An ISO 42001 certification body auditor is a person whom an accredited certification body has evaluated, authorized and assigned to audit client AI management systems (AIMS) for certification. The body grants that approval against ISO/IEC 17021-1 and ISO/IEC 42006:2025, and no training course or exam can grant it. A Lead Auditor credential is one item in the file the body reviews.
Two different things carry the name “certification” here. A personnel credential certifies a person, and the Lead Auditor that the Global AI Certification Council (GAICC) issues for ISO/IEC 42001 is one example. An accredited certification body certifies organizations, and it chooses its own auditors. This guide follows the auditor through that second decision: what the body checks, what to put in the file, and how approval is kept and extended.
Credential first, approval second
A certification body approves an auditor in stages, and the personal credential is only the first. GAICC’s Lead Auditor certification rules cover how the credential is earned. Everything after that belongs to the body you want to audit for. The fees for the credential itself are set out in GAICC’s Lead Auditor cost breakdown.
| Step | Who decides | What it shows | Rule behind it |
| 1. Personal credential | A personnel certification body, such as GAICC | You passed an exam on leading AIMS audits | The issuer’s scheme |
| 2. Competence evaluation | The certification body | You meet its documented criteria for knowledge and skills | ISO/IEC 17021-1, 7.1.2 and 7.1.3 |
| 3. Observed or witnessed audit | An evaluator the body appoints | You can run an audit, seen on site or remotely | ISO/IEC 17021-1, 7.2.4; ISO/IEC 42006, 7.2.2.1 |
| 4. Formal authorization | The certification body | You may audit, or lead, within named scope | ISO/IEC 17021-1, 7.2.4 |
| 5. Ongoing monitoring | The certification body | You still perform | ISO/IEC 17021-1, 7.2.9 to 7.2.11 |
The body’s decision stays with the body. In ISO/IEC 17021-1, competence “shall be demonstrated prior to the individual taking the responsibility” for audit work (clause 7.1.3). A certificate from any scheme feeds that judgement but does not replace it.
What ISO/IEC 17021-1 asks of a certification body’s auditors
ISO/IEC 17021-1:2015 is the requirements standard for bodies that audit and certify management systems, and its clause 7 sets how they qualify people. The standard has no AI content. Every rule below applies to an AIMS auditor exactly as it does to a quality or security auditor.
The International Accreditation Service publishes a clause 7 summary of ISO/IEC 17021-1, and it lists five duties that shape your path:
- Documented competence criteria for each audit and certification task (7.1.2).
- A documented process for the initial evaluation of competence and for ongoing monitoring (7.1.3).
- Processes for “selecting, training, formally authorizing auditors”, where the initial evaluation “requires observing the auditor conducting an audit” (7.2.4).
- Monitoring of each auditor through on-site evaluation, report review and client feedback, with periodic on-site evaluation (7.2.10 and 7.2.11).
- Up-to-date personnel records (7.4).
Clause 9 adds the trainee route. Auditors in training may take part in an audit “provided an auditor is appointed as an evaluator”, in the same accreditation body’s clause 9 summary. Technical experts can join a team too, but they do not act as auditors and must be accompanied by one.
What ISO/IEC 42006 adds for AIMS auditors
ISO/IEC 42006:2025 adds AI-specific requirements to ISO/IEC 17021-1, and its clause 7.2.2 sets floors for each person who audits an AIMS. GAICC read the published text through its identical Slovenian adoption, SIST ISO/IEC 42006:2026, on 20 October 2026.
| ISO/IEC 42006 clause | What each auditor must show (quoted where marked) |
| 7.2.2.2 a) | Education “to an equivalent level of university education” |
| 7.2.2.2 b) | “At least four years of full-time practical workplace experience in information technology or data protection”, and at least one year related to AI systems |
| 7.2.2.2 c) | “At least 24 hours of training that included AIMS audits and audit management” |
| 7.2.2.2 d) | Prior management system audits, “such as but not limited to ISO 9001 and ISO/IEC 27001”: “at least ten audit days” or “at least three management system audits”, performed “in the last five years” under supervision |
| 7.2.2.2 e) | Current knowledge of AI systems and auditing through “ongoing professional development and audits” |
| 7.2.2.3 (team leaders) | Participation as an auditor “in all stages of at least three management system audits”, including scoping, document review, risk assessment review and formal reporting |
The supervised experience in item d) has a fixed shape. It must include “at least one initial certification or re-certification audit” and “at least one surveillance audit.” A team leader’s supervised audits must have been performed by an experienced AIMS auditor “who has conducted at least three ISO/IEC 42001 audits”. For up to two years after the year of publication, three ISO/IEC 27001 audits may stand in for those three AIMS audits.
