---
title: "ISO 42001 certification: who certifies, what it costs and whether it is worth it"
canonical: https://www.grcmana.io/blog/iso-42001-decoded
published: 2026-03-22
updated: 2026-10-22
authors: ["Harry West"]
---

# ISO 42001 certification: who certifies, what it costs and whether it is worth it

## Key takeaways

ISO 42001 certification is a voluntary audit of your AI management system by an independent certification body, not by ISO. In the UK, look for a body accredited by UKAS for ISO/IEC 42001. An ISO 27001 holder reuses most of the management system but must add AI impact assessment, lifecycle controls and a new Annex A set. Certify when a customer or tender asks for it by name.

- **Who certifies** — ISO does not itself carry out certification. Independent certification bodies audit management systems and issue certificates, and ISO neither monitors nor endorses them.
- **UKAS accreditation** — UKAS announced its first accreditation for AI management system certification to ISO/IEC 42001:2023 on 15 January 2026, and has since concluded its pilot programme.
- **AI Management Essentials** — DSIT consulted on AIME, a self-assessment tool for SMEs that gives no certification. In February 2026 it said it would refine its approach rather than release AIME as consulted.
- **Presumption of conformity** — Under Article 40 of the EU AI Act, the presumption of conformity comes from harmonised standards published in the Official Journal, not from an ISO 42001 certificate.

An enterprise customer's security questionnaire has a new line: "Describe how you govern AI in your product. Do you hold ISO 42001?" Your team ships AI features every sprint, and the honest answer is a draft policy and one engineer who knows how the models work. This guide explains ISO 42001 certification for UK B2B tech firms of 25 to 250 people.

You will come away knowing who can certify you in the UK, how the audit runs, what an existing ISO 27001 system already covers, what drives the cost, and whether to pursue it now, later or not yet. The short test: if a customer or tender is asking for it by name, it is worth pursuing now.

## What does ISO 42001 certification actually prove?

ISO 42001 certification is a voluntary, independent audit of your AI management system by an accredited certification body. ISO writes the standard but does not certify anyone. A certificate shows that your organisation runs a working system for governing AI. It does not show that any model is accurate, safe or lawful.

If you need the basics first, our [ISO 42001 overview](https://www.grcmana.io/vault/iso-42001) covers what the standard is and who it applies to. This guide starts where that page stops: the decision to certify.

[ISO's help centre](https://help.iso.org/en/articles/380951-how-much-does-a-certification-cost) is direct about its role. ISO "does not itself carry out certification", and it neither monitors nor endorses the bodies that do. The certificate your customer wants comes from a third party, and the value of that certificate depends on who that third party is.

That distinction matters when you answer a questionnaire: promise the management system, and describe your model controls separately.

## Who can certify your company for ISO 42001 in the UK?

In the UK, credible ISO 42001 certification comes from a certification body accredited by UKAS, the national accreditation body. UKAS announced its [first accreditation for AI management system certification](https://www.ukas.com/resources/latest-news/ukas-grants-first-aims-accreditation/) on 15 January 2026, granted after a pilot. Unaccredited bodies can still issue certificates, but enterprise buyers may not accept them.

Three standards sit behind an accredited certificate:

- **ISO/IEC 42001:2023** is the standard your organisation is audited against.
- **ISO/IEC 17021-1:2015** sets the general rules for any body that audits and certifies management systems.
- **ISO/IEC 42006:2025** adds requirements for bodies certifying AI management systems specifically, including the technical competence of their auditors.

UKAS has since [concluded its pilot programme](https://www.ukas.com/accreditation/about/developing-new-programmes/development-programmes/aims/) and now handles AI management system assessments through its normal operations team. That makes accredited ISO 42001 certification a standard UKAS service rather than an experiment.

### How do you check a certification body's UKAS accreditation?

Check the body yourself before you sign. UKAS says organisations accredited for ISO/IEC 42001 can be viewed through its [browse-by-category page](https://www.ukas.com/find-an-organisation/browse-by-category/?cat=3972). Find the body there, open its schedule of accreditation and confirm that ISO/IEC 42001 appears on it, not only ISO 27001 or ISO 9001.

Then ask the customer who raised the question whether they accept certificates from that body. A certificate your buyer will not accept is an expensive way to stay blocked.

## How does the ISO 42001 certification process work?

The ISO 42001 certification process follows the same pattern as other accredited management system audits. You set the scope, run the system long enough to produce records, then pass a two-stage initial audit. The certificate then runs on a three-year cycle, with surveillance audits in between and a recertification audit before it expires.

