ISO 42001

What is ISO 42001?

An international standard (ISO/IEC 42001:2023) published by ISO and IEC in December 2023, scoped to an organization's Artificial Intelligence Management System (AIMS). It applies to any organization of any size or sector that develops, provides, or uses AI, and it governs how AI is managed across its lifecycle rather than setting rules for individual AI applications.

Is ISO 42001 a certification or an attestation?

ISO 42001 is a certification. An accredited certification body audits the AI management system and issues a certificate valid for three years. ISO itself certifies nobody. Three claims get confused here: a certified organization was audited by an accredited body, a compliant one usually assessed itself, and a lead auditor certificate belongs to a person.

Who can actually certify your organization to ISO 42001?

Only a certification body that a national accreditation body such as ANAB, UKAS, or RvA has accredited for AI management systems. Accreditors assess those bodies against ISO/IEC 42006, published in July 2025, which adds competence and audit-time requirements for ISO 42001 certification. ISO certifies nobody. AWS and Anthropic were each certified this way, by an ANAB-accredited body. Most search results for this question sell training courses to individuals instead.

Firms that sell ISO 42001 readiness or implementation work

17

A firm appears in the table above only when its accreditor's own record (ANAB, IAS, or SCC) names ISO/IEC 42001 in scope, checked on the date shown. The readiness count comes from firms' own sites. A body missing from the table can still be accredited, because our auditor directory does not list every certification body. There is no public count of certified organizations either, so any global certificate total quoted without a source is guesswork.

Who needs ISO 42001?

Companies that build, embed, or resell AI and are now being asked how they govern it. That means AI vendors facing enterprise procurement questionnaires, teams preparing for the EU AI Act, and organizations already certified to ISO 27001 that want one management system covering information security and AI together.

What happens during an ISO 42001 certification audit?

The same two-stage shape as ISO 27001, because both are certified under the same accreditation rulebook, followed by annual surveillance and a three-year recertification cycle. The detail below comes from certification bodies and consultancies rather than from the standard, whose text is paywalled.

Check the certification body's accreditation first

Four checks, in this order. 1. Find the body in its accreditor's directory (ANAB, IAS, UKAS, or SCC) and open its scope of accreditation. 2. Confirm ISO/IEC 42001 is in that scope, not only ISO 27001. 3. Match the accredited legal entity to the entity on your proposal, because several firms certify through a separate company (BARR Certifications LLC, Coalfire Certification, Inc., Armanino Certified, LLC). 4. Do not rely on IAF CertSearch for this. As of 6 October 2026 it does not show ISO/IEC 42001 in bodies' accredited scopes: A-LIGN, ANAB-accredited for ISO 42001 since October 2024, appears there with ISO 27001 and 27701 only, so a missing entry proves nothing. ISO published ISO/IEC 42006 in July 2025 to set the competence requirements these bodies must meet, which is why accredited capacity only became widely available through 2025 and 2026.

Stage 1: documentation review

The body reviews the AI policy, the scope of the management system, the AI risk and impact assessment, and the Statement of Applicability that justifies which Annex A controls apply and which are excluded. Usually remote, one to two days, and it ends in a list of gaps to close.

Stage 2: certification audit

Weeks to a couple of months later, auditors test whether the system actually operates as documented, sampling evidence and interviewing staff. A pass leads to the three-year certificate.

Surveillance audits (years 1 and 2)

Narrower annual audits, each roughly a third the length of the initial audit, confirm the system keeps operating. A major nonconformity can suspend or withdraw a certificate that has not yet expired.

Recertification (year 3)

A full audit renews the certificate for another three-year cycle. Let a certificate lapse and the next one starts again at Stage 1.

What does ISO 42001 cost and how long does it take?