ISO/IEC 42001: Stage 1, Stage 2 and the Recognition Gap

Every explainer walks the clause list. What decides whether a certificate survives due diligence is procedural: which audit examines what, which dates are deadlines, what the certificate is worth.

Aligned, Certified, Accredited: Three Different Claims

Stribog's earlier article, ISO 42001 for self-hosted inference: clause to artefact, maps the clauses onto evidence an inference stack emits. This one covers what follows: the audit events, their schedule, what the certificate carries.

• Aligned. A self-assessment against the clauses. Nobody external looked — not worthless, but not a third-party opinion.
• Certified. A certification body audited the system and issued a certificate. Whether anyone accredited that body is separate.
• Accredited certification. That body was itself assessed against ISO/IEC 17021-1 by an accreditation body, and the certificate says so.

The third tier has a one-line test a buyer can apply to a PDF. Global ACI's rules require conformity assessment bodies to carry the accreditation symbol and/or explicitly reference their accreditation status, including identification of the accreditation body — certificates without such a reference "shall not be considered accredited and will not be recognised by any MRA signatory." That test separates accredited from unaccredited and nothing else; the same rules confine accreditation references to outputs "explicitly covered by the accredited scope."

What Stage 1 Opens: The Scope Statement It Examines

Initial certification is one audit in two stages, and they examine different things. Under ISO/IEC 17021-1 the objectives of Stage 1 include reviewing the documented management system, evaluating preparedness for Stage 2, and obtaining the information needed about the scope — the client's sites, the processes and equipment used, the levels of controls established, and applicable statutory and regulatory requirements.

Read that against a self-built GPU cluster and it stops being abstract. "Sites" is a colocation hall with a cage number, or two if you failed over last quarter. "Processes and equipment" is the serving stack and the accelerators under it. The statutory limb drags in whatever regime you sit under — in Europe, EU AI Act obligations.

It closes by telling you what it found: documented conclusions on fulfilment of its objectives and readiness for Stage 2, "including identification of any areas of concern that could be classified as a nonconformity during stage 2." A written list of what will be held against you next — which teams treating Stage 1 as a formality throw away.

It does not fix the certified scope: Stage 1 obtains the proposed scope and tests whether it holds together, and what you end up certified for is settled after Stage 2 — so the boundary stays negotiable while changing it is cheap.

Put the Scope in Git and Make Drift a Build Failure

Stage 1 must obtain sites, processes and equipment, and every later surveillance measures you against that boundary — so make it a machine-readable file. A manifest in version control gives the auditor one object to read, you a diff history, and CI something to test. Exclusions matter as much as inclusions, as in Annex A scoping: silence about an adjacent cluster is a finding.

# The boundary stage 1 examines and every surveillance re-reads.
apiVersion: stribog.example/v1
kind: AimsScope
metadata: { name: inference-platform, reviewedOn: "2026-09-05" }
spec:
  sites: # "the client's site(s)"
    - { id: fra-colo-1, cage: FRA-C14, jurisdiction: DE, role: primary }
    - { id: fra-colo-2, cage: FRA-C22, jurisdiction: DE, role: failover }

  nodes: # "processes and equipment" — named, not counted
    selector: { aims.stribog.example/in-scope: "true" }
    expected: [gpu-fra-01, gpu-fra-02]

  endpoints:
    - { route: /v1/chat, namespace: inference-prod,
        models: [internal-assistant-14b, internal-assistant-70b] }
    - { route: /v1/embeddings, namespace: inference-prod, models: [internal-embed-base] }

  controlLevels: # "levels of controls established" — differ per zone
    - { namespace: inference-prod, oversight: reviewed-sampling, retentionDays: 30 }
    - { namespace: inference-eval, oversight: full-review, retentionDays: 90 }

  exclusions: # as load-bearing as the inclusions
    - { id: ml-research, reason: Fine-tuning only. Never serves production. }

  statutoryContext: [gdpr-eu-2016-679, eu-ai-act-2024-1689]

#!/usr/bin/env bash
# 0 = matches the certified AIMS scope, 1 = drift, 2 = usage error.
set -euo pipefail

