If you've looked into ISO/IEC 42001 training, you've probably noticed there are multiple certification options available. Foundation, Lead Implementer, Lead Auditor — and for some people, that immediately raises a question: which one do I actually need?
Having completed both the Lead Implementer and Lead Auditor myself, and having delivered PECB training across all three levels, I can give you a straightforward answer. But first, a quick overview of what each certification covers.
The Foundation certification is the entry point. It is designed for professionals who need a solid understanding of what ISO/IEC 42001 covers, how an AI Management System works, and what the key concepts and terminology mean — but who are not responsible for implementing or auditing one.
It suits people who are adjacent to AI governance: business stakeholders, HR professionals, communications leads, and anyone who needs to understand what their organisation's AI management programme is doing without being the one running it.
The Foundation exam is straightforward. Most people with relevant professional experience can prepare for it in a few focused study sessions.
This is the certification for professionals who are responsible for — or want to be responsible for — building and managing an AI Management System within an organisation.
The Lead Implementer programme goes deep into planning and implementing an AIMS from scratch: conducting a gap analysis, defining scope, performing AI risk and impact assessments, building the policy and control framework, preparing for certification audit, and managing continual improvement.
It is practical, detailed, and demanding. It is also the credential that is appearing most frequently in job specifications for senior compliance, security, and AI governance roles. If you want to do the work of AI governance — not just understand it — this is the certification to pursue.
The Lead Auditor certification is for professionals who audit AI Management Systems — either as internal auditors within their organisation or as third-party certification auditors.
The programme covers audit principles and methodology, planning and conducting AIMS audits, reporting findings, and managing audit programmes. It draws heavily on ISO 19011 (the international standard for auditing management systems) and applies it specifically to the AI management context.
The Lead Auditor qualification is essential if you are working toward a role in certification body auditing, or if your organisation runs a formal internal audit programme and needs qualified AI governance auditors.
My recommendation for most professionals: start with the Lead Implementer.
Here is my reasoning.
The Lead Implementer gives you the deepest practical understanding of how an AI Management System actually works — how it is built, what the controls look like, how risks are assessed, and what good governance looks like in practice. That knowledge is directly useful whether you go on to implement an AIMS, advise organisations on doing so, or eventually audit one.
The Lead Auditor builds on that foundation. When you audit a management system, you are evaluating whether it has been correctly implemented — and it is much easier to do that well if you have first-hand knowledge of what a well-implemented system looks like. Auditors who have done the Lead Implementer first bring a noticeably richer perspective to their audit work.
I did the Lead Implementer before the Lead Auditor, and I'd make that choice again. If you only have time for one certification right now, make it the Lead Implementer.
If you have no prior experience with ISO management system standards — no ISO 27001, ISO 9001, or equivalent background — the Foundation is a useful starting point. It gets you oriented before you invest time and money in a more advanced programme.
If you do have a background in ISO standards, compliance, information security, or AI, you can typically go straight to the Lead Implementer. The foundational concepts will feel familiar enough that you won't be lost.
PECB certifications include experience requirements for full certification. For the Lead Implementer, you need at least two years of professional experience in AI management, with at least one year in a management role. For the Lead Auditor, you need five years of professional experience including two years in AI auditing.
Completing the training programme and passing the exam is the first step. You then submit your experience record for verification before the full credential is issued. If you're early in your career, you can still complete the programme and exam now — your credential will be recognised once your experience meets the threshold.
If you are adjacent to AI governance but not implementing it: Foundation — builds understanding without implementation depth.
If you are building or managing an AI Management System: Lead Implementer — covers full AIMS implementation lifecycle.
If you are auditing AI management systems internally or externally: Lead Auditor — covers audit methodology specific to AIMS.
If you are new to ISO standards generally: Foundation → Lead Implementer — Foundation gives orientation before the deeper programme.
If you are experienced in ISO 27001 or similar standards: Lead Implementer (go direct) — Prior experience means Foundation level will feel basic.
If you're unsure, feel free to drop me a line at jan@fortifyinstitute.com and I'll give you an honest steer based on your background and goals.
ISO/IEC 42001 Lead Implementer — Blended eLearning, Cohort starts 3 July