The phases and what they consume
Foundation (1 to 3 months): complete AI system inventory (including the embedded and shadow uses), define scope and your role per system, write the AI policy, run risk and impact assessments, and produce the Statement of Applicability. Operation (2 to 4 months minimum): lifecycle controls, data management, monitoring, and oversight must run and leave records: evaluation results before deployments, oversight decisions, incident handling, supplier reviews. Auditors certify evidence of operation, not architecture diagrams. Certification (1 to 2 months): Stage 1, gap closure, Stage 2, findings closure, decision.
What compresses the timeline
- An existing ISMS. ISO 27001 holders reuse the management machinery (document control, internal audit, management review, corrective action) and extend it with AI-specific content; that is where the 4-month cases come from.
- A narrow, honest scope. Certify the AI products and uses your customers care about; expand scope at surveillance later. Boiling the whole organization's every AI experiment into scope adds months for no commercial return.
- Engineering evidence you already have. Mature ML teams already run evaluations, version models, and monitor behavior; the AIMS largely formalizes ownership and review around existing artifacts.
What stretches it
Discovering the real AI inventory (always larger than anyone believed), first-ever impact assessments for high-stakes systems, supplier contract reviews for model providers, disagreement about risk acceptance that surfaces governance gaps leadership must actually resolve, and part-time ownership. The pattern from every management standard holds: systems led by a named owner with allocated hours finish in half the time of side-project implementations.
A note on doing it during the land-grab
Because the standard is young, early certificates carry outsized signaling value: being the certified vendor while competitors answer questionnaires with essays is a real sales asset. The honest way to capture that speed is scope discipline plus an experienced certification body, never a mill; the buyers driving this demand are precisely the ones who check what is behind the certificate.