AI Compliance Vendors

Free tool

ISO/IEC 42001 certification cost calculator (2026)

Stage 1 + Stage 2 audit fees, implementation consulting, internal labor, and surveillance audits. Ranges cite IAF MD 5:2019 audit-day tables and public certification-body rate cards. Runs entirely in your browser.

Inputs

Year 1 total
$91K - $217K
Ongoing annual (years 2-3)
$17K - $44K
Audit days
9-14 days (Stage 1 + Stage 2 combined)

Line items

  • Stage 1 + Stage 2 certification audit$23K-$63K one-time
    9-14 audit days x $2,500-$4,500/day (accredited CB)
  • Implementation consulting (year 1)$45K-$100K one-time
    Framework mapping + AIMS-specific controls
  • Internal labor (cert prep, 6 months)$23K-$54K one-time
    25%-60% FTE x $180K loaded x 0.5 yr x scope
  • Annual surveillance audit (years 2-3)$8K-$22K /yr
    ~35% of certification audit days each year

Assumptions

  • Audit-day baseline follows IAF MD 5:2019 brackets, applied to AIMS with conservative widening pending mature AIMS-specific IAF guidance.
  • Accredited-path rates reflect US/EU public CB rate cards from BSI, TUV SUD, Schellman, A-LIGN, Coalfire ISO. Direct-path rates reflect non-accredited certification bodies.
  • Implementation ranges assume the maturity you selected. Greenfield includes AIMS policy suite, risk register, statement of applicability, and internal audit.
  • Internal labor is 6 months of prep at $180K loaded US-metro salary. Adjust down for lower-cost geographies.
  • Scope multiplier applied to both audit days and implementation: 0.65x for single product, 1.0x for business unit, 1.55x for enterprise.
  • Ranges are directional. Get 3 accredited-CB quotes before locking a budget.

How ISO/IEC 42001 cost breaks down

ISO/IEC 42001:2023 is the first international management-system standard for AI. Certification cost has four components, in roughly this order of magnitude for a mid-market deployer:

  1. Implementation consulting — typically the largest line item for greenfield programs. Ranges from $30K (small, mature) to $550K (enterprise, greenfield).
  2. Stage 1 + Stage 2 certification audit — audit days x daily rate. Accredited certification bodies charge $2,500-$4,500 per audit day; direct-path bodies charge $1,800-$3,200.
  3. Internal labor — typically 0.15-1.2 FTE for 6 months, depending on size. Costed at $180K loaded US-metro salary.
  4. Surveillance audits — years 2 and 3 at roughly 35% of certification-audit day count.

Two levers dominate: existing maturity (ISO 27001 in place saves 40-50% on implementation) and scope (single-product scope saves 35% versus one business unit).

When ISO/IEC 42001 is worth the cost

  • You sell AI to enterprises, financial services, healthcare, or government and are being asked for ISO 42001 in RFPs and vendor questionnaires.
  • You place high-risk AI systems on the EU market and want a presumption of conformity with EU AI Act Articles 9-15 once ISO 42001 is fully harmonized under Article 40.
  • You already have ISO 27001 and want to add AI-specific controls in a form your existing auditor can verify.
  • Your board or investors have asked for a defensible, third-party-verified AI governance program.

If none of the above apply, NIST AI RMF or a lightweight internal AI Management System may deliver more value per dollar in 2026.

Frequently asked

How much does ISO/IEC 42001 certification cost in 2026?

Combined Stage 1 + Stage 2 certification audit fees typically run $25K-$75K for a 51-200 person company at a single business unit scope on the accredited path. Add implementation consulting ($45K-$100K if ISO 27001 is already in place, more for greenfield) and internal labor (~$25K-$65K for 6 months of prep). Year-one total for a mid-market deployer is typically $95K-$240K.

What is the difference between Stage 1 and Stage 2 audits?

Stage 1 is a documentation review — the auditor verifies that your AI Management System (AIMS) policies, risk register, statement of applicability, and internal-audit records exist and are internally consistent. Stage 2 is the certification audit proper — the auditor tests whether the AIMS operates as documented. Stage 1 is typically 30-40% of combined audit days, Stage 2 is the remainder.

How many audit days does ISO/IEC 42001 require?

The AIMS-specific audit-day guidance is still consolidating; most accredited bodies apply IAF MD 5:2019 brackets from ISO 27001 as a baseline, then widen for AIMS-specific control complexity. A 51-200 person business unit typically requires 9-14 combined audit days.

Does having ISO 27001 already in place reduce ISO 42001 cost?

Yes, materially. Roughly 40-55% of ISO 42001 Annex A controls overlap with ISO 27001 Annex A (2022 revision). Implementation consulting drops 40-50% versus greenfield, and audit days may drop 10-15% if the auditor combines audits.

What is the difference between accredited and direct-path certification?

Accredited certification bodies operate under IAF MLA (International Accreditation Forum Multilateral Recognition Arrangement) and their certificates are recognized globally. Direct-path (non-accredited) bodies are cheaper (~30-40% lower daily rates) but customers, regulators, and procurement teams may not accept the certificate. For EU AI Act Article 40 harmonized-standard purposes and enterprise procurement, accredited is the safe choice.

How long does an annual surveillance audit cost?

Surveillance audits in years 2 and 3 are typically 30-40% of the certification-audit day count. Re-certification in year 3 is roughly 65-75% of the original Stage 1 + Stage 2 audit-day count.

Do I need to certify enterprise-wide or can I scope narrowly?

You can scope to a single AI system, product line, or business unit. Narrow scope drops cost roughly 35% versus one business unit; enterprise scope adds roughly 55%. Narrow scope only works if the AIMS is truly separable — otherwise the auditor will insist on expanding the scope.

Can I self-certify to ISO/IEC 42001?

No. ISO/IEC 42001 is a management-system standard that requires third-party certification to be recognized. You can self-attest to conformance for internal or customer trust purposes, but that is not a certification.

How does ISO 42001 relate to the EU AI Act?

ISO/IEC 42001 is expected to become a harmonized standard under EU AI Act Article 40, giving certified organizations a presumption of conformity with the risk-management, data-governance, transparency, human-oversight, and accuracy requirements of Articles 9-15. The formal harmonization process is underway but not complete as of 2026.

What is the fastest realistic timeline to certification?

Greenfield: 9-14 months. ISO 27001 in place: 5-9 months. Mature AI governance program: 3-6 months. Timeline is dominated by internal-audit and management-review cycles, not by the external audit itself.

Related tools

Get real ISO 42001 quotes

Once you have a range, we can route your request to accredited certification bodies and implementation consultants that match your scope. We disclose which vendors will see your details before we send anything.

Get ISO 42001 quotes

Embed this calculator

<iframe
  src="https://aicompliancevendors.com/tools/iso-42001-certification-cost"
  width="100%"
  height="1600"
  loading="lazy"
  style="border:0"
  title="ISO/IEC 42001 Certification Cost Calculator"
></iframe>

Disclaimer

This calculator produces directional ranges for budgeting purposes. It is not a quote and is not legal, accounting, or accreditation advice. Get quotes from at least three accredited certification bodies and one implementation consultant before locking a budget or committing to a timeline.