AI Compliance Vendors

Certification guide

ISO 42001 certification, step by step

Getting certified to ISO/IEC 42001 means building an AI management system, running it, and having an independent certification body audit it in two stages [1][2]. This guide walks through each step, how to choose an accredited auditor, what drives audit days and cost, and what happens after the certificate is issued. For what the standard itself requires, see our ISO 42001 guide.

Reviewed 15 Oct 2026 · next review by 13 Jan 2027 · 25 sources · report an error

Decide three things before you start

  1. Scope. Certificates cover the scope you define, not automatically the whole company. Published scopes range from a single product family, such as IBM’s certificate for its Granite models, to company-wide AI programs [19]; see real scopes on our certified companies list. Because audit time depends on factors such as the number of AI systems in scope, a narrower first scope generally means fewer audit days [16].
  2. Your role. Decide which AI roles you play for each system in scope, such as AI provider, AI producer, AI customer or AI partner (the roles defined in ISO/IEC 22989 and listed in clause 4.1). Controls that don’t fit your role are excluded, with reasons, in the Statement of Applicability [18][25].
  3. Integration. If you already hold ISO 27001, ISO 42001 uses the same harmonized clause structure, so you can extend one management system (shared document control, internal audit and management review) rather than build a second one [18].

The certification path, step by step

  1. 01

    Gap analysis

    Compare your current AI governance with clauses 4–10 and the 38 Annex A controls, and agree the scope [2].

  2. 02

    Design the AI management system

    Write the AI policy, assign roles, set your AI risk assessment method and criteria, and define the impact assessment process [2].

  3. 03

    Implement and operate

    Run risk and impact assessments for each AI system in scope, select controls, produce the Statement of Applicability, train staff and start collecting evidence [2][25].

  4. 04

    Internal audit and management review

    Audit your own AIMS and hold a management review before the certification audit; Schellman notes the standard requires an internal audit of the AIMS every year [2].

  5. 05

    Pick an accredited certification body

    Check its ISO/IEC 42001 accreditation in the accreditation body’s directory and get a quote based on audit days (see below) [6].

  6. 06

    Stage 1 audit

    The auditor reviews the design and documentation of the AIMS and raises any areas of concern to fix before Stage 2 [2].

  7. 07

    Stage 2 audit

    The auditor tests whether the AIMS operates as designed, including clause 8 operations, monitoring, internal audit and management review [2].

  8. 08

    Certification decision

    Once any nonconformities are resolved, the certification body issues a three-year certificate stating your scope [2][3].

  9. 09

    Surveillance and recertification

    Expect a surveillance audit at least once each calendar year, the first within 12 months of the decision, and a full recertification audit before the certificate expires [3].

Choosing an accredited certification body

A certificate from an accredited certification body means the body has been assessed by a national accreditation body against ISO/IEC 17021-1 and, now, ISO/IEC 42006:2025, the AI-specific requirements for auditing AI management systems [4][10]. Ask for the accreditation and check it in the accreditation body’s directory before you sign [6].

Accreditation programs for ISO/IEC 42001 certification bodies
Accreditation bodyMilestoneExamples of accredited certification bodies
ANAB (United States)Program launched January 2024 [6]Announced: Schellman, the first (24 Sep 2024) [7]; A-LIGN (23 Oct 2024) [8]; Coalfire (18 Jun 2025) [11]; DQS (26 Feb 2026) [12]; BSI (March 2026) [13]
UKAS (United Kingdom)First AIMS accreditation granted to BSI, January 2026 [9]BSI [9]; TÜV NORD [14]
RvA (Netherlands)Accredited bodies include BSI and TÜV NORD [13][14]BSI; TÜV NORD
SCC (Canada)Accredited bodies moved to ISO/IEC 42006:2025 from August 2025 [5]See the SCC directory
Examples, not a complete list; accreditations change, so always check the directory. Compare firms on our ISO 42001 audit firms page.

Audit days and timeline

Audit fees are mostly a function of audit days. ISO/IEC 42006 sets how certification bodies calculate audit time for an AI management system [5]. One analysis of the standard reports that the factors include the number of AI systems, high-risk uses, the regulations in scope and third-party AI relationships, and that recertification audits are generally at least two-thirds of the initial audit time [16].

There is no official benchmark for how long certification takes. Compliance vendor Vanta puts it at 6 to 12 months for programs run on manual processes and about 3 to 6 months with automation [15], and Schellman says Stage 1 and Stage 2 each take several days depending on scope [2]. The biggest variable is how much of the AIMS already exists: an organization with ISO 27001 can reuse its management-system processes [18].

What certification costs

The standard costs CHF 225 from ISO [17]. The rest depends on scope and how much you do in-house. Published figures come from vendors rather than any official survey, so treat them as ranges, not quotes:

Published ISO 42001 cost ranges (vendor estimates)
Cost itemPublished rangeSource
Gap or readiness assessment$3,000–$10,000+Vanta [15]
Implementation and internal resources$10,000–$40,000+Vanta [15]
Initial certification audit$5,000–$20,000 (its body text says $7,000–$20,000)Vanta [15]
Surveillance audits (yearly)$3,500–$9,000Vanta [15]
Initial certification total“Several thousand dollars to $75,000+”Vanta [15]
Total (GBP)£8,000–£50,000+ISMS.online [21]
Both sources sell compliance software. Totals rise with the number of AI systems in scope, consulting support and the internal time you count.

