An ISO 42001 nonconformity is the non-fulfilment of a requirement, found by an auditor in an AI management system (AIMS) and backed by evidence. ISO/IEC 42001:2023 defines the term but does not grade it. Certification bodies grade nonconformities as major or minor under ISO/IEC 17021-1, and the audit report carries each one to the certification decision.
Auditors who must write those findings are the readers the Global AI Certification Council (GAICC) had in mind here. The page covers what counts, how to word a finding, how to grade it and what happens after the closing meeting. Findings classification and reporting sit inside the scope of what the Lead Auditor exam covers. The examples below are illustrative and built from the structure of the standard.
What counts as a nonconformity
A nonconformity exists when the evidence shows a requirement is not met. ISO/IEC 42001 defines it in clause 3.16 as non-fulfilment of a requirement, and ISO 19011:2026 and ISO/IEC 17021-1 use the same definition. Everything turns on the word “requirement”.
The 2026 edition of ISO 19011 defines a requirement in clause 3.24 as a need or expectation that is stated, generally implied or obligatory. In an AIMS audit, three kinds of requirement can be broken.
| Source of the requirement | Example in an AIMS | How the finding reads |
| ISO/IEC 42001 itself | Clause 4.3 says the scope shall be available as documented information | Nonconformity against the clause |
| The organization’s own AIMS | A procedure says every model retraining triggers an impact reassessment | Nonconformity against the procedure, tied to the clause it serves |
| Legal or contract duties the AIMS covers | A customer contract requires notice before a model change | Often worded as non-compliance, per ISO 19011:2026 clause 3.8 Note 1 |
Two limits keep findings honest, and both come from the definitions. A nonconformity needs evidence, so an auditor’s worry without a record or observation is no finding. And it needs a requirement, so a practice the auditor dislikes, inside a requirement that is met, can at most be an opportunity for improvement.
A risk is a different thing. ISO 19011:2026 notes that audit findings can lead to the identification of risks, and an auditor may well spot one, such as a model likely to drift. Until a requirement actually fails, that risk belongs in the report as a risk or an opportunity for improvement. Write it as a nonconformity only when the evidence shows the gap.
Some audit forms say “nonconformance”. ISO/IEC 42001, ISO 19011:2026 and ISO/IEC 17021-1 all use “nonconformity”, and this guide follows them.
Major, minor, opportunity for improvement and observation
Certification bodies sort audit findings into grades, and only two grades are nonconformities. ISO/IEC 17021-1 defines major and minor nonconformities in clauses 3.12 and 3.13. Opportunities for improvement are allowed in clause 9.4.5.2. “Observation” appears in no definition clause, yet some certification bodies use it, and European Accreditation has answered a question on the practice.
| Grade | Meaning | Source | Before the certification decision |
| Major nonconformity | A nonconformity that “affects the capability of the management system to achieve the intended results” | ISO/IEC 17021-1, 3.12 | Correction and corrective action reviewed, accepted and verified |
| Minor nonconformity | A nonconformity that does not affect that capability | ISO/IEC 17021-1, 3.13 | The client’s plan for correction and corrective action reviewed and accepted |
| Opportunity for improvement | A point where practice could improve, with no requirement broken | ISO/IEC 17021-1, 9.4.5.2 | Nothing required |
| Observation (certification body term) | In the scheme European Accreditation reviewed, a finding that could lead to a nonconformity in future | European Accreditation FAQ 39.1 | Nothing required; in that scheme, the next audit examines the response |
The definition of a major carries a note, reproduced in the EU Agency for Railways’ terminology entry for ISO/IEC 17021-1. A nonconformity can be major where there is significant doubt that effective process control is in place. The same applies to doubt that products or services will meet specified requirements. Several minors on the same requirement or issue can show a systemic failure and so make a major.
European Accreditation’s FAQ on findings classification settles two practical questions. A certification body may use “observation” if its auditors can clearly tell observations apart from opportunities for improvement. And a finding that is a nonconformity must never be recorded as an opportunity for improvement, whatever the label.
