Adding ISO/IEC 42001: what ISO/IEC 42006 and Accredia require

The three layers

• ISO/IEC 17021-1. The base requirements for any management system certification body.
• ISO/IEC 42006:2025. Published in July 2025. Additional requirements for bodies certifying AI management systems, covering competence, audit time and the audit process. Accredia treats it as a level 4 standard under EA-1/06.
• ISO/IEC 42001. The AI management system standard your clients are certified against.

In Italy, Accredia set out how it accredits these bodies in technical circular DC N° 08/2026 of 19 February 2026. Several Italian bodies, including ACM CERT, RINA and Bureau Veritas, have already been accredited.

Competence is where the work is

Accredia's circular sets out what it expects to see for auditors on this scheme:

• Knowledge of the technical standards, shown through training certificates, or through documented teaching, research or standards committee work.
• Understanding of AI roles, including AI producer, AI provider and AI customer or user.
• Relevant, current operational experience, acquired continuously under modern AI practice, in areas such as machine learning, computer vision, training data management, bias mitigation and model governance.
• Team selection by the client's business sector, using the IAF ID 1 scope codes applied to quality management systems.
• Qualification records for every function, including application reviewers, lead auditors, auditors, technical experts and certification decision makers.

The circular also lists the reference standards auditors are expected to know, from AI concepts, risk, bias and data quality (ISO/IEC 22989, 23894, 24027, the 5259 series) to impact assessment (ISO/IEC 42005) and the governance and security standards around them (ISO 31000, ISO/IEC 38507, 27001 and 27701).

Audit time

Audit duration is set under ISO/IEC 17021-1 together with Annexes A and B of ISO/IEC 42006, which give the calculation method and worked examples. It is a separate method from the IAF MD 5 tables you use for quality and environmental systems, so it needs its own entry in your procedures and your audit time records.

The Accredia accreditation route

The effort Accredia plans depends on what you already hold. Each route also includes one witnessed audit of appropriate duration.

To maintain accreditation, Accredia plans at least one office assessment a year and one witnessed audit in each accreditation cycle, adjusted for risk.

What the document review asks for

Audit checklists and instructions, the qualification criteria and CVs of contract reviewers and auditors, qualification records of technical experts by business sector, the procedure for setting audit time in the commercial process, and your certification management procedures.

Where to start

1. 1

   Map the people you already have. Auditors with information security or privacy management experience are the likeliest starting point, but the circular asks for current AI experience, not adjacent experience.

2. 2

   Write the competence criteria per function. Application review, auditing, technical review and the certification decision each need their own criteria and evidence.

3. 3

   Set your audit time method from ISO/IEC 42006. And record how you apply it, because the document review asks for it.

4. 4

   Decide how you code clients by sector. Team selection follows the client's business sector, so your application review has to capture it.