How to Become an ISO 42001 Lead Auditor (2026 Route)
Six steps to becoming an ISO 42001 lead auditor: background, course, exam, audit hours, personnel certification and CPD, with PECB grades and BSI UK fees.
Eren İŞMAN · Lead Trainer, MEGADEMİ
Türkçe okuTo become an ISO 42001 lead auditor, you follow six steps: build a background in management system auditing and AI, take a full 4- to 5-day lead auditor course or a 3-day conversion course, pass the exam, log audit experience on AI management systems (AIMS), apply for personnel certification, then keep it current through CPD. The bar has risen. ISO/IEC 42006:2025 now sets competence criteria for each AIMS certification role, on top of ISO/IEC 17021-1 (ISO).
This guide is for management system auditors, often already ISO 27001 or ISO 9001 lead auditors, and for GRC and AI governance professionals in the UK and internationally. A Turkish version of this guide is also available.
Photographs in this article are illustrative and AI-generated; the diagram is an original MEGADEMİ graphic.
Key takeaways
- Six steps: background, course, exam, logged audit experience, personnel certification, then CPD and renewal.
- Three different credentials: a course certificate, an exam result and personnel certification are not the same thing, and only the last is a registered auditor grade.
- Experience counts: under the PECB scheme, the Lead Auditor grade needs 5 years of experience, including 2 in AI, and 300 hours of AIMS audit activity (PECB).
- Shorter route for existing lead auditors: 3-day conversion courses exist, but BSI UK requires a current lead auditor certificate in another management system standard.
- Competence is now defined: ISO/IEC 42006:2025 sets competence criteria for each AIMS certification role, so a course certificate alone is not enough to audit for a certification body.
What does an ISO 42001 lead auditor do?
An ISO 42001 lead auditor plans, leads and reports audits of an AI management system against ISO/IEC 42001:2023. ISO describes 42001 as "the world's first AI management system standard". It sets requirements for establishing, implementing, maintaining and continually improving an AIMS (ISO). The lead auditor manages the audit team, decides on findings and signs off the report.
The audit covers two parts of the standard:
- Clauses 4 to 10. These are the requirements, written in the harmonised structure shared with ISO 9001 and ISO/IEC 27001: context, leadership, planning, support, operation, performance evaluation and improvement. Clause 6 includes the risk assessment, risk treatment and AI system impact assessment requirements.
- Annex A. BSI describes Annex A as 38 controls across 9 areas. Annex B gives implementation guidance for those controls (BSI).
Three other standards shape how the work is done:
- ISO/IEC 17021-1:2015 sets the principles and requirements for the competence, consistency and impartiality of bodies that audit and certify management systems (ISO).
- ISO/IEC 42006:2025 adds requirements on top of 17021-1 for bodies that audit and certify an AIMS. BSI notes that it provides "specific competence criteria for personnel of the AIMS certification bodies", including "detail on the level of expertise needed for each relevant AIMS role" (BSI).
- ISO 19011:2026, published on 27 May 2026, gives the guidelines for auditing management systems, including how to evaluate auditor competence (ISO). Our summary of what changed in ISO 19011:2026 covers the new competence expectations.
For a fuller overview of the standard itself, see our ISO 42001 standard page.
The route step by step
The route has six steps, and the order matters because personnel certification bodies check each one. No single body owns the route, so this sequence is a neutral summary built from the PECB scheme, ISO/IEC 42006:2025 and ISO 19011:2026. For the general route across standards, see our guide on how to become a lead auditor.
- Build your background. You need two kinds of knowledge: management system auditing and AI. Auditing experience on ISO 9001, ISO/IEC 27001 or another standard gives you method. AI knowledge covers how systems are designed, trained, deployed and monitored.
- Take a course. Choose a full lead auditor course of 4 to 5 days, or a 3-day conversion course if you already hold a lead auditor certificate in another standard.
- Pass the exam. Lead auditor courses usually include an exam; PECB, for example, runs its exam on day 5 of a 5-day course (PECB).