How the grades differ in an AIMS
The same clause can produce any grade, so the evidence decides. Take clause 6.1.2 on AI risk assessment. A register that is current except for one outdated entry is a likely minor. No defined risk criteria at all, so that no two assessments can be compared, puts the whole risk process in doubt and is a likely major. A register that works but is hard to read is an opportunity for improvement. And a register due for review next month, with no review booked yet, might be logged as an observation by a body that uses the term.
Who grades a finding, and under which rules
ISO/IEC 42001 sets requirements for the organization and says nothing about grading, so the grading rules depend on who runs the audit. In a certification audit, the certification body grades under its own procedure, and that procedure has to match the ISO/IEC 17021-1 definitions. In a second-party audit, the contract or the customer’s audit procedure sets the grades. In a first-party audit, the organization’s program does.
Internal programs can borrow the certification grades so management can see how a certification auditor would likely treat the same evidence. GAICC’s guide to an internal grading scale for first-party audits covers that side. The rest of this guide assumes certification or second-party grading.
Second-party audits can use their own grade names. A customer may, for example, call its most serious level “critical”. Ask for the grading scheme in writing before fieldwork, so every finding uses the scale the report will be read against.
GAICC’s Lead Auditor credential treats this as core work. Its Candidate Handbook lists findings classification and reporting within the credential’s scope. Domain III of its exam content outline includes evaluating nonconformity management and corrective action. At first-party level, the Internal Auditor credential for clause 9.2 audits also tests how findings are classified.
The audit team proposes the grade, and the certification body decides what happens next. Under ISO/IEC 17021-1 the team leader tries to resolve diverging opinions between the team and the client, and any unresolved points go on record.
How to write a finding: requirement, evidence, statement
A well-written nonconformity names the requirement, sets out the objective evidence and states the gap, in that order. The structure follows ISO/IEC 17021-1. A nonconformity is recorded against a specific requirement. It carries a clear statement of the nonconformity and identifies the objective evidence in detail. The same clause bars the auditor from suggesting the cause or the solution.
| Part | What it contains | Test before you sign it off |
| Requirement | The clause, control or organization document, cited by number, with the relevant words paraphrased | Could the auditee find the exact requirement in under a minute? |
| Evidence | What was seen, where, when and on which sample: record IDs, dates, systems, people interviewed by role | Could a second auditor go and see the same thing? |
| Statement | One sentence on what is missing or wrong, set against the requirement | Does it describe the gap without explaining why it happened or how to fix it? |
ISO 19011:2026 clause 3.9 defines objective evidence as data supporting the existence or verity of something. It can come from observation, measurement, test or other means. In practice that means dates, identifiers and named documents. “Risk assessments seem out of date” is an impression. “Two of five sampled systems show risk assessments dated before their last model release” is evidence.
Keep three things out of the finding. Leave out the cause, because ISO/IEC 17021-1 reserves cause analysis for the client. Leave out the fix for the same reason. And leave out names of individuals, since the finding is about the system.
Practice with this sequence is part of the nonconformity analysis and reporting module of the Lead Auditor course, followed by a module on corrective and preventive action.
Worked examples by clause and control
The six findings below are illustrative. The organization is a fictional US lender with three AI systems in scope. It runs a credit decision model, a document extraction model bought from a vendor, and a vendor language model that marketing uses to draft copy. The requirement column paraphrases ISO/IEC 42001, so check the wording against your licensed copy before reusing any line.