1. **Set the scope.** Decide which products, AI systems and teams the AI management system covers. A narrow scope tied to the product your customer buys is quicker to certify and easier to defend.
2. **Build and run the system.** Write the AI policy, assess AI risks and impacts, apply the controls you select, then run at least one internal audit and one management review.
3. **Stage 1 audit.** The certification body reviews your documented system and readiness, and tells you what must be fixed before the main audit.
4. **Stage 2 audit.** The auditor tests whether the system operates in practice, sampling records and interviewing the people who run AI systems.
5. **Certification decision.** Once any major nonconformities are closed, the body issues the certificate.
6. **Surveillance audits.** Shorter audits in the following years check that the system keeps running.
7. **Recertification.** A fuller audit before expiry starts the next three-year cycle.

| Stage | What the auditor looks at | What you need ready |
| --- | --- | --- |
| Stage 1 | Scope, documented system, readiness for Stage 2 | AI policy, risk and impact assessments, control selection, internal audit and management review records |
| Stage 2 | Whether the system operates in practice | Records from running the system, people who can explain their AI decisions |
| Surveillance | Whether the system kept running | Records since the last audit, closed corrective actions |
| Recertification | The whole system, before the certificate expires | A full cycle of evidence and improvement |

If you have been through ISO 27001, our [ISO 27001 guides](https://www.grcmana.io/vault/iso-27001) cover the same audit rhythm in more depth. Expect the same structure here, with auditors who also ask how your AI systems are built, deployed and monitored.

## What does an ISO 27001 holder reuse for ISO 42001, and what is new?

An ISO 27001 holder reuses most of the management system. ISO/IEC 42001 follows the same high-level structure as ISO/IEC 27001, so clauses 4 to 10 cover the same ground: context, leadership, planning, support, operation, performance evaluation and improvement. The new work is AI-specific: impact assessment, AI system lifecycle control and a different Annex A control set.

| Area | What you reuse from ISO 27001 | What is new for ISO 42001 |
| --- | --- | --- |
| Context and scope | Scope method, interested parties, legal register | AI systems in scope and your role for each (developer, provider or user) |
| Leadership and policy | Governance forum, management commitment | An AI policy and named accountability for AI decisions |
| Risk | Risk method, risk register, treatment process | AI risks, plus AI system impact assessment for affected people and groups |
| Controls | Statement of Applicability approach | A separate Annex A control set covering AI governance, data and the AI system lifecycle |
| Operation | Change management, supplier management | Lifecycle control from design and data to deployment, monitoring and retirement |
| Evaluation and improvement | Internal audit, management review, corrective action | The same processes, extended to AI objectives and AI incidents |

The AI system impact assessment is the clearest gap. ISO 27001 asks what could happen to your information. ISO 42001 also asks what your AI system could do to the people and groups it affects. An ISO 27001 risk process does not ask for that assessment, so it is usually new work.

Shared clauses save paperwork. They do not save the thinking.

The other gap is ownership. An ISMS often sits with one security lead. An AI management system needs product and engineering owners who can explain how a model was trained, tested and changed. That is the same accountability problem we explore in [who owns AI decisions](https://www.grcmana.io/blog/ai-accountability).

## How much does ISO 42001 certification cost?

No public, primary source sets a price for ISO 42001 certification, and ISO itself says it cannot advise on certification costs. The cost has two parts: the audit fees, which depend on how many audit days the certification body assigns, and your internal effort to build and run the system. Scope drives both.

The audit fee follows the audit time. UKAS reminds certification bodies that ISO/IEC 17021-1 requires them to [determine the audit time for each client](https://www.ukas.com/resources/technical-bulletins/iaf-md5-update/), based on what a complete and effective audit needs. In practice, the drivers are:

- **Scope.** The number of products, AI systems, sites and people inside the boundary.
- **Your role.** Developing and providing AI systems puts more of the lifecycle in scope than using third-party AI services.
- **Existing certification.** A body that already audits your ISO 27001 system may combine audits, which can reduce duplicated time.
- **Readiness.** Stage 1 findings that delay Stage 2 add audit days and internal rework.
- **Internal effort.** Writing impact assessments, running the system long enough to produce records and preparing people for interviews is the larger cost for most small firms.

Get written quotes from more than one accredited body, and ask each for the audit days per stage. Our [ISO 27001 certification cost guide](https://www.grcmana.io/vault/iso-27001/certification-cost) explains how audit days turn into fees, and the same logic applies here.

## Is ISO 42001 certification worth it?

ISO 42001 certification is worth pursuing now if a customer, tender or partner is asking for it by name and the deal value justifies the cost. If buyers ask how you govern AI but do not name the standard, build the system first and certify later. If nobody is asking, start with a self-assessment.

We recommend deciding on the evidence of your own pipeline, not on market noise.

**Certify now when:**

- a live deal or tender lists ISO 42001 as a requirement or a scored criterion;
- your product makes or shapes decisions about people, and enterprise buyers already ask for independent assurance;
- you already hold ISO 27001 and can extend the same system and audit relationship.

