Work through this honestly. The value is in the answers you are not comfortable giving, and an optimistic self-assessment produces a plan that is wrong in exactly the places it matters.
Each item is phrased the way an auditor would probe it. Where the honest answer is "we have a document", ask whether you have evidence of it operating, which is what Stage 2 actually samples.
4. Context of the organisation
- Have the external and internal issues relevant to your AI activities been identified and written down?
- Have interested parties been identified, including the people your AI systems affect, not only customers and regulators?
- Is the scope of the AI management system defined, and does it name the AI systems in it?
- The auditor's version: can you show me an AI system that is in scope, and one that is out, and explain why?
5. Leadership
- Has top management approved an AI policy, and can you show the approval?
- Is there a named individual accountable for AI risk, with the authority to stop a deployment?
- Are AI responsibilities allocated across the lifecycle - who proposes, assesses, approves, monitors?
- The auditor's version: who signed off on this system going live, and what did they see before they did?
6. Planning
- Is there a documented methodology for assessing AI risk, and has it been applied?
- Have AI system impact assessments been completed for systems that affect people, before deployment?
- Are objectives for the AI management system defined and measurable?
- Has the applicability of each Annex A control been determined, with justification for any exclusion?
- The auditor's version: show me the impact assessment for this system, and show me it predates the release.
7. Support
- Are the competences needed to govern AI identified, and do the people holding those roles have them?
- Are staff aware of the AI policy and what it requires of them?
- Is documented information controlled - versioned, approved, and retrievable?
- The auditor's version: pick a member of staff at random and ask what the AI policy says.
8. Operation
- Is there an operational process controlling how AI systems are developed, procured and deployed?
- Are data management procedures defined - provenance, quality, labelling, lineage?
- Is model and supplier provenance documented, including third-party models?
- Is there human oversight of AI-driven decisions, defined proportionately to impact?
- Is there a process for AI incidents specifically, distinct from general IT incidents?
- The auditor's version: what happens when this model produces a wrong answer that affects someone?
9. Performance evaluation
- Is AI system performance monitored against the objectives set in clause 6?
- Has an internal audit of the AI management system been completed, by someone independent of the activity audited?
- Has a management review been held, minuted, with decisions recorded?
- The auditor's version: show me the internal audit report and what changed as a result.
10. Improvement
- Are non-conformities recorded, with root cause and corrective action?
- Is there evidence of the management system being improved rather than only maintained?
Scoring it honestly
Count only the items where you have evidence of operation, not a document describing intent. A document with no operating record fails Stage 2 reliably and is the single most common cause of a delayed certificate.
If you score above roughly seventy per cent on that basis, a certification programme is realistic within four to seven months. Below forty, the honest sequence is to build the governance layer first and treat certification as the second phase rather than the frame for the first.
The ISO 42001 reference page sets out the full certification path with realistic durations, and the EU AI Act scope checker tells you which obligations sit behind this if you want a score in four minutes rather than an afternoon.
Before any of this, check whether the EU AI Act reaches you
ISO 42001 is voluntary. The EU AI Act is not, and its obligations land on a fixed timetable regardless of whether you certify. The EU AI Act scope checker works out in six questions which parts of the Act apply to your organisation and the date each one takes effect, so you know whether the certification programme has a legal deadline sitting behind it or is purely a commercial decision.