| No. | Requirement (paraphrased) | Evidence (illustrative) | Statement |
| 1 | Clause 4.3: the AIMS scope is determined and kept as documented information | Scope statement v2 lists the credit and document models. Marketing confirmed in interview that it drafts customer emails with a vendor language model. Procurement records show the subscription since January | The vendor language model in use by marketing is neither inside the documented scope nor recorded as excluded with a reason |
| 2 | Clause 8.4 and the organization’s impact assessment procedure: impact assessments are repeated when significant changes are proposed; the procedure names retraining as significant | Model registry shows the credit model retrained and released on 12 March. The latest impact assessment is dated 4 November of the previous year | The credit model was retrained and released without the impact reassessment the procedure requires |
| 3 | Clause 6.1.3: necessary controls are determined, and the SoA justifies each inclusion and exclusion | SoA v3 excludes A.10.3 (suppliers) as “not applicable”. Two of the three AI systems come from vendors | The SoA excludes the supplier control without a justification drawn from the risk assessment, while two in-scope systems are supplied by third parties |
| 4 | Clause 9.2: auditors are selected and audits conducted to ensure objectivity and impartiality | The internal audit of clause 6 in June was led by the risk manager, who wrote the AI risk method (method document v1 author field) | The internal audit of the AI risk process was conducted by the author of that process |
| 5 | Control A.6.2.4: AI system verification and validation is defined and recorded | Release tickets for the five document model releases this year: two have no validation results against the acceptance criteria in the test plan | Two of five sampled releases went to production without recorded validation against the defined acceptance criteria |
| 6 | Clause 9.3: top management reviews the AIMS at planned intervals | AIMS launched 15 months ago; the review plan says twice a year; no management review minutes or input packs exist | No management review of the AIMS has taken place since launch |
Each statement stands alone. A reader who sees only the statement column can tell what is wrong, and the evidence column shows where to check it. None of the statements says why the gap exists or what to do, because both belong to the organization’s response.
Notice what the examples avoid. Example 3 does not say “A.10.3 is applicable”, since applicability follows from the organization’s risk assessment. It says the exclusion lacks a justification and conflicts with the evidence. Example 2 cites both the clause and the procedure, because the procedure defines “significant change” and the clause makes the reassessment a requirement. For the organization’s side of that record, see what a clause 6.1.4 assessment record holds.
Where AIMS findings tend to cluster
AIMS findings tend to gather where the standard joins two records, because a gap in either record shows up at the join. The patterns below are GAICC’s editorial reading of the standard’s structure. They are not survey results.
| Join in the standard | Clauses and controls | What the gap usually looks like |
| Scope and the systems in use | 4.1, 4.3, A.4 | AI features in bought software never assessed for scope |
| Impact assessment and risk assessment | 6.1.4, 6.1.2 | Harms named in the impact assessment with no matching risk entry |
| Risk treatment and the SoA | 6.1.3 | Controls named in treatment marked excluded, or exclusions with no reason |
| Change and reassessment | 8.2, 8.4, A.6 | Model, data or vendor changes released with no reassessment record |
| Supplier and contract | A.10.2, A.10.3, 4.2 | Responsibilities for model changes or incidents not allocated in contracts |
| Audit and review loop | 9.2, 9.3, 10.2 | Findings closed on correction only, or reviews with no decisions recorded |
Use the table to plan where to look harder. A finding still needs its own requirement and evidence, so a pattern seen before is never a reason to write one.
Grading decisions
Grading starts only once the finding is written. It asks one question. Does the gap affect the capability of the AIMS to achieve its intended results? European Accreditation’s guidance makes the order explicit: the finding must first be a nonconformity, and only then is it classified. ISO/IEC 42001 clause 4.1 ties the intended results to the organization’s own AIMS, so read them from its context, AI policy and objectives.
- Confirm the finding is a nonconformity against a specific requirement, with objective evidence.
- Identify the intended result at stake, such as fair credit decisions, reliable extraction or truthful customer content.
- Decide how far the doubt reaches: the whole AIMS, one process or only the instance sampled.
- Check the two triggers in the major definition’s note: significant doubt about effective process control, or about meeting specified requirements.
- Look for other findings on the same requirement or issue, since several minors can show a systemic failure.
- Record the reasoning in the audit file, so the grade can be explained at the closing meeting and to the certification body’s reviewer.
