Get ISO 42001 certified when a live deal or a named customer requires the certificate in writing, and align to the standard without an audit until then. If you sell AI into regulated buyers and their questionnaires already ask, start now, because the system has to run for months before an auditor can pass it. If you want it to satisfy the EU AI Act, spend the money elsewhere: the harmonised standard for that is EN 18286.
An ISO 42001 certificate is an accredited auditor's finding that your organization runs an AI management system meeting the standard. It says nothing direct about whether a given model is accurate, fair or safe.
| Option | What the buyer sees | 3-year audit fees | Pick it when | Do not pick it when |
|---|---|---|---|---|
| ISO 42001, accredited | Certificate with a stated scope | $14K to $38K (Vanta's estimates) or $46K to $80K+ (Schellman's figures) | A customer requires it, or AI is your product and regulated buyers ask | Nobody has asked and you only use AI internally |
| ISO 27001 | Security certificate | Not priced here | Buyers ask about security in general | You expect it to answer AI governance questions |
| SOC 2 with ISO 42001 controls | CPA report, no certificate | Quote from your CPA firm | You already have SOC 2, and US buyers accept a report | The contract says "certified" |
| NIST AI RMF | Your own documentation | None, there is no certificate | You need internal discipline first | A customer wants outside proof |
| EN 18286 | Quality system built for Article 17 | No published figure found | You provide high-risk AI systems in the EU | You are a deployer, or outside the high-risk rules |
The loser is any ISO 42001 certificate from a body without accreditation for this standard. You pay for an audit and a careful buyer can reject the result. Fees above are audit-only for one management system over one three-year cycle, checked November 1, 2026. They exclude readiness work, internal labour and recertification.
What ISO 42001 Certifies and What It Leaves Out
ISO 42001 certifies a management system, meaning the policies, objectives and processes an organization uses to develop, provide or use AI responsibly. Its Annex A has 38 controls, and it requires an AI system impact assessment at clause 6.1.4.
A CEPA analysis from August 2026 sets out the limits: the certificate does not guarantee accurate answers from ChatGPT, that Claude cannot be misused, or that Gemini is free from bias. It shows an outside auditor found the management process meets the standard.
Scope is the second limit. AWS certified Bedrock, Q Business, Textract and Transcribe in its initial November 2024 certificate. Microsoft lists its in-scope services by name, including GitHub Copilot, Copilot Studio and Foundry. A certificate on one product line tells you nothing about the product next to it.
Certification also does not pass down from your vendors. Microsoft says you can use its certificate in your own compliance assessment, but "You're responsible, however, for engaging an assessor" to evaluate your organization and your implementation. Running on certified Copilot gives you evidence for your supplier file and nothing more.
How Much Existing ISO 27001 and SOC 2 Work Carries Over?
Expect roughly a third of the requirements to carry over, mostly the management system machinery. One published figure comes from Drata, which sells compliance software: its SOC 2, ISO 27001 and privacy work covered about 35-40% of ISO 42001. Treat it as one vendor's self-report.
ISO 27001 gives you the most. Both standards put Clauses 4 to 10 in the same sequence, so you can run one management system for both, and a Schellman manager says risk assessment, internal audit, incident response and performance monitoring controls can be reused. ISO 27001 is not a prerequisite. The Annex A lists share few subjects, though, and the same Modulos comparison notes that conformity with one does not show conformity with the other. New work sits where Drata says it did: impact assessments, fairness, model governance and lifecycle documentation.
SOC 2 is an attestation, not a certification, so a CPA issues a report and nobody issues a certificate. Schellman describes a route where you test ISO 42001's Annex A in Section 4 of a SOC 2+ report. That helps with a buyer who wants AI controls examined, and it does nothing for a contract that says "certified". The criteria are also moving: the AICPA's exposure draft, reported October 28, 2026, adds points of focus on AI governance, model monitoring and prompt manipulation, with comments due January 15, 2027 and application to engagements starting on or after December 31, 2027 if approved. Wait for the final text before you assume SOC 2 alone will answer AI questions.
NIST AI RMF is intended for voluntary use and carries no certificate. Practitioner Jeffery Moore gets the distinction right: ISO 42001 is the path to a certificate, NIST AI RMF to a self-attestation document. The pattern he says teams might settle into, NIST first and certification once the documentation is ready, is the cheap way to stay ready without paying an auditor yet. CSA's AI Controls Matrix mapping to ISO 42001 gives you a control-by-control view if you are starting from that matrix.
What Does ISO 42001 Certification Cost?
