ISO 42001 certification is a significant achievement. It represents independent, third-party verified evidence that your organisation has a functioning AI Management System built to an internationally recognised standard. For the clients, procurement teams, and regulators asking about your AI governance maturity, it provides a clear and credible answer.

But certification is not the end of the programme — it is the first evidence checkpoint. What comes after is the work that determines whether your AIMS remains meaningful or becomes shelfware: the surveillance audit cycle, the ongoing maintenance of your AI inventory and risk assessments, and the governance of an AI landscape that continues to change faster than almost any other technology area.

This post covers what post-certification AIMS maintenance requires, what the surveillance audit will examine, and how organisations that maintain certification effectively operate their AIMS between audit cycles.

The Surveillance Audit: What It Tests

Most certification bodies operate ISO 42001 under a three-year certification cycle, with surveillance audits at year one and year two, and a recertification audit at year three. The surveillance audit is not a re-run of the certification audit — it is a targeted assessment of whether the AIMS continues to operate as intended and whether the organisation has responded appropriately to changes in its AI environment.

Auditors at surveillance audits typically focus on:

Changes since certification. Has the AI inventory changed? Have new AI systems been deployed? Have existing systems been significantly updated or retrained? Has the deployment context of any system changed? The auditor will look for evidence that the AIMS has tracked these changes — updated risk assessments, revised control documentation, management review records that addressed significant changes.

Internal audit results and follow-up. What did the internal audit find? Were nonconformities identified? Were they addressed within the required timescales? An organisation that ran a pro forma internal audit and recorded no findings will draw scrutiny — some degree of nonconformity identification is evidence that the audit programme is operating honestly.

Management review records. Did leadership conduct a formal management review? What inputs were reviewed (AI incident records, audit results, performance metrics, changes in the AI landscape)? What outputs were produced (decisions about AIMS improvement, resource allocation, scope changes)? Management review records that show genuine engagement with AI governance issues are substantially more convincing than template documents with no material content.

AI incident handling. Have any AI-related incidents occurred? How were they detected, responded to, and documented? What changes to AI systems or controls resulted? Organisations with no incident records over a 12-month period of AI operation should be able to explain why — the absence of incidents is not inherently implausible, but it requires more context than the absence of evidence.

AI Inventory Maintenance: The Hardest Part

In our experience, the most common post-certification problem is an AI inventory that has drifted from reality. New AI systems are deployed without triggering the AIMS update process. Existing systems are updated with new model versions without risk reassessment. Third-party AI vendors change their underlying models, sometimes with limited notice to deployers.

Keeping the AI inventory accurate requires two things: a defined trigger process and an ownership model. The trigger process identifies the events that require AIMS updates — new AI system deployment, significant AI system changes, AI vendor model updates, changes in deployment context, AI-related incidents. The ownership model assigns specific individuals responsibility for initiating AIMS updates when triggers occur.

Without both elements, the inventory degrades. With both, it remains an accurate picture of the organisation’s AI operations — which is the foundation on which all other AIMS controls depend.

Risk Assessment Review Cycles

ISO 42001 requires risk assessments to be reviewed and updated when changes occur. Beyond event-driven reviews, successful organisations also establish periodic review cycles — typically annual — that explicitly revisit each AI system’s risk assessment, regardless of whether a specific change event has triggered an update.

The rationale is straightforward: AI risk is not static even when the system has not changed. The external context changes. Regulatory requirements evolve. New research on model fairness or robustness may be relevant. The population the model operates on may have shifted. A system that was assessed as low risk 12 months ago may have accumulated risk factors that a periodic review would surface.

Preparing for the EU AI Act’s August 2026 Obligations

For organisations certified under ISO 42001, the August 2026 EU AI Act deadline for high-risk systems is best addressed through the AIMS rather than as a separate compliance workstream. The AI inventory and risk classification work that ISO 42001 requires produces the foundation for EU AI Act risk tier assessment. The risk documentation and control evidence the AIMS generates are directly relevant to the EU AI Act technical file requirements.

Organisations that maintain their AIMS rigorously in 2025 and 2026 will approach the August 2026 deadline with significantly more preparation than those treating the two as separate programmes.

At Bitsecura, our post-certification support includes surveillance audit preparation, AI inventory maintenance support, risk assessment review cycles, and EU AI Act gap analysis from your ISO 42001 baseline. We work with organisations throughout their three-year certification cycle — not just at the certification audit. If you have achieved ISO 42001 certification and want support maintaining it effectively, we should talk.

Reach out here to discuss what ongoing AIMS support looks like for your organisation.

Bitsecura provides ISO 42001 AIMS implementation, internal audit, and maintenance services. Learn more about our ISO 42001 services.