**Build now, certify later when:**

- security questionnaires ask about AI governance in general terms;
- you are adding AI features quickly and expect the question within a year;
- you have no named owner for AI decisions yet.

**Not yet when:**

- no customer, investor or regulator has asked;
- AI is a minor internal tool rather than part of what you sell;
- you have no management system of any kind, in which case foundations come first.

A certificate nobody asked for is a cost. The same certificate on the right tender is market access.

## Should a UK firm start with a self-assessment instead?

For many UK firms, a self-assessment against ISO/IEC 42001 is a sensible first step before certification. The UK government consulted on a tool for this, DSIT's AI Management Essentials (AIME), but has not released a final version. Its consultation draft still works as an informal gap check, though it gives no certificate.

DSIT published AIME for consultation in November 2024 as a self-assessment tool aimed mainly at SMEs and start-ups. The [consultation guidance](https://www.gov.uk/government/consultations/ai-management-essentials-tool/guidance-for-using-the-ai-management-essentials-tool) says it draws on ISO/IEC 42001, the NIST AI Risk Management Framework and the EU AI Act, that it "does not provide formal certification", and that completing it does not represent compliance with those frameworks.

In its [February 2026 response](https://www.gov.uk/government/consultations/ai-management-essentials-tool/outcome/guidance-for-using-the-ai-management-essentials-tool-government-response), DSIT said a single tool for every size and role of firm had struggled to meet users' needs. It now plans refined guidance on foundational AI governance, aimed at SMEs. Until that appears, the AIME questions remain a useful checklist, but they are not an official standard to cite to a buyer.

Use a self-assessment as a gap check, then decide. If the gaps are small and a buyer is asking, move to a certification body. If the gaps are large, close them first, because a Stage 1 audit is a costly way to discover them.

## Does ISO 42001 certification mean EU AI Act compliance?

No. ISO 42001 certification supports AI governance, but it is not legal compliance with the EU AI Act. Under Article 40 of the Act, the presumption of conformity comes from harmonised standards whose references are published in the Official Journal of the EU. An ISO 42001 certificate is not that, and it does not discharge the Act's obligations.

The [EU AI Act, Regulation (EU) 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng), ties that presumption to harmonised standards "to the extent that those standards cover those requirements". Providers of high-risk AI systems also need a quality management system under Article 17. A working ISO 42001 system gives you governance, records and accountability to build that on, but the legal test is the Act's, not the standard's.

If you sell AI systems into the EU, read our [EU AI Act overview](https://www.grcmana.io/vault/eu-ai-act) alongside this guide, and treat the two as separate questions.

## What are the common mistakes with ISO 42001 certification?

The common mistakes are choosing a body without checking its UKAS scope, scoping the whole company when one product would do, treating the certificate as proof the AI is safe, and copying ISO 27001 documents without adding AI impact assessment and lifecycle controls. Each one adds cost or weakens the certificate's value with buyers.

- **Accreditation assumed, not checked.** A body accredited for ISO 27001 is not automatically accredited for ISO 42001. Check its schedule.
- **Scope too wide.** Certifying every team and system before a buyer asks for it multiplies audit days and internal effort.
- **Certificate oversold.** Sales teams describe the certificate as proof that the AI is safe or compliant. Neither claim holds, and a buyer's lawyers will notice.
- **Copy-paste ISMS.** Renaming ISO 27001 documents produces a system with no impact assessments and no lifecycle evidence, which Stage 1 will find.
- **No AI owner.** If nobody outside security can explain how a model is changed and monitored, the Stage 2 interviews will expose it.

## Frequently asked questions

### What does it mean to be ISO 42001 certified?

Being ISO 42001 certified means an independent certification body has audited your AI management system against ISO/IEC 42001 and found it conforms within the stated scope. The certificate names that scope. It says nothing about the quality, safety or legality of any individual AI model.

### Can we certify only one product for ISO 42001?

Yes, if the scope is defined clearly and the boundary makes sense to an auditor and to your customer. Starting with the product your buyers purchase keeps the first audit smaller. Check that the scope on the certificate matches what the customer is asking about, or the certificate will not answer their question.

### How can a customer check our ISO 42001 certificate?

A customer will usually ask for a copy of the certificate and check three things: that the scope covers the product they are buying, that the certificate is still in date, and that the issuing body is accredited for ISO/IEC 42001. Keep the certificate, its scope statement and the body's accreditation details ready, so the check takes minutes rather than a follow-up questionnaire.

### Do we need ISO 27001 before ISO 42001?

No. ISO/IEC 42001 can be certified on its own. Holding ISO 27001 first makes the job smaller, because the management system processes already exist, but a firm without it can build an AI management system from the ground up.