ISO 42001 Certification Levels Explained

When people say ISO 42001 certification, they can mean two different things, and telling them apart is the first step to understanding the levels. An organization can have its AI management system audited and certified against the standard, a process now overseen by bodies accredited under ISO/IEC 42006, which is what firms such as AWS have achieved. Separately, an individual can earn a professional certification that runs from Foundation up to Senior Lead. This page explains that second ladder: the individual levels, what each one certifies, and how they fit together.

Two kinds of ISO 42001 certification

The confusion is worth clearing up because the two certifications answer different questions. Organizational certification asks whether a company's AI management system meets the standard, and it is granted by an accredited certification body after an audit. Individual certification asks whether a person has the knowledge and capability to work with the standard, and it is earned by completing a course and assessment. The levels in this guide are individual, professional certifications; they build the people who then help organizations reach the organizational kind.

The individual levels, from Foundation to Senior Lead

The individual ladder has a single entry point and then two directions. Everyone begins at the Foundation level, which certifies a working understanding of AI governance and ISO/IEC 42001. From there the ladder splits into building and evaluating. The most popular professional level is the Lead Implementer level, for those who will build and run an AI management system, alongside auditor levels for those who will evaluate one. Each level certifies a distinct capability rather than simply a higher grade of the same thing.

Two tracks: build it or evaluate it

The clearest way to read the ladder is by direction, not just height. After Foundation, you choose a track based on what you will do with the standard.

• The implementer track. Foundation, then Lead Implementer, then Senior Lead Implementer. This is for the people who construct and operate the AI management system.

• The auditor track. Foundation, then Internal or Lead Auditor, then Senior Lead Auditor. This is for the people who test whether the system works and report on it.

The two tracks share a foundation and a common language, which is why an implementer and an auditor can work together even though their certifications point in different directions.

How the tiers build, and what each expects

Across both tracks, the ladder rises through three tiers. The foundation tier assumes nothing in advance. The professional tier, Lead Implementer or Lead Auditor, expects a relevant background and the readiness to apply the standard rather than just understand it. The senior tier is for experienced practitioners leading programs or engagements. Because the expectation grows with the tier, it is worth understanding the experience each tier needs before you choose where to enter, rather than assuming you must start at the bottom or can leap to the top.

The ISO 42001 Certification Levels Map

Put together, the ladder is easiest to hold as a single map: each level, its track, its tier, and the capability it certifies. Use it to place any level in context at a glance. It is available as a one-page download.

Frequently asked questions

What are the ISO 42001 certification levels?

For individuals, the levels run from Foundation, through the professional levels of Lead Implementer and Lead Auditor (with Internal Auditor alongside), up to the senior levels of Senior Lead Implementer and Senior Lead Auditor. Foundation is the shared entry point, after which the ladder splits into an implementer track and an auditor track.

Is ISO 42001 certification for a person or a company?

It can be either, and the two are different. A company earns organizational certification when its AI management system is audited and confirmed to meet ISO/IEC 42001. A person earns individual certification, at one of the levels in this guide, by demonstrating knowledge and capability.

What is the difference between the implementer and auditor tracks?

The implementer track prepares you to build and run an AI management system; the auditor track prepares you to evaluate one. Both start at Foundation and share a common language, but they develop different capabilities and lead to different roles.

Which level should I start at?

Almost everyone starts at Foundation, because it builds the shared understanding the higher levels rely on. From there you choose a track and a professional level based on whether you will build or evaluate an AI management system, and your background.

Do the higher levels need more experience?

Yes. The foundation tier assumes nothing, the professional tier expects a relevant background and readiness to apply the standard, and the senior tier is for experienced practitioners leading programs or engagements. The expectation rises with the tier rather than being a fixed gate.

Putting the ladder to use

The levels are less a hierarchy to climb than a map to navigate: one shared foundation, two tracks, three tiers, each certifying a real capability. Once you can see the whole ladder, choosing where to begin becomes straightforward. Most people start at Foundation and specialise from there, which you can do across the full range of ISO/IEC 42001 certification courses.