Budget $46,000 to $80,000+ in audit fees across three years if you want a planning number from a certifier, and treat anything lower as a target to test against real quotes. No neutral benchmark exists: one review found no independent, scope-normalized benchmark as of August 10, 2026. Every figure below comes from someone selling something.
| Cost line | Figure | Source and date |
|---|---|---|
| Stage 1 and Stage 2 audit | "$20,000's up to the $40,000's" | Schellman FAQ, updated June 23, 2026 |
| Surveillance, years 2 and 3 | $13,000 to $20,000+ a year | Schellman FAQ |
| Initial audit | $7,000 to $20,000 | Vanta guide, undated, checked November 1, 2026 |
| Surveillance | $3,500 to $9,000 | Vanta guide |
| Readiness or gap analysis | $3,000 to $10,000+ | Vanta guide |
| Implementation and internal audit | $10,000 to $40,000+ | Vanta guide |
| External partner, first year, 50 to 200 staff | $160,000 to $505,000 | Elevate, as reported by soc2auditors.org, mixes advisory with certification |
| Recertification | "Typically similar to initial audit fees" | Bastion, updated October 2026 |
The three-year totals in the opening table are simple arithmetic on those lines: one initial audit plus two surveillance years. Vanta's page says its overall initial estimate rests on anecdotal data. Its illustrative table for up to 50 stakeholders runs lower still, at $10,000 to $14,000 over three years, and its summary table starts the audit at $5,000. Schellman is the only one of these sources that issues certificates, so its number is the one to plan on until you have quotes. Surveillance is also a bigger bill than a one-off audit budget implies, since Schellman's low end for a surveillance year is 65% of its low end for year one.
Your scope drives the quote. Sensiba's audit-day estimates, reported on the same review page, run 3.5 days for a 1-10 person AI team acting as developer, provider or user, 6.5 days for multiple roles, and 13 days for an AI producer at 126-175 staff. Decide your AI roles and in-scope products before you request a quote, because a vague scope makes quotes impossible to compare.
None of these lines counts your own staff, so estimate that yourself and add it.
How Long Does ISO 42001 Certification Take?
Plan on 6 to 9 months with ISO 27001 in place and 9 to 12 months without it. Those are this guide's planning assumptions, set toward the slow end of what sellers publish, because the faster numbers assume paid help or automation.
| Situation | Published estimate | Source |
|---|---|---|
| Managed service | 4 to 6 months | Bastion |
| Self-directed | 8 to 12 months | Bastion |
| Manual | 6 to 12 months | Vanta |
| With automation | About 3 to 6 months | Vanta |
| Existing ISO 27001 | Saves 4 to 8 weeks | Bastion |
| No existing management system | Adds 4 to 8 weeks | Bastion |
| Immature AI practices | Adds 4 to 12 weeks | Bastion |
Two things limit how far a tool can compress this. NQA, as described in the same cost review, wants the system operating for at least three months, with a management review and a full internal audit cycle done first. The audit itself then takes time: Stage 1 is typically 1-2 days and Stage 2 around 1-3 weeks, depending on scope. The certificate lasts three years, with surveillance audits in years 2 and 3.
Waiting for the RFP to arrive can fail on timing alone. One Bulgarian consultancy's guide to ISO certificates in public tenders says offer windows usually run around 30 days, and that "When the tender is announced, it is already too late to start an ISO procedure." If your pipeline has a likely requirement inside 12 months, the decision is due now.
Compliance vendors such as Comp AI and Drata sell faster evidence collection, and Credo AI sells AI governance tooling. The operating period still has to run on your own systems.
Which Certification Bodies Are Accredited, and How Do You Check?
ISO does not certify anyone or accredit certifiers, so check the accreditation chain yourself before you sign. Certifiers announcing ISO 42001 accreditation include:
- BSI, with UKAS accreditation announced January 15, 2026, plus RvA and ANAB
- Schellman, described as ANAB-accredited in Anthropic's certification announcement
- Sensiba and DQS, both ANAB, announced May 2025 and February 2026
That list is a starting point and new bodies keep appearing, so run these checks on any certifier you shortlist:
- Find the certifier on its accreditation body's directory, and confirm ISO/IEC 42001 is in the accredited scope. Accreditation for ISO 27001 does not count.
- Confirm the accreditation body belongs to the IAF multilateral framework.
- Search IAF CertSearch, the database ISO points to, for certificates that body has issued, and contact the body directly on anything unclear.
The same checks work in reverse when you assess a vendor. A missing CertSearch entry is a reason to ask, and it does not prove a fake, because posting there is not compulsory for certification bodies. Ask for the scope statement, and as one procurement guide advises, the audit calendar, the last surveillance date and any non-conformities raised. Be wary of early claims in general: Schellman's Joe Sigman cites an organization that claimed certification before the final standard was published.
Is Procurement Actually Asking for ISO 42001?
Yes in questionnaires, but no public evidence shows it has become a default hard requirement. The strongest claims are the weakest sourced. A figure of 83% of Fortune 500 organisations requiring it by 2027 appears on one vendor blog credited only to unnamed "industry procurement surveys". Do not put that number in a business case.
