ISO/IEC 42001:2023 (the "AI Management System" standard) is the first internationally recognized management system standard designed specifically for organizations that develop, deploy, or use artificial intelligence systems. The standard was published in December 2023 by ISO/IEC JTC 1/SC 42, and adoption has accelerated through 2024 and 2025 as AI-specific regulation has emerged (EU AI Act, US AI Executive Order, UK AI Safety Institute framework, Singapore AI Verify, Canada AIDA) and as enterprise buyers have begun including ISO 42001 certification status in vendor risk questionnaires. A customer that has completed an ISO 42001 certification through an accredited certification body has made attestable claims about their AI governance objectives, AI risk management process, transparency and explainability commitments, human oversight mechanisms, data and resource management for AI, and continual improvement of the AI management system.
From a customer-success and testimonial-wall perspective, an ISO 42001 certification milestone differs structurally from the SOC 2 audit, ISO 27001 certification, HITRUST CSF certification, and NIS2 compliance milestones in five ways. First, ISO 42001 is a management system standard, not a controls-attestation report — it certifies the existence and operation of an AI management system, not the absence of specific AI risks. Second, the standard's scope is defined per-organization in the Statement of Applicability and the AI system inventory, which means certification scope must be communicated explicitly. Third, ISO 42001 references and integrates with the AI risk taxonomy in ISO/IEC 23894 and the AI impact assessment in ISO/IEC 42005, and testimonial language about "AI risk management" implicates both reference standards. Fourth, the standard's transparency and human-oversight clauses (clauses 6.1.4, 8.4, 9.4) create disclosure expectations that interact with the testimonial wall — a customer that claims robust human oversight in a testimonial must be able to point to a documented oversight mechanism. Fifth, the certification has a three-year validity window with annual surveillance audits, and testimonial language must reflect the current audit status rather than the initial certification date in perpetuity.
This guide separates the ISO 42001 certification journey into five phases, explains the testimonial-wall risks in each phase, and provides per-phase playbooks calibrated to the standard's specific AI-management-system mechanics and the certification body's expectations.
The five phases of an ISO 42001 certification
A typical ISO 42001 certification journey for a mid-sized organization with a moderate AI system inventory runs nine to fifteen months from initial scoping to issued certification.
Phase 1: AI system inventory and scope definition. The customer inventories its AI systems (including third-party AI components and AI features in vendor products), classifies each system by risk level (using the standard's risk-tier framework or an equivalent), and defines the certification scope. The phase produces the Statement of Applicability and the AI system register.
Phase 2: AI management system design and documentation. The customer designs the AI management system policies, the AI risk management process, the human oversight framework, the transparency and disclosure procedures, the data governance framework, and the supplier management process. The phase produces the AI management system documentation suite.
Phase 3: Implementation and operational evidence. The customer operates the AI management system for at least three months (and typically six months) to generate operational evidence — risk assessments, oversight logs, incident records, change management records, supplier evaluations, training completions. The phase produces the evidence base for the certification audit.
Phase 4: Stage 1 and Stage 2 audits. The certification body conducts a Stage 1 audit (documentation review) and a Stage 2 audit (on-site evidence review). The auditor produces an audit report, identifies any nonconformities, and submits the certification recommendation to the certification body's decision committee. The phase produces the certification decision.
Phase 5: Certification maintenance and surveillance. The customer maintains the AI management system through annual surveillance audits, addresses any minor nonconformities from the certification or surveillance audits, and prepares for the three-year recertification cycle. The phase has no end-date and produces a steady-state audit-and-evidence cycle.
Each phase has distinct testimonial-wall risks and opportunities. The largest risk across all phases is the conflation of "we have an ISO 42001-certified AI management system" with "our AI systems are safe." The standard certifies the management system, not the systems themselves, and the testimonial wall must reflect the distinction.
Per-phase playbook for the testimonial wall
Phase 1: AI system inventory and scope definition
During the inventory and scope definition phase, the testimonial wall faces a premature-claim risk and a scope-ambiguity risk.
First, do not publish any testimonial that references "ISO 42001" until certification is issued. A customer that has engaged a certification body and started the journey is in pre-certification state. Public statements that imply certification create misrepresentation risk against the certification body's marking rules and against the customer's auditor relationship. The remediation is to defer all ISO 42001-specific testimonial publication until at least Phase 4 issuance.