MANIFEST="${1:-}"
[ -f "$MANIFEST" ] || { echo "usage: $0 <aims-scope.yaml>" >&2; exit 2; }
for t in kubectl yq jq; do
  command -v "$t" >/dev/null || { echo "need kubectl, yq and jq" >&2; exit 2; }
done

drift=0
diff_sets() { # $1 label, $2 declared, $3 live
  while read -r x; do [ -n "$x" ] && { echo "DRIFT $1: $x" >&2; drift=1; }; done \
    < <(comm -3 <(echo "$2") <(echo "$3") | tr -d '\t')
}

sel=$(yq -r '.spec.nodes.selector | to_entries[0] | "\(.key)=\(.value)"' "$MANIFEST")
diff_sets nodes \
  "$(yq -r '.spec.nodes.expected[]' "$MANIFEST" | sort -u)" \
  "$(kubectl get nodes -l "$sel" -o \
     jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' | sort -u)"

# Ask the gateway what it SERVES, not what the spec claims.
diff_sets models \
  "$(yq -r '.spec.endpoints[].models[]' "$MANIFEST" | sort -u)" \
  "$(kubectl run "aims-probe-$RANDOM" -n inference-prod --rm -i --restart=Never \
     --quiet --image=curlimages/curl:8.11.1 -- -sS --max-time 10 \
     http://vllm-gateway/v1/models | jq -r '.data[].id' | sort -u)"

[ "$drift" -eq 0 ] && { echo "OK  matches $MANIFEST"; exit 0; }
exit 1

Click to zoom

Stage 2 Wants It Running, Not Written

Stage 2 evaluates the implementation, including effectiveness, of the management system. It takes place at site, covering information and evidence; performance monitoring, measuring, reporting and reviewing against key performance objectives and targets; operational control of the client's processes; internal audit and management review.

Read it for what it presupposes. "Reviewing against key performance objectives and targets" presupposes a period you reviewed. "Internal auditing and management review" presupposes an audit that happened and a review that met. Effectiveness is a property of a process with a history, not of a document — which is why a binder written the fortnight before can be complete, correct and still fail. The standard sets no minimum operating period; the evidence accrues only by running.

For an inference platform that record is a by-product of operating well: change records for every model version promoted to serving; incidents where the system behaved outside its declared envelope; internal audit findings, open ones included.

The Audit Programme Is a Multi-Year Clock

The initial-certification programme comprises the two-stage initial audit, surveillance audits in the first and second years following the certification decision, and a recertification audit in the third year prior to expiration. The first three-year cycle begins at that decision.

One is a deadline, not an anniversary: the first surveillance audit following initial certification shall be not more than 12 months from the certification decision date, with surveillance at least once a calendar year except in recertification years. From the decision, not from Stage 2.

Two more behave like production deadlines. For any major nonconformity at recertification, time limits for correction and corrective action are defined and completed prior to the expiration of certification — the expiry date does not move for your fix. After expiry the body can restore certification within six months provided outstanding recertification activities are completed, otherwise at least a Stage 2 is conducted. A window for restoring certification, not one in which it stays valid.

#!/usr/bin/env bash
# ISO/IEC 17021-1 audit-programme dates from the certification DECISION date.
set -euo pipefail

DECISION="${1:-}"; CYCLE="${2:-3}"
# A bare letter is a valid GNU date, so test emptiness separately.
[ -n "$DECISION" ] && date -d "$DECISION" >/dev/null 2>&1 &&
  case "$CYCLE" in ''|*[!0-9]*) false ;; esac || {
    echo "usage: $0 <decision YYYY-MM-DD> [cycle-years]" >&2; exit 2; }

d() { date -u -d "$1" +%Y-%m-%d; }
expiry=$(d "$DECISION + $CYCLE years")

echo "decision              $(d "$DECISION")   the cycle begins here"
echo "surveillance 1 DUE BY $(d "$DECISION + 12 months")   a cap, not a target"
echo "surveillance 2 by     $(d "$DECISION + 24 months")"
echo "recertify BEFORE      $expiry   majors closed by then"
echo "restoration ends      $(d "$expiry + 6 months")   certificate NOT valid in it"

Four Ways a Self-Built AIMS Scope Drifts Out of Its Certificate

Surveillance reviews internal audits and management review, actions on prior nonconformities, complaints handling, continuing operational control, review of any changes, and use of certification marks. "Any changes" is what finds infrastructure drift, and on owned hardware changes are yours to make at any hour.