The firmer evidence is narrower. The SIG 2026 update added a mapping to ISO 42001 and codified AI governance as a standard requirement, according to Mitratech, which sells third-party risk software. Expect reviewers to ask the question, and be ready to show controls if your answer is "not certified". CSA's STAR for AI Level 2 does require third-party ISO 42001 certification, and Microsoft and Zendesk were the first to hold it.
Certified vendors show supply more than demand. A Bright Defense review lists announcements from AWS, Anthropic and others, found no verified global adoption rate, and calls how quickly ISO 42001 becomes a default RFP requirement unresolved.
The certified population is small. The ISO Survey counted 271 ISO 42001 certificates worldwide at the end of 2025, against 125,622 for ISO 27001, per DQS's summary. That count covers accredited certificates only, in the first year the survey included the standard, and it draws mainly on IAF CertSearch. DQS warns some data may be incomplete, so treat 271 as a likely undercount that is now 10 months old. A buyer who made this a hard gate would still likely disqualify most of the market, so ask whether "in progress" or an equivalent would be accepted before you assume it would not.
BSI, which sells this certification, says 26% of organizations report taking steps to align, and alignment is a long way from a purchase requirement. A search on November 1, 2026 turned up no public tender naming ISO 42001 as mandatory, which does not prove none exists. Your own pipeline is better evidence than any of this, and you can pull it this week.
Does ISO 42001 Help With the EU AI Act?
Only indirectly. It is not the harmonised standard, so it gives you no presumption of conformity. The first harmonised standard under the Act is EN 18286, referenced through Implementing Decision (EU) 2026/2274. Providers of high-risk AI systems that build their quality system on it are presumed to conform with Article 17.
The standards committee used ISO 42001 as an input but did not make it the harmonised quality standard. A JTC 21 tracker from the vendor KLA reports the Commission found that "the goals and definitions of ISO/IEC 42001:2023 are not aligned with the quality management system required under the AI Act." The case for it as groundwork is that EN 18286's informative annexes map to ISO 42001, so certified organizations can extend an existing system. That makes ISO 42001 a useful starting point for a provider and a poor reason on its own to certify.
Timing removes the rush. The AI Omnibus moved Annex III high-risk obligations to December 2, 2027 and product-embedded systems to August 2, 2028. EN 18286 also covers only the quality management system, including post-market monitoring processes, and as of October 15, 2026 it was the only JTC 21 deliverable cited in the Official Journal, per the same tracker.
The Criteria That Predict Regret
Four questions decide this, and the first outweighs the rest.
- Is the requirement in writing? Certify if a customer's contract, RFP or renewal says "certified" and the account is worth more than your three-year cost. A workable threshold is one deal or renewal above that cost, or two live opportunities asking in writing. Below that, answer questionnaires with mapped controls.
- Are you a vendor or a user? A vendor whose product is AI gets a sales asset. An enterprise using AI internally gets a governance program it could run without the audit, so skip the certificate unless a regulator or customer asks.
- Can the system run for three months? You need an AI inventory, an owner for each system and impact assessments in use. Without those, an audit date will force paperwork, and no operational evidence for documented controls is a listed common finding.
- Will your scope match what buyers buy? A narrow scope is cheaper to audit, and it fails the buyer whose product sits outside it. Scope the product your largest prospects are purchasing.
The answer changes if a top-ten customer adds the requirement to a renewal, if you move into the EU high-risk categories (which points you to EN 18286 first), or if the final AICPA text makes SOC 2 sufficient for your US buyers.
What to Do, by Time Horizon
This Week:
- Search your last 12 months of RFPs and security questionnaires for "42001". Sort hits into required, preferred and scored, and put the revenue attached next to each.
- Ask sales which open deals inside 12 months have raised it. Get the wording.
This Month:
- Run a gap assessment against Annex A using your ISO 27001 or SOC 2 evidence, and write down your AI roles and product scope.
- Get written quotes from two accredited certifiers on that same scope, covering initial audit, both surveillance years and recertification. Verify their accreditation first.
Before Your Next Budget Close:
- If the written demand meets your threshold, fund certification and put the internal audit and management review on the calendar at least three months before Stage 1.
- If it does not, keep the alignment work, add ISO 42001 controls to your next SOC 2 if your CPA firm supports it, and re-run the search next quarter. The questions that change a vendor security review show what buyers can test beyond the certificate.
The Bottom Line
ISO 42001 is voluntary, and with 271 certificates counted at the end of 2025 it is not yet a market default. Pay for the audit when your own deals ask for it, and do the management work in the meantime, so the three-month operating period is already behind you when they do.
Search your RFP archive for "42001" this week and put the revenue next to each hit.
Continue Reading
- AI Vendor Security Review: 6 Questions That Change the Answer
- Agent Audit Logging: Platform Logs Miss the Decision You Must Prove
- SK Telecom's AI Governance Report Gives Agents Employee IDs
- Collibra Acquires Munich Startup trail ML for AI Governance
- EU AI Act Article 4 Favors Role-Based Training You Build
- Five AI Vendors Give Customers 0 to 90 Days to Get Data Out