ISO 42001 Certification Timeline: How Long Does It Take in Australia?

You’re considering ISO 42001 certification and want a straight answer: how long will this take? The honest response is it depends—but we’ll break down exactly what to expect.

The Big Picture: 6 to 18 Months

Most organisations in Australia need between 6 and 18 months from kickoff to hold a valid ISO 42001 certificate. KPMG Australia, the first company worldwide to achieve certification (achieved in October 2024), launched their effort in February 2024—a five-month sprint. But KPMG is exceptional: they had internal AI governance foundations already in place and dedicated resources. For most businesses, plan for a longer journey.

The timeline depends heavily on three variables: how mature your current AI governance is, how many AI systems you’re bringing into scope, and whether you have a skilled internal team or need external support.

Phase Breakdown: What Each Stage Takes

ISO 42001 certification follows a predictable structure. Here’s what a realistic timeline looks like:

Gap Analysis (4–6 weeks)

This is the foundation-setting phase. An external auditor or consultant reviews your current AI practices, documentation, and risk controls against ISO 42001 requirements. They’ll identify what you already have and what’s missing. For most organisations, this reveals more gaps than expected—especially around impact assessment processes, supply chain oversight, and ongoing monitoring controls.

Implementation Phase (3–9 months)

This is where the real work happens. You’ll develop your AI Management System (AIMS), which includes policies, risk assessment procedures, impact assessments, control documentation, and staff training. Why the wide range? A simple, single-product fintech might finish in 3–4 months. A large enterprise with 20+ AI systems across multiple departments could need 9 months or longer.

A 250-person professional services firm typically takes 6–7 months here. They need to document controls for AI used in client delivery, administrative decisions, and recruitment. The delay usually comes from gathering AI system information scattered across teams and defining ownership for controls that cut across departments.

Pre-Audit Readiness (4–6 weeks)

You conduct an internal audit, verify your documentation is complete and accurate, and train staff on the AIMS. Most organisations find this phase reveals incomplete records that need rework. Plan for some revision cycles.

Stage 1 Audit (1–2 days)

This is a desktop review. The external auditor confirms your AIMS is documented, your scope is clear, and preliminary evidence exists that controls are in place. It’s quick but not trivial—your team needs to be ready to answer detailed questions about how you’ve implemented each requirement.

Stage 2 Audit (2–5 days)

This is the full, on-site assessment. The auditor observes how your AIMS actually works in practice, reviews real AI impact assessments and risk registers, interviews staff, and verifies that the controls you’ve documented are genuinely operating. A smaller organisation might complete this in 2 days; a large enterprise could take 5.

Certificate Issuance (2–4 weeks)

After Stage 2, the auditor prepares their report. Assuming no major non-conformances, your certificate is issued within 2–4 weeks. Non-conformances (either major or minor) extend this timeline—you’ll need to remediate, provide evidence, and get auditor sign-off before the certificate is released.

What Actually Speeds Up or Slows Down Your Timeline

The phases above are averages. Here’s what makes the real difference:

Speed factors: Strong existing AI governance, an experienced internal team, clear AI system inventory, executive sponsorship, and external consulting support. If you’ve already documented AI systems and risk controls, you’re ahead. If your organisation is structured with clear AI ownership, implementation is faster.

Delay factors: AI systems already deployed without documented controls, scattered risk assessments across teams, staff resistance to new processes, limited internal AI expertise, and competing business priorities. The hidden killer? Discovering mid-implementation that critical AI systems weren’t on your inventory—suddenly you need to re-scope and restart documentation.

Think of it like this: ISO 42001 certification isn’t building from scratch; it’s establishing visibility and governance around AI systems you’re already running. The longer your systems have been running without formal controls, the longer the discovery and documentation phase.

SME vs Enterprise: Realistic Timelines

Small and Medium Enterprise (50–250 staff): Expect 6–12 months. You probably have fewer AI systems, simpler decision-making chains, and tighter communication. Most SMEs in this category finish in 8–9 months with focused effort.

Large Enterprise (500+ staff): Expect 12–18 months. You have multiple AI systems across functions, distributed accountability, and more complex control requirements. Governance maturity matters enormously here—if you already have ISO 9001 or 27001 in place, certification is faster because you understand management system thinking.

A government contractor with 180 staff seeking ISO 42001 for tender eligibility took 9 months. A fintech startup with 35 staff achieved it in 5 months. The startup moved faster partly due to size, but also because they had treated AI governance as urgent from day one.

Can You Speed It Up?

Yes—but only so much. Honest recommendation: allocate at least 6 months if you’re starting from a baseline governance position. If you have minimal AI governance today, 9–12 months is more realistic. Trying to compress below 6 months usually means sacrificing thoroughness, and auditors will catch gaps. You’ll end up remediating after the audit anyway, which defeats the purpose.

The organisations that finish fastest are those that treat the implementation phase like a project: assign a dedicated lead, set monthly milestones, and secure buy-in from teams owning AI systems.

After Certification: Ongoing Commitment

Your ISO 42001 certificate is valid for three years. But the journey doesn’t stop there. You’ll undergo surveillance audits at 12-month intervals (Years 2 and 3), and a full recertification audit in Year 4. Surveillance audits are lighter—roughly 30–50% of the initial audit duration—but they still require active management system maintenance.

FAQ

How long does ISO 42001 certification typically take in Australia?

Most organisations need 6 to 18 months from kickoff to achieve ISO 42001 certification, depending on current AI maturity and resource availability. KPMG Australia achieved it in five months, but they had exceptional internal foundations in place.

What speeds up or slows down the ISO 42001 certification process?

Factors that speed up certification include strong internal AI governance, experienced consultants, dedicated teams, and mature existing risk management. Factors that slow it down include AI systems already in production without controls, scattered documentation, resistance to process change, and limited internal expertise.

Should my SME expect a different timeline than a large enterprise?

Yes. SMEs typically move faster (6–12 months) because they have smaller scope and fewer AI systems to govern. Enterprises often take 12–18 months due to broader AI footprint, more stakeholders, and complex risk landscapes.

Ready to Start Your Certification Journey?

The timeline for ISO 42001 certification in Australia is achievable—six to eighteen months depending on your starting point. The key is honest assessment upfront: understand your AI footprint, secure executive support, and plan for the implementation phase as the longest stretch. Organizations that succeed are those that commit to the process and treat AI governance not as a compliance checkbox, but as essential risk management.

If you’re ready to explore your ISO 42001 pathway, we’re here to help. Contact us to discuss your timeline and roadmap.