1. Node drift. A GPU node is added, replaced after an RMA, or loses its label in a rebuild, and serving lands on hardware the scope never named. Caught by the manifest check above, scheduled as well as in CI, since most node changes never see a pull request.
2. Model drift. A served model identifier appears outside the declared set: a quantised build promoted for latency, a base model bumped by a chart default. Caught by comparing what the gateway serves against the manifest.
3. Endpoint drift. A new route or namespace starts serving outside the boundary. Caught by alerting on traffic from any namespace the manifest never named.
4. Control-ownership drift. A control's owner leaves, or its evidence stream moves, and the artefact the auditor asks for stops being produced. Nothing breaks.

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: aims-scope-drift
  namespace: monitoring
  labels:
    role: alert-rules
spec:
  groups:
    - name: aims-scope-drift
      interval: 60s
      rules:
        # Regex generated from aims-scope.yaml.
        - alert: AimsUndeclaredModelServed
          expr: |
            sum by (model_name) (
              rate(vllm:request_success_total{
                model_name!~"internal-assistant-14b|internal-assistant-70b|internal-embed-base"
              }[5m])
            ) > 0
          for: 5m
          labels: { severity: critical, compliance: iso-iec-42001 }
          annotations:
            summary: "Undeclared model {{ $labels.model_name }} is serving"

        # The vLLM counter has no node label; kube_pod_info supplies it.
        # Endpoint drift: same shape, namespace instead of node.
        - alert: AimsServingOnOutOfScopeNode
          expr: |
            sum by (node) (
              sum by (namespace, pod) (
                rate(vllm:request_success_total[5m])
              )
              * on (namespace, pod) group_left(node) kube_pod_info
            ) > 0
            unless on (node) (
              max by (node) (
                kube_node_labels{label_aims_stribog_example_in_scope="true"}
              )
            )
          for: 10m
          labels: { severity: critical, compliance: iso-iec-42001 }
          annotations:
            summary: "Serving from out-of-scope node {{ $labels.node }}"

The fourth resists this: nothing emits a metric when a person stops caring. The nearest proxy is a freshness check per control — an artefact older than its interval is a finding waiting for a date.

Click to zoom

The Missing Level 5 Row: What Accredited 42001 Does Not Carry

The ground moved recently. Global Accreditation Cooperation Incorporated was established to bring together the work of ILAC and IAF, commencing full operations on 1 January 2026 with its own Multilateral Recognition Arrangement. IAF's site now carries a notice that it is no longer operational and is archival only. Existing ILAC MRA and IAF MLA accreditations stay recognised through the transition, so "IAF MLA signatory" on a body's paperwork is transitional wording, not a defect.

That arrangement has levels: Level 1 is the endorsed normative document for accreditation bodies, Levels 2 and 3 the main scopes, Levels 4 and 5 the sub-scopes — for management system certification, Level 3 is ISO/IEC 17021-1:2015 and the Level 5 entries are the standards themselves. Global ACI names Global ACI-FMRA-001 the authoritative reference for its MRA's current scope. In version 3.2, issued 05 August 2026, the Level 5 entries under Management System Certification include ISO 9001, ISO 14001, ISO 45001, ISO 37001 and ISO/IEC 27001:2022 (ISMS), the last paired with ISO/IEC 27006-1:2024 at Level 4. ISO/IEC 42001 is not among them: a full-text search returns zero occurrences of 42001 or 42006, checked 2026-09-05, and the scopes page agrees.

Accreditation is demonstrably happening. UKAS announced on 15 January 2026 that it had granted BSI accreditation for certification of AI management systems to ISO/IEC 42001:2023, calling BSI the first body to meet these requirements under the UKAS process — a claim about its own process, since RvA published on 27 January 2025 that BSI and DNV were already accredited in the Netherlands to certify against ISO 42001.