Team-level rules sit on top of the individual floors. The audit team must “collectively” know every control in Annex A of ISO/IEC 42001 and how each is implemented. As a group, it must also trace incidents with serious negative effects on people back to the AIMS elements involved. Report reviewers and certification decision makers meet the same 7.2.2.2 criteria, though a note lets a separate decision maker hold more general knowledge.
Steps to approval at a certification body
Approval at a certification body follows a predictable sequence, although each body writes its own procedure and timetable. The sequence below is GAICC editorial analysis, built from the clauses above.
- Check the body’s accreditation. Find bodies accredited for ISO/IEC 42001 in an accreditor’s register, such as ANAB’s accredited body directory. It listed 20 bodies for ISO/IEC 42001 on 20 October 2026.
- Meet the entry floors. Count your full-time IT or data protection years, your AI-related year, your AIMS audit training hours and your supervised audit days against ISO/IEC 42006, 7.2.2.2.
- Apply as staff, contractor or trainee. Send the career file described in the next section.
- Pass the competence evaluation. Expect an interview and a review of your file against the body’s criteria; a body may add a written or case test.
- Audit under supervision. Join audits as an auditor in training with an appointed evaluator, until the supervised audits in 7.2.2.2 d) are complete.
- Be observed. An evaluator watches you run an audit. ISO/IEC 42006 lists AIMS audits “witnessed by another competent and authorized AIMS auditor” as one form of evidence.
- Sign the agreements. Contracted auditors sign a written agreement on confidentiality and impartiality, and every auditor declares past relationships.
- Receive authorization. The body records what you may audit and in what role, then starts monitoring.
The timetable from step 3 to step 8 is set by the body, because supervised audits depend on its client calendar. The audits you will join are Stage 1, Stage 2 and surveillance visits, described from the client’s side in what the certification body tests at each audit stage.
The career file a certification body reviews
A career file is the evidence pack you hand a certification body so it can test you against its criteria. ISO/IEC 42006, 7.2.2.1, names five kinds of evidence. A body must show each auditor’s knowledge and skills through recognized AIMS qualifications, registration where applicable, training, professional development records and witnessed audits.
| Item in the file | What it proves | Clause that asks for it |
| Degree or equivalent training record | The education floor | 42006, 7.2.2.2 a) |
| Dated work history in IT or data protection, with AI work marked | Four years full time, plus at least one year related to AI systems | 42006, 7.2.2.2 b) |
| AIMS audit training certificate showing hours | 24 hours including AIMS audits and audit management | 42006, 7.2.2.2 c) |
| Lead Auditor credential, with issuer and validity | A recognized AIMS-specific qualification | 42006, 7.2.2.1 |
| Audit log with days, audit type, role and supervisor | Ten audit days or three audits in five years, with initial and surveillance audits | 42006, 7.2.2.2 d) |
| CPD record for the last cycle | Current knowledge of AI and auditing | 42006, 7.2.2.1 and 7.2.2.2 e) |
| Witness or evaluator reports | Observed audit performance | 17021-1, 7.2.4; 42006, 7.2.2.1 |
| Declaration of past consulting and employment | No conflict with clients you may audit | 17021-1, 7.3 and 5.2 |
| Two referees who saw you audit | Independent confirmation of the log | Only if the body asks; not a 17021-1 or 42006 rule |
Write the audit log as you go. Record the client sector, the standard, the audit type (initial, surveillance or recertification), the stage, your days, your role and your supervisor’s name. GAICC’s own Lead Auditor rule counts experience in months. A certification body reads audit days and audit types, so log both.
