1. Certification application & application review

The organization contacts GIC Vietnam for guidance and provides information on the AIMS scope, role in the AI value chain, AI systems/use cases, products and services, sites, personnel, life-cycle stages performed, technologies and models, data sources, cloud infrastructure, suppliers, risks/impacts, legal and contractual requirements, and integrated management systems. GIC Vietnam reviews the application to determine the scope, specialist competence, audit duration, sites and audit conditions, and then agrees on the certification fees and contract.

2. Audit planning & preparation

GIC Vietnam establishes the certification programme, appoints an audit team with competence appropriate to the organization's role, AI technologies, use cases and types of impact within the scope, and prepares a detailed audit plan. The plan defines the objectives, scope, criteria, sites, timing, life-cycle processes and AI systems to be sampled. It is communicated to enable the organization to prepare policies, risk and impact records, the Statement of Applicability, technical documentation, data, supplier records, personnel and necessary access rights.

3. Audit process

The audit is conducted in two stages:

• Stage 1: Review the context, roles, scope and AIMS policy; risk and impact assessment methodologies; treatment plans and the Statement of Applicability; document controls, internal audits, management review and readiness for the Stage 2 audit.
• Stage 2: Evaluate the implementation, conformity and effectiveness of the AIMS at the sites, processes and AI systems covered by the certification scope. Sampling focuses on governance and accountability; risk and impact assessment; data and resources; requirements, design, development, testing, deployment, monitoring, changes and decommissioning; transparency, human oversight, suppliers, feedback, incidents and corrective action. The main activities include: Opening meeting → Interviews and record review → Observation, demonstration and system sampling → Consolidation of findings → Closing meeting.

4. Audit report & nonconformity handling

The audit team prepares a report setting out its conclusions and any nonconformities identified. Where necessary, the organization must immediately control affected systems, outputs, data or processes; take immediate action such as increasing human oversight, restricting use, rolling back a version or suspending operation; assess risks and impacts and notify relevant parties where applicable; analyze root causes and propose and implement corrective actions within the specified timeframe. GIC Vietnam reviews the evidence and may conduct a follow-up audit before certification review.

5. Review & certification

A person independent of the audit team reviews the complete file, audit report, corrective-action evidence and conclusions concerning the effectiveness of the AIMS, and makes the certification decision. When the file meets all requirements, GIC Vietnam makes the decision and issues an ISO/IEC 42001:2023 certificate clearly identifying the roles, products/services, activities and sites covered by the scope. The certificate remains valid throughout a three-year certification cycle, provided that the organization maintains conformity and completes the required surveillance audits.

6. Periodic surveillance and recertification

During the certification cycle, GIC Vietnam conducts periodic surveillance audits to confirm that the AIMS continues to be maintained and remains effective. The first surveillance audit is conducted no later than 12 months from the date of the initial certification decision. The organization must notify GIC Vietnam of significant changes to the scope, roles, AI systems/use cases, models, data, technologies, suppliers, sites, legal requirements, ownership, or serious incidents that may affect certification. Before the certificate expires, the organization undergoes a recertification audit for renewal into the next certification cycle.