The other half a reader over-reads: the absent global row says nothing about regional coverage. The Asia Pacific Accreditation Cooperation's MRA page lists, under "Certification – Management Systems ISO/IEC 17021-1", standards its signatories' accredited facilities conform to — ISO 37001 (ABMS), Artificial Intelligence Management Systems (AIMS), ISO 55001 (AMMS). APAC prints AIMS and no 42001 number; quote it as APAC writes it. The Singapore Accreditation Council, updated 3 August 2026, records under APAC "Signed in 2025 (AIMS)" while its IAF MLA list ends at "Signed in 2025 (ABMS)". Both checked 2026-09-05.

Global Level 5: absent. Regional listing: present. Neither implies the other, and SAC is one accreditation body, not the region.

The gap matters because the two checks a buyer reaches for first cannot see it. The accreditation-symbol test separates accredited from unaccredited, and a UKAS-symbol 42001 certificate passes. A CertSearch lookup also returns positive: the database provides data on accredited management system certifications issued by a body accredited under main scope ISO/IEC 17021-1, with participation mandatory for all standards and schemes in its principles — so it carries standards that are not MLA sub-scopes, and cannot close the Level 5 question. Only a dated FMRA-001 lookup detects it.

So date it: write the date of your lookup beside the claim, in the procurement answer itself, and re-run before repeating it. Absences stop being true without notice.

The Exit Ramp Is the Record a Receiving Body Reviews

A certification body is a supplier, and suppliers get changed. The rules for moving accredited certification between bodies are the legacy IAF mandatory document MD 2:2023, which Global ACI has not been shown to have re-issued — a published position, not settled policy.

What it makes concrete is the material a pre-transfer review runs on. Clause 2.2.4(v) requires it to cover the initial certification or most recent recertification audit reports and the latest surveillance report, the status of all outstanding nonconformities arising from them, and any other available relevant documentation regarding the certification process — and if those reports are not made available, or the surveillance or recertification audit was not completed as the issuing body's programme required, the organisation is treated as a new client. Clause 2.2.4(ii) requires confirming the issuing body's accredited scope falls within its accreditation body's MLA scope; where no problems are found, clause 2.3.4 bases the cycle on the previous one, so a clean transfer does not reset the clock.

So the exit ramp is a record: audit reports, the latest surveillance report, a live nonconformity register, plus the scope-manifest history — a git log of every change to the certified boundary is the kind of "other available, relevant documentation" that clause invites.

What is unsettled deserves saying so. Clause 2.1.1 makes certification eligible for transfer where covered by an IAF or Regional MLA signatory's accreditation at Level 3 and, where applicable, Levels 4 and 5 — the Regional limb being why the APAC AIMS listing is material rather than trivia. "Where applicable" does visible work too: Global ACI's expansion document — the procedure for adding scopes to the arrangement, not a transfer rule — classifies management system certification as Category 2, requiring Level 5 endorsement, yet notes recognition may in some cases be granted where no Level 5 normative document has been identified for a Level 3 standard.

Supplier-risk practice applied to an auditor, priced like any switching cost — exit-cost modelling transfers directly, and third-party risk work stopping at cloud providers has stopped early.

The Long Game: Building for the Row That Is Not There Yet

The picture on 2026-09-05 is a snapshot with a direction of travel: accreditation bodies accrediting to 42001 from early 2025, ISO/IEC 42006 published to govern how, a regional cooperation already listing AIMS, and an eight-month-old global arrangement that has not added the row. A table not caught up, not a standard excluded.

The design consequence: if the row arrives, whoever holds a continuous audit record benefits immediately and whoever holds a binder starts from zero. So build for it — scope manifest in version control, nonconformity register live with open items, every FMRA-001 lookup dated so the claim ages visibly.

Sovereignty is what makes it tractable. On infrastructure you own, the certified boundary is a set of facts you can enumerate, label and test in CI — nobody else defines it or moves it between audits, and the return is answers you generate rather than request. The standing cost is small: one manifest, one drift check, four calendar dates, one dated lookup per procurement answer. Over a decade that separates an organisation answering a change of body with a record from one that runs a programme every time.