Applied to the worked examples, those steps give the grades below. The grades are illustrative; a different evidence picture could change any of them.
| No. | Likely grade | Reasoning |
| 1 | Minor | One system missing from scope; the scope process otherwise works |
| 2 | Minor, rising to major if other retrained systems show the same gap | One release missed a trigger; repeated misses would cast doubt on change control |
| 3 | Major | Supplied systems form most of the scope, so the supplier risk may be untreated across the AIMS |
| 4 | Minor | One audit lacked impartiality; the program itself exists |
| 5 | Minor, or major if validation is skipped by design | Two of five releases suggest a control that fails in practice |
| 6 | Major | With no management review, top management has not evaluated the AIMS at all |
Two habits keep grading consistent. Grade the effect and ignore the size of the document. A missing one-page procedure can matter more than a long but outdated register. And never downgrade a nonconformity to an observation or an opportunity for improvement to soften a report. ISO/IEC 17021-1 bars recording a nonconformity as an opportunity for improvement, and the European Accreditation answer requires a nonconformity to be classified as one.
Once the grades are agreed, the findings leave the auditor’s hands and enter the organization’s corrective action process.
Correction and corrective action under clause 10.2
A correction fixes the nonconformity that was found, and a corrective action removes its cause so it does not recur. ISO/IEC 42001 defines corrective action in clause 3.17 as action to eliminate the cause of a nonconformity and to prevent recurrence. Clause 10.2 then sets the sequence. The organization reacts and corrects, reviews the nonconformity and finds its causes. It checks whether similar ones exist or could occur, acts, and reviews whether the action worked.
| Example | Correction (fix the instance) | Corrective action (remove the cause) |
| 2, retrained model | Complete and approve the impact reassessment for the March release | A release gate in the model registry that blocks deployment until a current impact assessment is linked |
| 3, supplier exclusion | Rewrite the SoA entry with a justification, or include the control | A change to the SoA review step so every exclusion cites a risk result |
| 5, missing validation | Validate the two releases already in production | A deployment check that requires validation results against acceptance criteria |
| 6, no management review | Hold and minute a management review with the required inputs | Reviews fixed in the governance calendar, with an owner for the input pack |
Under ISO/IEC 17021-1, the certification body requires the client to analyze the cause and describe the specific correction and corrective action within a defined time. That response is often called a corrective action plan, and its root cause analysis shows whether the corrective action can work. The auditor reviews the response but does not write it. In GAICC’s view, a response that offers a correction with no cause analysis should be sent back. Clause 10.2 asks for both.
Closing findings and the timelines that apply
Most deadlines come from the certification body, which tells the client at the closing meeting. The rules that do exist come from ISO/IEC 17021-1, set out here from an accreditation body’s slide summary of section 9.
| Point in the process | Rule | ISO/IEC 17021-1 clause |
| Closing meeting | The client is told the timeframe for presenting a plan for correction and corrective action | 9.4.7.2 d) |
| Client response | The client analyzes the cause and describes the correction and corrective action within a defined time | 9.4.9 |
| Review and verification | The certification body reviews the response for acceptability, then verifies effectiveness from documents or on site | 9.4.10 |
| Major found at Stage 2 | If correction and corrective action cannot be verified within 6 months after the last day of Stage 2, another Stage 2 is conducted before certification is recommended | 9.5.3.2 |
| Major found at recertification | Correction and corrective action are implemented and verified before the certificate expires | 9.6.3.2.2 |
No day count appears in these clauses for the client’s first response. Treat a “90-day rule” as a certification body’s own policy, and ask for that policy in writing. Minor nonconformities need an accepted plan before the decision. Their verification often falls to the next surveillance audit, which reviews action taken on earlier nonconformities.
Closure needs a record. The certification body records the evidence that resolved each nonconformity and tells the client the result of its review and verification. For the auditor, that means the follow-up line names the evidence seen and the date, in the same three-part form as the original finding.