The clause-by-clause tests you will apply once approved are set out in the tests certification body auditors run on each clause. Rehearse them on internal audits before your first supervised visit.
Impartiality rules for consultants who want to audit
Consulting and certification auditing are kept apart by rule, and former consultants face a waiting period. ISO/IEC 42006, 5.2.2.1, says certification bodies “shall not provide consulting for management systems related to artificial intelligence”. The bar also covers information security, data protection and risk management systems for AIMS clients. Clause 5.2.2.3 adds that the body “shall not carry out any internal audits for the client to be certified.”
ISO/IEC 17021-1 turns those rules into limits on people. Personnel who consulted for a client are not used on it, and the recognized mitigation is to keep them off “for a minimum of two years following the end of the consultancy”. That wording comes from the IAS summary of the impartiality clauses. The same two-year mitigation applies to internal audits a body ran for a client.
| Your past work for a client | Can you audit that client for certification? |
| Built or advised on its AIMS, AI risk or security management system | Not for at least two years after that work ends (the mitigation ISO/IEC 17021-1 recognizes) |
| Ran its internal audits | Declare it; a body may not certify a system it internally audited in the previous two years |
| Taught a public training course its staff attended | Usually yes; ISO/IEC 42006 treats public courses as no conflict for the body, but not in-house or client-specific training |
| Worked there as an employee | Declare it; the body decides on the threat to impartiality |
| No past relationship | Yes, after the standard declaration |
The public course exception comes from ISO/IEC 42006, 5.2.2.2, which allows publicly available training “excluding inhouse trainings”. Stop advising AIMS clients well before you apply. Then list every client relationship from the last two years in the file, because the body has to test each one against its impartiality risks. The parallel rule for one person who both builds and audits an AIMS inside one organization is compared in whether one person can implement and audit the same AIMS.
Working as a contracted or associate auditor
Certification bodies may use contracted auditors as well as staff, and ISO/IEC 17021-1 allows it under a written agreement. Its clause 7.3 requires external auditors to sign commitments on confidentiality and impartiality. They must also tell the body about any existing or prior relationship with a client they may be assigned. The standard notes that an individually contracted auditor “does not constitute outsourcing.”
One limit matters for consultants. A certification body may not outsource audits to a management system consultancy organization, though individuals contracted as auditors are allowed. ISO/IEC 42006, 7.5, goes further: outsourcing under ISO/IEC 17021-1, 7.5, is not permitted at all within the scope of ISO/IEC 42001 certification. You therefore contract as an individual, and the body cannot place its audits with the consulting firm that employs you. Associate auditors are held to the same evaluation, monitoring and records as staff, so approval steps do not shrink.
US certification firm ads show the staff version of this work. A remote “Senior Associate, ISO” ad from an advisory firm whose certification arm is one of ANAB’s 42001-accredited bodies, posted in late September 2026, combined audits against ISO/IEC 42001 with 27001 and 27701 work. Its requirements included “a minimum of 2 years of external Audit experience”, and it named AI or ISO Lead Auditor credentials among its preferred qualifications. Pay for contract and staff roles is covered in US audit careers and pay for Lead Auditors.
Keeping your approval current
Approval is monitored for as long as you audit, and continued authorization depends on the results. ISO/IEC 17021-1 requires documented monitoring of each auditor that combines on-site evaluation, review of audit reports and client feedback, plus periodic on-site evaluation. The frequency depends on how often you audit and the risk of the work.
Three habits keep the file current:
- Audit regularly. ISO/IEC 42006 expects current knowledge “through ongoing professional development and audits”, so long gaps weaken your record.
- Log CPD on AI as well as auditing. Track changes to ISO/IEC 42001 guidance, ISO 19011:2026 and AI law that affects clients.
- Keep the personal credential valid. The GAICC Lead Auditor runs three years and renews with 32 CPD hours, and the body will ask for proof.
