ISO 42001 Case Studies: What the First 350+ Certified Companies Did

Updated August 2026

More than 350 organisations now hold ISO/IEC 42001:2023 certificates — from AWS, Microsoft and Anthropic to 100-person SaaS companies. The pattern across their case studies is consistent: certification takes 3–12 months, the hard work is the AI system inventory and impact assessments, and companies that automated evidence collection certified in roughly half the time at roughly half the cost.

ISO 42001 went from a brand-new standard in December 2023 to a procurement checkbox in under three years. Below are the documented case studies worth learning from — who certified, what it took, and what the first movers say — followed by the practical lessons if you are planning your own run at it.

Who has certified: the notable cases

Case study 1: AWS — certification as a sales asset

AWS certified four AI services in November 2024 through Schellman and immediately turned the certificate into customer-facing assurance: the announcement leads with what it means for customers building on Bedrock, not with AWS’s internal governance. The lesson from the hyperscaler cases (AWS, Microsoft) is that ISO 42001 is scoped to named services, not the whole company — you can certify your AI product line without boiling the corporate ocean.

Case study 2: KPMG Australia — first mover in professional services

KPMG Australia certified in December 2024 as the first organisation globally, covering its internal AI governance. For a firm that sells AI advisory, being certified before your clients ask is the point: it converts a marketing claim (“we do responsible AI”) into an audited fact. KPMG International followed with its own certificate via Schellman.

Case study 3: Unique AG — the SMB blueprint

The most useful case study for mid-sized companies is Unique AG, a ~100-person Swiss fintech SaaS certified by TÜV SÜD in March 2025. The documented numbers: three months from start to certificate, passed on the first audit attempt, ~75% reduction in manual documentation effort and ~50% lower cost versus a conventional consulting-led preparation — achieved by running the AI system registry, impact assessments and evidence collection on an automation platform instead of spreadsheets.

Their reported challenges are the ones everyone hits: unclear expectations from a young standard, finding an accredited certifier, and centralising oversight of AI systems scattered across teams. The fix in every case was a single live inventory with automated evidence attached to it.

Case study 4: the GRC vendors certifying themselves

Companies like Anecdotes.ai and KnowBe4 certified partly to eat their own cooking — Anecdotes is one of only ~30 organisations worldwide holding ISO 42001, ISO 27001 and ISO 27701 together. The triple-certification pattern matters: ISO 42001 shares its management-system skeleton with ISO 27001, so organisations that already run an ISMS reuse policies, risk processes and audit rhythms, and certifiers offer integrated audits.

Five lessons from the first 350 certificates

• 1. Scope small, certify fast. AWS certified four services, not four hundred. A tight scope statement is the single biggest timeline lever.
• 2. The AI inventory is the real project. Every case study reports the same surprise: more AI systems in use than anyone knew. You cannot assess impacts on systems you have not found.
• 3. Impact assessments are where audits are won. Auditors expect AIIAs that name affected people and concrete harms — not recycled privacy assessments.
• 4. Automation halves the bill. Unique AG’s 3-month, first-attempt certification came from automating the registry, evidence collection and first-draft documentation. Market data puts typical spend at $4,000–$20,000+ for SMBs (audit fees $3,500–$5,000; consulting $6,000–$25,000) — automation attacks the consulting line.
• 5. ISO 27001 holders are halfway there. The harmonised structure means your ISMS does double duty; what is genuinely new is the registry, the AIIAs and 38 AI-specific Annex A controls.

What certification actually costs and takes

Across published figures and the case studies above: 4–12 months end to end for most organisations, with focused SMB scopes landing in 3–5 months; certification-body fees of $3,500–$5,000+; implementation/consulting from $6,000 to $25,000+ depending on scope and how much is automated; and annual surveillance audits at 20–30% of the initial cost. Companies using evidence automation consistently report ~50% total savings.

Replicating the Unique AG playbook

ITSECOPS runs ISO 42001 readiness exactly the way the fastest case studies did it: automated AI system inventory, AI-drafted impact assessments and AIMS documentation reviewed by named consultants, and scheduled evidence collectors — on the same AI GRC platform we use for ISO 27001 and SOC 2. Details, cost table and programme phases are on our ISO 42001 readiness page.

Frequently asked questions

How many companies are ISO 42001 certified?

As of mid-2026, over 350 organisations globally hold ISO 42001 certificates, and the pace is accelerating as enterprise procurement teams begin requiring it from AI vendors.

Which was the first company certified to ISO 42001?

KPMG Australia announced the first certification globally (December 2024, via BSI). AWS was the first major cloud provider, certified in November 2024 by Schellman for Bedrock, Q Business, Textract and Transcribe.

How long did the fastest ISO 42001 certifications take?

The fastest documented SMB case is Unique AG: three months from start to certificate, passing Stage 2 on the first attempt, using an automation platform for the AI registry, impact assessments and evidence.

Is ISO 42001 certification worth it for a small AI company?

If you sell AI features to enterprises, yes — it pre-answers the AI governance section of security questionnaires and is increasingly a named procurement requirement. For SMBs the all-in cost is typically $4,000–$20,000+, substantially less with automated evidence collection.