After the certificate

  • Keep the AIMS running. Surveillance audits check that risk and impact assessments, internal audits and management reviews keep happening, at least once a calendar year [3].
  • Re-assess when things change. New AI systems, new uses or significant changes trigger new risk and impact assessments (clauses 8.2–8.4) and may need a scope extension [20].
  • Recertify before expiry. The three-year cycle ends with a recertification audit, which must finish before the certificate lapses [3].
  • Publish the scope. Share the certificate’s scope statement with customers so they can see exactly which products and roles it covers.

Certification is not EU AI Act conformity

An ISO 42001 certificate is not a conformity assessment under the EU AI Act and gives no presumption of conformity: the Commission says the standard is not aligned with the quality management system the Act requires [22][23]. On 14 October 2026 the Commission cited EN 18286:2026, a quality management standard written for the AI Act, as the Act’s first harmonised standard [24]. A certified AIMS is useful groundwork, but providers of high-risk AI systems still need system-level documentation, testing and conformity assessment [23]. More in our ISO 42001 guide.

Tools and help

Frequently asked questions

+How long does ISO 42001 certification take?

There is no official benchmark. Compliance vendor Vanta estimates 6 to 12 months for manual programs and about 3 to 6 months with automation [15], and Stage 1 and Stage 2 audits each take several days depending on scope [2]. Organizations that already run ISO 27001 can reuse much of their management system [18].

+How much does ISO 42001 certification cost?

The standard is CHF 225 [17]. Vendor-published totals range from several thousand dollars to $75,000 or more [15], driven by audit days, consulting and internal time. Our cost calculator gives an estimate for your size and scope.

+Do I need an accredited certification body?

It isn’t legally required, but an accredited certificate comes from a body checked against ISO/IEC 17021-1 and ISO/IEC 42006 [4][10]. Check accreditation in the directory of ANAB, UKAS or another national accreditation body [6].

+How long is an ISO 42001 certificate valid?

Three years, provided you pass a surveillance audit at least once each calendar year; a recertification audit before expiry starts a new cycle [3].

+Can we certify just one product or business unit?

Yes. You define the scope, and published certificates range from a single model family to company-wide programs [19]. Make sure customers can see exactly what the scope covers.

+Does ISO 42001 certification make us EU AI Act compliant?

No. It is not a harmonised standard and is not a conformity assessment [22][23]. The AI Act’s first harmonised standard is EN 18286:2026 for quality management [24].

Sources

  1. [1]ISO, ISO/IEC 42001 explained: what it is (2026-08-31).
  2. [2]Schellman, Guide to ISO 42001 certification.
  3. [3]Bureau Veritas, Certification process (three-year cycle, surveillance and recertification).
  4. [4]ISO, ISO/IEC 42006:2025 — Requirements for bodies providing audit and certification of AI management systems (2025-07).
  5. [5]Standards Council of Canada, Bulletin: transition to ISO/IEC 42006:2025 (2025-08-28).
  6. [6]ANAB, ISO/IEC 42001 AI management systems accreditation program (2024).
  7. [7]Schellman, Schellman becomes first ISO 42001 ANAB-accredited certification body (2024-09-24).
  8. [8]A-LIGN, A-LIGN achieves ISO 42001 accreditation (2024-10-23).
  9. [9]UKAS, UKAS grants first AIMS accreditation (2026-01-15).
  10. [10]UKAS, AI management systems (AIMS) accreditation programme.
  11. [11]Coalfire, Coalfire earns ANAB accreditation for ISO 42001 (2025-06-18).
  12. [12]DQS, DQS receives ANAB accreditation for ISO/IEC 42001 (2026-02-26).
  13. [13]BSI, BSI secures ANAB accreditation to certify ISO/IEC 42001 (2026-03).
  14. [14]TÜV NORD, TÜV NORD Group achieves ISO 42001 accreditation for AIMS (2026-02-06).
  15. [15]Vanta, ISO 42001 certification cost.
  16. [16]Bright Defense, ISO 42006 raises the bar for ISO 42001 certifiers.
  17. [17]ISO, ISO/IEC 42001:2023 (catalog page and price) (2023-12).
  18. [18]ISO/IEC via iTeh Standards, ISO/IEC 42001:2023 official sample (introduction: harmonized structure; clause 4).
  19. [19]IBM, IBM Granite achieves ISO/IEC 42001 certification (2025-10-01).
  20. [20]Schellman, What are the ISO 42001 requirements?.
  21. [21]ISMS.online, ISO 42001 certification cost.
  22. [22]European Commission, Understanding standardisation under the AI Act (FAQ) (2026-03-10).
  23. [23]LRQA, What ISO 42001 does and does not get you under the EU AI Act (2026-10-11).
  24. [24]Official Journal of the EU, Commission Implementing Decision (EU) 2026/2274 (EN 18286:2026) (2026-10-14).
  25. [25]Konfirmity, ISO 42001 Statement of Applicability.

How we keep this page current

Every claim links to its source. We re-check this page at least every 90 days, and sooner when a standard, law or vendor changes; vendor names, acquisitions and shutdowns update automatically from our directory. Vendors cannot pay to be included or ranked.