Remote work now forms part of that record. ISO 19011:2026 expanded its guidance on remote auditing methods and virtual locations. IAF MD 4:2025, the mandatory document on information and communication technology in audits, has applied since 30 January 2026. The International Accreditation Forum issued it in January 2025, before its work passed to Global Accreditation Cooperation in January 2026. The document treats a virtual site as a single site for audit time, which matters when the AI system runs in a cloud region you never visit. ISO/IEC 42006 adds a clause on deploying remote audits. Expect a body to check how you sample evidence over a video link as well as in a meeting room.
Findings are where monitoring bites. A reviewer reads every report you write, and weak or inconsistent findings show up quickly. Practise grading on real evidence with grading findings the way certification bodies do.
From auditor to team leader and technical reviewer
After approval, an auditor can move to team leader and then to roles that review other auditors’ work. Each move needs a separate authorization from the body.
| Role | What you do | Extra rule (ISO/IEC 17021-1 and 42006) |
| Auditor | Audits assigned clauses, sites or processes | 42006 7.2.2.2 floors |
| Audit team leader | Plans the audit, assigns work, resolves diverging views, writes the report | 42006 7.2.2.3: all stages of three audits under an experienced AIMS auditor |
| Report reviewer | Checks reports before a decision | Same criteria as 7.2.2.2 apply |
| Certification decision maker | Grants, refuses or withdraws certification | Must differ from the auditors who carried out the audit (17021-1, 9.5.1.1) |
A side door exists for AI specialists who lack audit experience. ISO/IEC 17021-1 lets a body add technical experts to a team when the auditors need specialist knowledge. Their role is agreed with the client before the audit, and a technical expert does not act as an auditor and is always accompanied by one. ISO/IEC 42006 applies the base standard’s rules on external technical experts unchanged. Data scientists and model risk staff can start this way, then train and log supervised audits to qualify as auditors.
Team leaders carry the audit plan and the report. The Lead Auditor training from GAICC prepares candidates for an exam on leading AIMS audits, the base that a team leader builds on. GAICC’s Senior Lead Auditor credential is built for complex multi-site and multi-standard engagements, the work a seasoned team leader takes on.
Frequently Asked Questions
Does a Lead Auditor certificate let me audit for certification?
No. A Lead Auditor certificate is a personal credential. Certification audits are run by accredited certification bodies, and each body evaluates and authorizes its own auditors, using ISO/IEC 17021-1 with ISO/IEC 42006. The credential counts as evidence in that evaluation. Approval also needs supervised audits, an observed audit and an impartiality commitment.
What is a witness audit for an ISO 42001 auditor?
A witness audit is an audit in which an evaluator watches a candidate auditor work and reports on performance. ISO/IEC 17021-1 requires the body’s first competence evaluation to include observing the auditor conduct an audit. ISO/IEC 42006 lists AIMS audits witnessed by another competent and authorized AIMS auditor as evidence of competence.
Can I count ISO 27001 audits toward ISO 42001 approval?
Yes, within limits. ISO/IEC 42006 accepts prior management system audits such as ISO 9001 and ISO/IEC 27001 toward the supervised audit floor. For team leaders, three ISO/IEC 27001 audits may replace three AIMS audits during a transition of up to two years after the year of publication. You still need AIMS audit training and AI-related experience.
Do I need a degree to audit ISO 42001 for a certification body?
ISO/IEC 42006 asks for professional education or training “to an equivalent level of university education”. A degree meets it, and equivalent training can too. The body decides what counts as equivalent and records the reason. The four-year work floor in IT or data protection applies either way, with at least one year related to AI systems.
Can a certification body auditor also work as an AI consultant?
Not for the same clients, and not through a consulting firm. A body may not outsource ISO/IEC 42001 audits at all, and personnel who consulted for a client should not audit it for two years. An individual can hold both roles for different clients, as long as every relationship is declared and the body judges the threat to impartiality acceptable.
How many ISO 42001 certification bodies are there in the US?
On 20 October 2026, ANAB’s directory showed 20 ANAB-accredited AIMS certification bodies, some of them based outside the US. The list changes, so check the directory before applying. Other accreditors keep their own lists; the UK’s UKAS listed five AIMS bodies the same day. Each body runs its own auditor approval procedure.
