Six-phase roadmap: scope → policy → risk register → controls → internal audit → certification.
- Mandatory artefacts: AIMS policy, AI risk register, AI impact assessment, third-party AI register, incident runbook.
- Budget: ₹6–18 lakh for a small Indian AI team incl. certification body fees.
- Validate each artefact with a ₹1,799 guided audit before Stage 1.
Phase 1 — Scope and gap assessment (weeks 1–3)
Define the AIMS scope: which AI systems, which business units, which data flows. Run a gap assessment against the 38 ISO 42001 Annex A controls. Most Indian AI teams start with a 40–60% gap; the goal of Phase 1 is a written gap register and a prioritised remediation plan signed off by the board sponsor.
Phase 2 — Policy and governance (weeks 3–6)
- AIMS policy signed by the CEO or board.
- Roles & responsibilities matrix (AI owner, risk owner, data owner).
- Decision rights for model deployment, model retirement, and incident escalation.
- Quarterly management review cadence — annual-only fails Stage 2.
Phase 3 — AI risk register and impact assessment (weeks 6–10)
Build a 12-category AI risk register scored on likelihood × severity × detectability. For every production AI system, complete an AI impact assessment (AIIA) covering intended use, affected stakeholders, fairness, transparency, and residual risk. The AIIA template should mirror ISO 42001 Annex A.6 and align with EU AI Act Article 27 so the same artefact serves both audiences.
Phase 4 — Lifecycle and third-party controls (weeks 10–14)
| Control family | What to ship | Common gap |
|---|---|---|
| A.4 Policies | AIMS policy + sub-policies (data, third-party AI, model release) | No sub-policy for third-party AI |
| A.5 Internal org | Roles, decision rights, board oversight | No board-level AI owner |
| A.6 AI lifecycle | Per-system AIIA, model card, release checklist | Model cards absent for older systems |
| A.7 Data | Provenance, quality, retention, consent register | Training data lineage gaps |
| A.8 Third-party | Third-party AI register, contract clauses, renewal cadence | Shadow LLM use not tracked |
| A.9 Incidents | Runbook for model failure, breach, misuse + drills | No table-top exercise on record |
Phase 5 — Internal audit and management review (weeks 14–18)
Run a full internal audit against all in-scope controls. This is the single most common failure point: teams skip the internal audit and walk into Stage 2 with unresolved nonconformities. Use a ₹1,799 guided audit per frame to dry-run each control family, then convene a management review meeting with documented minutes, action items, and owners.
Phase 6 — Certification body audit (weeks 18–24)
- Stage 1: documentation review by the certification body (1–2 days).
- Address Stage 1 findings (typically 2–4 weeks).
- Stage 2: implementation audit on-site or remote (3–5 days).
- Resolve nonconformities; certificate issued (typically 4–8 weeks after Stage 2).
- Surveillance audits annually; recertification every 3 years.
Realistic budget for an Indian AI team
| Line item | Small team (≤25) | Mid team (25–150) |
|---|---|---|
| Internal effort (4–7 months partial allocation) | ₹3–6 lakh | ₹8–14 lakh |
| Guided audit dry-runs (₹1,799 × 12 frames) | ₹21,588 | ₹21,588 |
| Certification body fees (Stage 1 + Stage 2) | ₹2–4 lakh | ₹4–8 lakh |
| Annual surveillance audit | ₹1–2 lakh | ₹2–4 lakh |
| Total year-1 outlay | ₹6–12 lakh | ₹14–26 lakh |
Frequently asked
- How long does ISO 42001 certification take?
- For a small-to-mid Indian AI team, plan 4–7 months from kickoff to a Stage 2 audit pass — split as ~3 weeks gap assessment, ~3 weeks policy, ~4 weeks risk register and AI impact assessments, ~4 weeks lifecycle and third-party controls, ~4 weeks internal audit, then 6–8 weeks of certification body engagement. Teams that skip the internal audit add 4–8 weeks resolving Stage 2 nonconformities.
- How much does ISO 42001 certification cost in India?
- A small team (≤25 people) typically spends ₹6–12 lakh in year one: ₹3–6 lakh internal effort, ₹21,588 in ₹1,799 guided audits across 12 frames, ₹2–4 lakh certification body fees, and ₹1–2 lakh annual surveillance. Mid-sized teams (25–150) run ₹14–26 lakh. Recertification is every three years.
- Is ISO 42001 mandatory in India?
- No — it is voluntary. But it is rapidly becoming a procurement gate for selling AI into EU, UK and US enterprise, and a credible governance signal for Indian regulators and large buyers. Most Indian AI teams now pursue it because the alternative is losing enterprise deals.
- What are the mandatory ISO 42001 artefacts?
- AIMS policy signed by the CEO or board, a 12-category AI risk register, a per-system AI impact assessment, a third-party AI register, an incident response runbook, and quarterly management review minutes. Annex A control families A.4–A.9 dictate the floor — A.6 (lifecycle) and A.8 (third-party AI) are where Indian teams most often have gaps.
- Who can act as lead auditor on ISO 42001?
- Only ANSI/ABICB-certified ISO 42001 lead auditors can sign off certification. Dr. Nitnem Singh Sodhi is lead auditor of record at Bharat NeuroTech on ISO 42001, 27001 and 27701 — the ₹1,799 guided audits use the same control map a Stage 2 lead auditor uses, so dry-run findings translate directly to certification body findings.
- Can I do ISO 42001 and DPDP together?
- Yes — they share data governance and AI impact assessment artefacts. The pragmatic path is to scope both in one programme: ISO 42001 covers AI governance and lifecycle, DPDP covers personal-data fiduciary duties. The 4–7 month ISO 42001 timeline accommodates DPDP if you reuse the consent register and DPIA template across both.
Dry-run your ISO 42001 readiness in 30 minutes.
Run a ₹1,799 guided audit on the ISO 42001 frame and get a per-control gap report you can hand to your certification body.