- Log audit experience. Record the hours you spend on AIMS audits, including your role and the audit activities, because certification bodies ask for evidence.
- Apply for personnel certification. Apply to a personnel certification body such as PECB or Exemplar Global for the grade your experience supports (confirm Exemplar Global's current AIMS grades with them first).
- Keep it current. Maintain your grade through CPD and renewal. Our guide to lead auditor certification renewal and CPD explains how this usually works.
Three credentials people confuse
Finishing a course, passing an exam and holding personnel certification are three separate credentials. They are easy to confuse, which causes problems when a certification body checks competence.
| Credential | Who issues it | What it shows | What it does not show |
|---|---|---|---|
| Course certificate | The training provider | You attended and completed the course | That you passed a scheme exam or have audit experience |
| Exam result | The training provider or the personnel certification body, depending on the scheme | You met the pass mark on the knowledge assessment | That you have logged audit hours or hold a registered grade |
| Personnel certification | A personnel certification body, such as PECB or Exemplar Global | Your training, exam, experience and ethics commitment were assessed against a published grade | That you are competent for every AIMS role a certification body assigns under ISO/IEC 42006 |
Exemplar Global shows how the layers fit. Exemplar-certified training gives competency-unit certificates. BSI LearnCentral's ISO/IEC 42001 internal auditor listing names the units "AI: Artificial Intelligence Management Systems" and "AU: Management Systems Auditing". Auditor certification is a separate application. If you are unsure where you stand, our article on auditor vs lead auditor explains the role difference.
PECB experience requirements by grade
PECB is the only scheme we could verify with published ISO/IEC 42001 auditor grades. Each grade requires the PECB exam and acceptance of the PECB Code of Ethics. The grades differ by work experience and AIMS audit hours (PECB). For how these requirements compare across standards, see our guide to lead auditor requirements.
| Grade | Work experience | AIMS audit experience | Also required |
|---|---|---|---|
| Provisional Auditor | None | None | Exam and PECB Code of Ethics |
| Auditor | 2 years, including 1 in AI | 200 hours | Exam and PECB Code of Ethics |
| Lead Auditor | 5 years, including 2 in AI | 300 hours | Exam and PECB Code of Ethics |
| Senior Lead Auditor | 10 years, including 7 in AI | 1,000 hours | Exam and PECB Code of Ethics |
The PECB course also carries 31 CPD credits.
Other schemes are not yet clear. At the time of writing, Exemplar Global has not published AIMS auditor grades that we could verify, so confirm the current requirements directly with Exemplar Global before you apply. Our note on Exemplar Global credentialing changes in 2026 tracks the wider scheme changes. At the time of writing we could not find a published IRCA ISO 42001 auditor grade either.
Full course or conversion course?
Choose the full course if you are new to lead auditing, and the conversion course only if you already hold a current lead auditor certificate in another standard. Full ISO/IEC 42001 lead auditor courses run 4 to 5 days. Conversion courses run 3 days and assume you already know audit method.
The conversion prerequisite is strict. BSI UK states: "Delegates must have a current lead auditor certificate in another management system standard." ISOQAR's 3-day conversion requires a lead auditor qualification in another standard, "preferably ISO 9001 or ISO 27001".
| Course type | Length | Prerequisite | BSI UK published price |
|---|---|---|---|
| Full lead auditor course | 4 to 5 days (BSI UK: 4 days) | Check the provider's entry requirements | £2,585 + VAT |
| Conversion course | 3 days | A current lead auditor certificate in another management system standard | £1,965 + VAT |
BSI's full course leads to a BSI Training Academy certificate. Prices change, so check the provider's page on the day you book. ISOQAR did not publish a current price for its conversion course when we checked.
