ISO/IEC 42001:2023 is the certifiable management-system standard for artificial intelligence — the “ISO 27001 for AI.” ITSECOPS runs ISO 42001 readiness on the same AI GRC platform we use for ISO 27001 and SOC 2: your AI systems are inventoried automatically, impact assessments and AIMS documentation are AI-drafted and expert-reviewed, and readiness costs about 60% less than a manual engagement.
Over 350 organisations worldwide already hold ISO 42001 certificates — AWS, Microsoft, Anthropic, KPMG and ServiceNow among them — and enterprise procurement teams have started writing it into vendor requirements for any product with AI in it. If you sell AI features to regulated or enterprise customers, the question is no longer whether you will be asked for it, but when.
What ISO 42001 actually requires
The standard defines an AI Management System (AIMS): 10 management clauses plus 38 Annex A controls covering fairness, transparency, explainability, data governance, human oversight and incident response. In practice, certification stands on four artefacts:
- AI system inventory — a live registry of every AI system you build or consume, with owners and intended purpose.
- AI Impact Assessments (AIIA) — documented analysis of who each system can affect and how, with risk treatment.
- Statement of Applicability — which Annex A controls apply, how they are implemented, and the evidence behind each.
- Operational proof — logs, reviews, incident drills and monitoring showing the AIMS actually runs between audits.
Who is already certified (and what it took)
| Organisation | Certified | Scope / note |
|---|---|---|
| AWS | Nov 2024 | First major cloud provider — Bedrock, Q Business, Textract, Transcribe |
| KPMG Australia | Dec 2024 | First organisation globally to certify (BSI) |
| Anthropic | Jan 2025 | Frontier AI lab |
| Microsoft | 2025 | GitHub Copilot, Microsoft 365 Copilot, Copilot Studio, Security Copilot |
| Unique AG (Switzerland) | Mar 2025 | 100-person fintech SaaS — certified in 3 months, first audit attempt, using automated evidence tooling |
| ServiceNow, Snowflake, Synthesia, KnowBe4… | 2025–2026 | 350+ certificates globally and accelerating |
The Unique AG case is the one that matters for mid-sized companies: with an AI-governance platform handling the registry, evidence and first-draft documentation, they cut manual documentation effort by ~75% and certified in three months. That is exactly the delivery model ITSECOPS uses. See more examples in our ISO 42001 case-studies roundup.
Our ISO 42001 readiness programme
- Scoping & gap analysis (weeks 1–2) — we inventory your AI systems (built and bought), map existing ISO 27001/SOC 2 controls onto the 38 Annex A controls, and give you a fixed-scope plan.
- AIMS build (weeks 3–8) — AI policy, roles, impact assessments and Statement of Applicability, AI-drafted from your real environment on our AI GRC platform and reviewed by named consultants.
- Evidence automation — collectors pull model-usage logs, access reviews and monitoring proof on a schedule, so evidence is audit-ready continuously, not gathered in a panic before Stage 2.
- Internal audit & certification support — we run the internal audit, fix findings, and sit with you through the certification body’s Stage 1 and Stage 2.
Cost and timeline, honestly
| Typical market figures | With ITSECOPS AI GRC | |
|---|---|---|
| Timeline | 4–12 months (3–4 months for small, focused scopes) | 3–5 months for most SMB/SaaS scopes |
| Consulting & implementation | $6,000–$25,000+ | ~60% lower for comparable scope — automation removes evidence and first-draft hours |
| Certification body audit fees | $3,500–$5,000+ (paid to the certifier, not us) | Same — but shorter auditor time with pre-organised evidence |
| Surveillance (years 2–3) | 20–30% of initial cost annually | Largely absorbed by continuous evidence collection |
Already ISO 27001 certified? You are halfway there
ISO 42001 shares the harmonised management-system structure with ISO 27001 — context, leadership, planning, support, operation, evaluation, improvement. Your existing ISMS policies, risk process, internal-audit rhythm and much of the evidence reuse directly; what is genuinely new is the AI system registry, the impact assessments and the AI-specific Annex A controls. Multi-framework clients on our platform collect evidence once and map it to every standard that needs it.
Frequently asked questions
How much does ISO 42001 certification cost?
For small and mid-sized organisations, market figures run $4,000–$20,000+ all-in: $3,500–$5,000 in certification-body audit fees plus $6,000–$25,000 in consulting and implementation. Automated evidence collection and AI-drafted documentation are where the savings live — that is how our readiness engagements come in around 60% below traditional consulting quotes.
How long does ISO 42001 certification take?
Most organisations take 4–12 months. Small, well-scoped companies can do it in 3–4 months — Unique AG certified in three months on their first audit attempt using automated tooling. Timeline is driven by how fast you can inventory AI systems and produce credible impact assessments.
Do we need ISO 27001 before ISO 42001?
No — ISO 42001 is a standalone certification. But if you hold ISO 27001, roughly half the management-system work is already done, and certification bodies offer integrated audits. If you have neither and need both, implementing them together is cheaper than sequentially.
Does ISO 42001 cover EU AI Act compliance?
It is the closest thing to a recognised compliance vehicle. The EU AI Act’s obligations for risk management, data governance, transparency and human oversight map heavily onto ISO 42001’s controls, and certification is strong evidence of a functioning AI governance system — though the Act has product-level requirements the standard alone does not discharge.
Who needs ISO 42001?
Any company that builds AI products, embeds AI features in software it sells, or deploys AI in decisions affecting people — and especially vendors selling into enterprises, banks, healthcare or the public sector, where procurement questionnaires now ask for it by name.
Get an ISO 42001 gap analysis on real data
Book a free scoping call. We will inventory your AI systems, map your existing controls onto the 38 Annex A controls, and give you a fixed price and timeline — with and without evidence automation.
Prefer to ask live? We run a free AI compliance webinar every Thursday and Friday at 9:00 AM ET covering ISO 42001, the EU AI Act and automated evidence. Register for a session.