IEC International ISO Standard IS0/IEC42006 First edition Information technology Artificial intelligence Requirements 2025-07 for bodies providing audit and certification of artificial intelligence management systems Technologies de I'information Intelligence artificielle Exigences pour les organismes procédant a I'audit et a la certification des systemes de gestion de I'intelligence artificielle Reference number IS0/IEC 42006:2025(en) @ ISO/IEC 2025 IS0/IEC 42006:2025(en) COPYRIGHTPROTECTEDDOCUMENT IS0/IEC2025 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may the internet or an intranet, without prior written permission. Permission can be requested from either IsO at the address below or ISO's member body in the country of the requester. ISO copyright office CP 40i : Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +41 22 749 01 11 Email: [email protected] Website: www.iso.org Published in Switzerland @ IS0/IEC 2025 - All rights reserved i IS0/IEC 42006:2025(en) Contents Page Foreword. ..V Introduction ..vi 1 Scope. .1 2 Normative references .1 3 Terms and definitions ..1 4 Principles .2 5 General requirements . 2 5.1 Legal and contractual matters .2 5.2 Management of impartiality ..2 5.2.1 General. 5.2.2 Conflicts of interest. .2 5.3 Liability and financing 5.3.1 General .3 5.3.2 Liability ..3 6 Structural requirements .3 7 Resource requirements ..3 7.1 Competence of personnel. ..3 7.1.1 General. .3 7.1.2 Generic technical competence requirements ..3 7.1.3 Specifictechnicalcompetencereguirements 7.2 Personnel involved in the certification activities. 7.2.1 General. .7 7.2.2 Demonstrationofknowledgeandexperience 7.3 Use of individual external auditors and external technical experts ..8 7.4 Personnel records ..8 7.5 Outsourcing. ..8 8 Information requirements .8 8.1 Public information. ..8 8.2 Certification documents ..9 8.2.1 General .9 8.2.2 AiMScertificationdocuments. 8.3 Referencetocertificationanduseofmarks .9 8.4 Confidentiality. 8.4.1 General. .9 8.4.2 Access to the documentation of the organization .9 8.5 Information exchange between a certification body and its clients ..9 9 Process requirements 9 9.1 Pre-certification activities. ..9 9.1.1 General. 9.1.2 Audit programme .10 9.1.3 Scope of certification .10 9.1.4 Determining audit time .10 9.1.5 Multi-site sampling.. .10 9.1.6 Multiple management systems .10 9.2 Planning audits. .11 9.2.1 Determining audit objectives, scope and criteria .11 9.2.2 Audit team selection and assignments. .11 9.2.3 Audit plan .11 9.2.4 Deployment of remote audit. 12 9.3 Initial certification. .12 9.3.1 General. .12 @ IS0/IEC 2025 - All rights reserved iii IS0/IEC 42006:2025(en) 9.3.2 Initial certification audit 12 9.4 Conducting audits 13 9.5 Certification decision. 13 9.6 Maintaining certification 13 9.6.1 General 13 9.6.2 Surveillance activities 13 9.6.3 Re-certification 13 9.6.4 Special audits 13 9.6.5 Suspending, withdrawing or reducing the scope of certification .14 9.7 Appeals. .14 9.8 Complaints .14 9.9 Client records. .14 10 Management system requirements for certification bodies 14 10.1 Options. .14 10.2 Option A: General management system requirements .14 10.3 Option B: Management system requirements in accordance with Is0 9001 ..14 AnnexA(normative)Audittime ..15 AnnexB(informative)Examplesforaudittimecalculations .20 Annex C (informative) Template for a certification document .29 Bibliography .31 @IS0/IEC2025-Allrightsreserved iv IS0/IEC 42006:2025(en) Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of IsO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees c