An independent review of how your AI management system stands against the standard: before you certify, when the internal audit is due or when a customer asks for evidence. It is carried out by an ISO 42001 lead auditor trained by AENOR.
ISO/IEC 42001 requires the AI management system to be audited at planned intervals (clause 9.2) and the results to be reviewed by management. If you also want certification, an accredited body will carry out its own external audit. In both cases it helps if someone with an auditor mindset has reviewed the evidence beforehand.
This service is that review: which requirements are met and with what proof, which ones exist only as intentions and what to resolve first.
You want to reach the certification body audit knowing which findings it will raise, with time to close them.
The system has been running for months and you need to meet the internal audit programme and management review without improvising.
A customer asks about your AI governance, or you need to review a critical AI supplier against the standard before signing.
The audit runs against the requirements of clauses 4 to 10 and against Annex A as you have applied it, not against a list of 38 tick boxes. The statement of applicability rules: every control included must be implemented and evidenced, and every exclusion must be justified.
You do not have to implement all 38. The audit covers those in your statement of applicability, together with the justification for those left out.
They are contracted separately. The internal and the pre-certification audit share a method; what changes is the moment and the use made of the report.
The one the standard requires at planned intervals.
A full rehearsal with the approach of a certification audit, following ISO 19011.
Reviewing an AI supplier before depending on it, or one that already serves you.
Four phases, with scope and days agreed before starting.
Which systems and sites are included, what the audit is run against (the standard, the statement of applicability, customer requirements) and who takes part.
Policy, risk and impact assessments, statement of applicability, procedures and records. This is used to prepare the audit plan.
Interviews and evidence sampling in operation, remotely or on your premises, following the ISO 19011 guidelines.
Closing meeting with management, report with findings and an action plan. For an internal audit, follow-up until nonconformities are closed.
A report you can show to management, to a customer or to the certification body, and a plan to resolve what is missing.
Scope and limitsI do not issue ISO/IEC 42001 certificates or carry out certification audits: those are done by accredited certification bodies. The AENOR qualification is AENOR’s own and attests to the programme and its exam; it is not a registration as a certification auditor. For independence, I do not audit a system that I designed or implemented. The work is technical and compliance-focused: it does not replace legal advice and it is not a conformity assessment under the AI Act.
I am Antonio Cebreiro Bernárdez. I hold the AENOR qualification of ISO 42001 Lead Auditor: a 35-hour programme, from 14 to 22 October 2026, with the exam passed, on the internal audit of AI management systems under ISO/IEC 42001 and ISO 19011.
It adds to AENOR training in ISO/IEC 42001 implementation (14 hours) and internal auditing (21 hours), and to my ISO/IEC 27001 Lead Auditor qualification. The rest of my credentials are on my professional profile.
ISO 42001 Lead Auditor
AENOR’s own qualification: it attests that the programme was completed and its exam passed.
The internal audit is required by the standard (clause 9.2) and carried out by the organisation itself or by someone on its behalf, at planned intervals. A pre-certification audit is a rehearsal with the approach of the external audit, but it carries no certificate value. The certification audit is done by an accredited body and is the only one that ends in a certificate. I do the first two; I do not do the third.
They should not. An audit needs independence from what is being audited (it is one of the principles of ISO 19011), and whoever designed or implemented a system would end up reviewing their own work. That is why I keep the engagements apart: if we work together on AI governance, someone else does the audit; if you prefer that I audit, someone else has built the system. I make this clear in the proposal.
Yes, or at least documented and running for some time, because an audit reviews evidence that things are actually done. If it does not exist yet, the starting point is a gap analysis: you can measure it with the ISO 42001 checklist or with the AI cybersecurity consulting service.
Not directly. ISO/IEC 42001 organises AI governance and helps gather evidence, but passing an audit or getting certified does not prove compliance with the AI Act. To know what the Act requires of you, system by system, there is the applicability review. The relationship between the two is explained in the article on ISO/IEC 42001.
It depends on the number of AI systems, the sites and how mature the management system is. Scope and days are agreed before starting, so you know the full cost from the beginning. If you are at the start, the initial diagnostic on the cybersecurity audit page lets you pick ISO/IEC 42001 among the frameworks.
Both. The document review and much of the interviewing are done remotely; if the scope calls for it, the audit is completed on your premises. I travel to Santiago de Compostela, A Coruña and Vigo, as described on the cybersecurity for SMEs in Galicia page.
Tell me where the system stands, whether certification is on the horizon and who is asking for evidence. One conversation is enough to see which type of audit fits and whether the system is ready to be audited.
I reply personally within 24 working hours · No commitment