ISO 42001 certification, for companies that build or use AI.
Show clients and regulators that your AI is governed responsibly. We set up your AI management system, prepare the documents and stay with you through the certification audit.
- Typical timeline
- 4 weeks
- Certificate valid for
- 3 years
- Current version
- ISO/IEC 42001:2023
- Pricing
- Quote on request
What's involved
Six pieces of work. We do the heavy lifting on each.
- 01
Scope and AI inventory
We list the AI systems you build or use and agree what the certificate will cover.
- 02
AI risk and impact assessment
We assess the risks each system creates for your business and for the people it affects.
- 03
Policies and documentation
We draft your AI policy, procedures and the Statement of Applicability, then review them with your team.
- 04
Controls and training
We help you put controls in place for data, transparency and human oversight, and brief your staff.
- 05
Internal audit and review
We run the internal audit and management review the standard requires, and close any gaps found.
- 06
Certification audit
We support you through the certification body's audits until the certificate is issued.
Timeline
Typically 4 weeks, start to certificate
A typical plan looks like this. The exact schedule depends on how many AI systems you have, your scope and how much is already in place.
What we need from you
We prepare the documents; you supply the facts.
- A list of the AI systems, models and tools you build, sell or use, and what each is for
- The data behind them: where it comes from and who owns it
- Who develops, approves and monitors AI in your company
- Existing AI, security and privacy policies, including ISO 27001 documents if you are certified
- Client contracts or commitments that mention AI
- Company registration certificate and organisation chart
- A management representative as our point of contact
Questions we get asked
Is ISO 42001 mandatory?
No. It is a voluntary standard. It is quickly becoming something clients and partners ask for when AI touches their data or their customers.
Is it the same as ISO 27001?
No. ISO 27001 covers information security. ISO 42001 covers how AI is governed. They share the same structure, so they work well together.
Do we need ISO 27001 first?
No. You can certify to ISO 42001 on its own. If you already hold ISO 27001, much of the groundwork is reusable.
We only use AI tools, we do not build them. Does it apply?
Yes. The standard covers organisations that use AI as well as those that develop or provide it. The scope decides how much work is involved.
How long is the certificate valid?
Three years, with a surveillance audit each year in between. We support you through those as well.
What does it cost?
It depends on headcount, the number of AI systems and scope, so we quote for each company.
Ready for ISO 42001? Let's start.
Tell us what AI you build or use and your headcount. We will reply with a plan and a quote.