If you are already an ISO 27001 lead auditor
Much of your ISO 27001 experience carries over, but the AI-specific content is new and needs real study. Both standards use the harmonised structure for clauses 4 to 10, and both pair those clauses with an Annex A of controls. The audit method is the same. The subject matter is not.
| Carries over from ISO/IEC 27001 | New in ISO/IEC 42001 |
|---|---|
| Harmonised structure clauses 4 to 10 | AI system impact assessment |
| Statement of Applicability logic for Annex A controls | The AI lifecycle, from design to retirement |
| Risk assessment and treatment process | Data quality for AI systems |
| Audit method under ISO 19011 and ISO/IEC 17021-1 | Supporting guidance: ISO/IEC 42005:2025 and ISO/IEC 23894:2023 |
Two supporting standards are worth reading before the course. ISO/IEC 23894:2023 gives guidance on AI risk management. ISO/IEC 42005:2025 gives guidance on AI system impact assessment. It was approved in May 2025 and is not certifiable. ISO/IEC 22989:2022 sets out AI concepts and terminology, which helps when you interview engineers.
If you want the shorter conversion route but do not yet hold a lead auditor certificate in another standard, a course such as our ISO/IEC 27001 lead auditor training leads to a lead auditor course certificate in another standard; check that your chosen conversion provider accepts it before booking. As a hypothetical example, an ISO 9001 lead auditor with a current certificate could ask about a 3-day conversion, while a GRC analyst with no lead auditor certificate would take a full course.
What ISO/IEC 42006 means for auditors
ISO/IEC 42006 sets competence criteria for each AIMS certification role, on top of ISO/IEC 17021-1. It was published in July 2025 (ISO). In practice, a certification body has to show that the people it assigns to each AIMS role have the expertise that role needs. A course certificate on its own will not meet that test.
This matters now because accredited ISO/IEC 42001 certification exists. According to BSI press releases, UKAS and RvA accredited BSI for ISO/IEC 42001 certification in November 2025, and ANAB accredited BSI on 10 March 2026. Once accreditation exists, certification bodies need auditors whose AIMS competence they can evidence to their accreditation body.
For you, that means keeping records beyond your certificates. Note which AI systems you audited, what lifecycle stages you examined and which Annex A areas you sampled. ISO 19011:2026 gives guidance on how auditor competence is evaluated, and these records are the evidence an evaluator needs.
ISO 42001 and the EU AI Act
ISO/IEC 42001 certification does not by itself give legal conformity with the EU AI Act. The AI Act is law and ISO/IEC 42001 is a voluntary management system standard. An AIMS can help an organisation structure its AI governance, but the legal obligations still have to be met on their own terms. Auditors should not suggest otherwise in reports or sales conversations.
| Date | Milestone |
|---|---|
| 1 August 2024 | AI Act enters into force |
| 2 February 2025 | Prohibitions and AI literacy obligations apply |
| 2 August 2025 | General-purpose AI (GPAI) obligations apply |
| 2 August 2026 | General application, with exceptions |
| 2 December 2027 | High-risk obligations for Annex III systems apply |
| 2 August 2028 | High-risk obligations for Annex I products apply |
The two high-risk dates were moved by the AI Omnibus amendment, which entered into force on 27 July 2026 (European Commission).
Training with MEGADEMİ
The MEGADEMİ ISO/IEC 42001 lead auditor training is a 5-day Exemplar Global registered course that covers steps 2 and 3 of the route: the course and the exam. You can take it online, in a classroom or in a blended format.
Assessment has two parts: a two-hour invigilated exam and an audit simulation. The pass mark is 70%, with no section below 60%.
Be clear about what you receive. The certificate is a course completion certificate, not personnel certification. To hold a registered auditor grade, you still need to log audit experience and apply to a personnel certification body, as set out in steps 4 and 5 above. The course page lists dates, formats and booking details.
Frequently asked questions
How long does it take to become an ISO 42001 lead auditor?
The course takes 4 to 5 days, or 3 days for a conversion course. The experience takes longer. Under the PECB scheme, the Lead Auditor grade needs 5 years of work experience, including 2 in AI, and 300 hours of AIMS audit activity (PECB). How long that takes depends on your current experience.
Do I need an ISO 27001 lead auditor certificate first?