What goes in the audit report
The audit report is the certification body’s record of the audit, and findings are only one part of it. ISO/IEC 17021-1 clause 9.4.8 lists what a certification audit report must contain. The items that carry the findings are these.
| Report item (ISO/IEC 17021-1, 9.4.8) | What it means for findings |
| Audit criteria, objectives and scope, including units or processes audited | Each finding cites a requirement inside these criteria and this scope |
| Audit findings, reference to evidence and conclusions | Every nonconformity appears with its evidence reference and grade |
| Unresolved issues | Disputed findings are recorded as unresolved |
| Verification of earlier corrective actions | Results of follow-up on previous nonconformities |
| A disclaimer that the audit rests on sampling | Findings describe the sample, and the absence of findings proves nothing beyond it |
| A statement on conformity and effectiveness, with a summary of evidence on internal audit and management review | Example 6 above would weigh directly on this statement |
| A conclusion on the appropriateness of the certification scope | Example 1 above bears on this conclusion |
| The audit team’s recommendation | Whether to grant, maintain or renew certification, given the open findings |
An audit conclusion closes the report. ISO 19011:2026 defines it as the result of an audit after considering the audit objectives and all findings. Second-party reports follow the contract and ISO 19011:2026 clause 6.5. The same discipline applies there: findings with evidence, a stated sample and a conclusion that does not claim more than the audit tested. The checklist fields that feed each report section are set out in GAICC’s auditor’s checklist guide.
How findings affect the certification decision
Open findings decide whether certification can be granted, maintained or renewed. Under ISO/IEC 17021-1, the certification body reviews three things before deciding. The audit information must be sufficient, major nonconformities must be closed, and minor ones must have an accepted plan. The decision is made by people who did not run the audit, working from the report, the comments on nonconformities and the team’s recommendation.
The grade therefore shapes the timetable. A major at Stage 2 holds the decision until the fix is verified, and the six-month limit can force a repeat Stage 2. A minor lets the decision proceed on an accepted plan. The organization’s view of that sequence is in what a certification body must close before it decides.
Findings also travel forward. Each surveillance audit reviews action taken on nonconformities from the previous audit, and recertification reviews the surveillance reports. A finding written clearly today is the one the next auditor can test quickly.
Frequently Asked Questions
Can the auditee refuse to accept a nonconformity?
The auditee can dispute it, and the dispute should be settled on evidence. ISO/IEC 17021-1 requires nonconformities to be discussed with the client so the evidence is accurate and understood. The team leader tries to resolve diverging opinions, and unresolved points go into the report. The client can also use the certification body’s appeal process, which the closing meeting explains.
Is a missing document always a major nonconformity?
No. Grades follow the effect on the AIMS. A missing scope statement for the whole AIMS could put its intended results in doubt, because nobody can then say which AI systems the AIMS governs. One missing record in an otherwise working process usually points to a minor. Apply the capability test from ISO/IEC 17021-1 to each case and record the reasoning.
Can an auditor recommend how to fix a nonconformity?
In a certification audit, no. ISO/IEC 17021-1 says the auditor refrains from suggesting the cause of a nonconformity or its solution, which protects impartiality. The auditor can explain the requirement and the evidence. In a second-party audit the contract decides. In GAICC’s view, a customer who prescribes the fix blurs who owns it.
Can an observation become a nonconformity at the next audit?
Yes, if the next audit finds that a requirement is now unmet. An observation records a weakness that could lead to a nonconformity. In the certification body scheme that European Accreditation reviewed, the next audit examines the client’s response to it. If the evidence then shows non-fulfilment of a requirement, the auditor writes a nonconformity, even if the same issue was logged as an observation before.
How should a finding against a legal requirement be worded?
ISO 19011:2026 notes that where the audit criteria are legal requirements, findings are often termed compliance or non-compliance. In an AIMS certification audit, cite the ISO/IEC 42001 requirement that covers the legal duty, such as clause 4.2 on interested-party requirements. A certification audit checks the management system and does not replace a legal compliance review.
Do nonconformities appear on the certificate?
No. The certificate states the scope and, for an AIMS, the Statement of Applicability version it rests on. Findings stay in the audit report, which the certification body owns and gives to the client. Customers who want assurance can ask a supplier for its latest surveillance report or a summary of open findings. What they receive depends on what the supplier agrees to share.