Second, prepare for scope disclosure. The Statement of Applicability defines which AI systems are in scope and which are out of scope. A testimonial that names "AI systems" in general while the certification scope covers only a subset creates an implicit scope misrepresentation. The remediation is to draft testimonial copy that explicitly references the certified scope (for example, "our customer-facing recommendation systems" rather than "our AI").
Phase 2: AI management system design and documentation
During the design and documentation phase, the testimonial wall faces a process-versus-outcome risk and a third-party-AI risk.
First, prepare to communicate management system maturity, not AI safety. The customer is building governance processes, not directly improving the safety of individual AI systems. Testimonial language that says "ISO 42001 helped us make our AI safer" is technically defensible only if the management system has driven specific risk reductions, and the claim should be supported by documented evidence. The remediation is to draft testimonial copy that focuses on governance maturity, human oversight, transparency, and risk management process — not on AI safety as an outcome.
Second, treat third-party AI components carefully. Most organizations build on third-party foundation models, fine-tuning APIs, or AI-augmented vendor products. The customer's ISO 42001 certification covers their management of these third-party components, but it does not certify the third-party systems themselves. Testimonial language that says "we use ISO 42001-certified AI from Vendor X" is a misstatement unless Vendor X holds its own certification. The remediation is to limit testimonial claims to the customer's own management practices.
Phase 3: Implementation and operational evidence
During implementation and evidence generation, the testimonial wall faces an incident-disclosure risk and a pre-audit-claim risk.
First, treat AI incident logs as confidential. The ISO 42001 standard requires AI incident management (clause 10.1), and the customer will have a log of incidents, near-misses, and corrective actions. Public statements that quote from the incident log, or that imply zero incidents, create risk. The remediation is to publish no incident-specific content and to draft incident-related testimonial copy at the level of process ("we have a documented AI incident management process") rather than at the level of count ("we have had no AI incidents").
Second, do not pre-announce certification. Even when the implementation phase is complete and the Stage 2 audit is scheduled, the certification is not yet issued. Pre-announcement creates risk if a major nonconformity surfaces in the audit and certification is delayed. The remediation is to defer announcement until the certification body has formally issued the certification.
Phase 4: Stage 1 and Stage 2 audits
During the audit phase, the testimonial wall faces a nonconformity-disclosure risk and an auditor-relationship risk.
First, treat the audit report as confidential. The Stage 1 and Stage 2 audit reports may identify minor nonconformities, observations, or opportunities for improvement. Even when certification is ultimately issued, the existence of nonconformities should not be referenced in marketing copy without explicit auditor and certification body consent. The remediation is to draft testimonial copy that references the certification outcome, not the audit-process details.
Second, do not name the certification body or the auditor in marketing without consent. Certification bodies have specific rules for marking and reference, and individual auditors typically have client-confidentiality policies. The remediation is to follow the certification body's published marking rules and to seek explicit consent before naming individuals.
Phase 5: Certification maintenance and surveillance
During certification maintenance, the testimonial wall faces a temporal-validity risk and an evolving-AI-system risk.
First, communicate current certification status. The certification is valid for three years with annual surveillance. A testimonial published in year one of the certification but visible in year four (after recertification or after lapse) creates a stale-attestation risk. The remediation is to date-stamp testimonial copy that references certification and to include a process for refreshing copy at each surveillance audit and recertification.
Second, manage scope drift. The customer's AI system inventory evolves between surveillance audits — new systems are added, existing systems are modified or retired, third-party dependencies change. Testimonial copy that implies a stable certified-AI portfolio can become inaccurate as the portfolio evolves. The remediation is to write testimonial copy at the management system level (governance practices, human oversight processes, risk management framework) rather than at the system level, which is more durable across portfolio change.
What to publish and what to omit
Testimonials about an ISO 42001 certification should publish: the existence of the certified AI management system, the broad category of AI systems in scope (without naming individual systems unless customer counsel approves), the customer's investment in governance and human oversight, the discipline of the documented risk management process, and the value of the certification for buyer trust and regulatory readiness.
Testimonials should omit: specific incident counts, audit report quotations, certification body or auditor names without consent, claims about the safety or performance of individual AI systems, claims about third-party AI vendors' certification status, and implicit certification claims for AI systems outside the Statement of Applicability scope.
The ProofShow approach to ISO 42001 testimonials emphasizes management system maturity, governance investment, and buyer-trust outcomes — three claim categories that are both attestable from the certification and durable across the certification lifecycle. For broader context on compliance-milestone testimonials, see the SOC 2 audit playbook and the HITRUST CSF certification playbook.