Not necessarily. You do need a current lead auditor certificate in another management system standard for a 3-day conversion course, according to BSI UK. For a full course, check the provider's entry requirements. ISOQAR's conversion course prefers ISO 9001 or ISO 27001.
How much does ISO 42001 lead auditor training cost?
BSI's published UK prices, checked on 23 October 2026, are £2,585 + VAT for the 4-day lead auditor course and £1,965 + VAT for the 3-day conversion course. Other providers set their own prices, so compare course length, exam format and what the certificate represents.
Who needs ISO 42001?
ISO/IEC 42001 is voluntary. It suits organisations that want a certifiable management system for how they govern AI, and accredited certification is now available. Auditors need it if they want to audit an AIMS, internally or for a certification body.
Summary
Becoming an ISO 42001 lead auditor takes more than a course. You need auditing method and AI knowledge, a course and exam, logged AIMS audit hours, personnel certification and ongoing CPD. Since ISO/IEC 42006:2025, certification bodies have to show role-based AI competence, so keep evidence of your audit work alongside your certificates. Start by checking which course type fits your current qualifications, then confirm the grade requirements with your chosen personnel certification body.
About this guide
- Author: Eren İŞMAN, Lead Trainer, MEGADEMİ; mechanical engineer and lead auditor with more than 25 years of experience.
- Method: prepared with AI assistance; the photo-style images are AI-generated and illustrative. Standard details were checked on iso.org, scheme grades on the PECB website, course prices on BSI's UK pages and AI Act dates on the European Commission website. Where we could not verify a scheme requirement, we say so. Last reviewed: 23 October 2026.
- Disclosure: MEGADEMİ provides ISO auditor training, including the ISO/IEC 42001 courses mentioned in this article. Our course certificate is a course completion certificate, not personnel certification.
- Editorial standards and corrections: we cite primary and named secondary sources only, and we update this guide when standards, schemes or prices change. Send corrections or questions through our contact page.
Sources
- ISO/IEC 42001:2023 Information technology: Artificial intelligence: Management system, ISO, edition 1, published 18 December 2023, accessed 23 October 2026.
- ISO/IEC 42006:2025 Requirements for bodies providing audit and certification of artificial intelligence management systems, ISO, edition 1, published 7 July 2025, accessed 23 October 2026.
- ISO/IEC 42006:2025 product summary, BSI Knowledge, accessed 23 October 2026.
- ISO/IEC 17021-1:2015 Conformity assessment: Requirements for bodies providing audit and certification of management systems, ISO, accessed 23 October 2026.
- ISO 19011:2026 Guidelines for auditing management systems, ISO, edition 4, published 27 May 2026, accessed 23 October 2026.
- ISO/IEC 42001 Lead Auditor, PECB, accessed 23 October 2026.
- ISO/IEC 42001 AI controls implementation training course (on demand), BSI Training Academy, accessed 23 October 2026.
- ISO/IEC 42001 Lead Auditor training course, BSI Training Academy UK, 4 days, £2,585 + VAT, published price accessed 23 October 2026.
- ISO/IEC 42001 Lead Auditor conversion training course, BSI Training Academy UK, 3 days, £1,965 + VAT, published price and prerequisite accessed 23 October 2026.
- ISO/IEC 42001 lead auditor conversion course, ISOQAR, accessed 23 October 2026.
- ISO/IEC 42001:2023 Internal Auditor, BSI LearnCentral, Exemplar Global competency units, accessed 23 October 2026.
- ISO, ISO/IEC 23894:2023, ISO/IEC 42005:2025 and ISO/IEC 22989:2022 catalogue pages, accessed 23 October 2026.
- BSI becomes the first certification body accredited by UKAS and RvA to deliver certification for ISO/IEC 42001, BSI press release, 17 November 2025, accessed 23 October 2026.
- BSI secures ANAB accreditation to certify ISO/IEC 42001, BSI press release, 10 March 2026, accessed 23 October 2026.
- AI Act: regulatory framework on AI, European Commission, page updated 19 October 2026, accessed 23 October 2026.