ISO/IEC 42001 · Decision

How to choose an ISO/IEC 42001 certification body

Updated 12 July 2026 · 6 min read

Key takeaway

Only certification bodies accredited under ISO/IEC 17021-1 can issue a recognised ISO/IEC 42001 certificate. Under that same standard, a body that helped design, implement or operate your AI management system cannot then certify it — the independence rule is absolute, and any body that offers you 'implementation and certification as a bundle' is either not accredited or is offering to breach 17021. Verify accreditation directly on the accreditation body's register (UKAS in the UK, ANAB in the US, and their equivalents worldwide), and choose a body with genuine AI-domain competence, not only ISO management-system experience.

Only accredited bodies can certify — accreditation is public and verifiable on the accreditation body's register.
ISO/IEC 17021 prohibits the same body from consulting on the AIMS and then auditing it.
'Bundle deals' for implementation + certification are a warning sign; the accredited body cannot honestly offer both.
Choose a body with AI-domain audit competence, not only management-system experience.
Ask about auditor CVs, audit-day methodology, and their scheme for ISO/IEC 42001 specifically.
General information, not legal advice. Current as of July 2026.

The independence rule

ISO/IEC 17021-1 governs conformity assessment bodies. It requires that certification decisions be made independently of any consulting or implementation work on the management system being certified. In plain language: the firm that helped you build your AIMS cannot then audit it. A recognised certificate depends on this independence; without it the certificate is worthless.

Consequences for how you buy help

You will use two different parties. An implementation partner (a specialist consultancy, an integrator, a vCISO firm) can help design and stand up the AIMS. A certification body then, independently, audits it. Both roles are legitimate; combining them in one firm for the same engagement is not.

This is why the Hael partner programme is explicitly for implementation firms only. We support consultancies and integrators that help clients build the AIMS; we do not — and could not — operate as an accredited certification body ourselves without breaching 17021.

Publicly recognised bodies certifying to ISO/IEC 42001

Several established certification bodies are actively certifying against ISO/IEC 42001, including BSI, Schellman, SGS, CertX and DNV. This is not an endorsement or a complete list; verify current accreditation status on the accreditation body's public register before engaging.

How to verify accreditation

In the UK: check the UKAS directory of accredited bodies and scopes.
In the US: check the ANAB directory.
Internationally: check the IAF's global directory, which links to national accreditation bodies.
For any body: ask for the scope of their accreditation and confirm ISO/IEC 42001 is listed on it, not only ISO/IEC 27001 or ISO 9001.

What to ask before engaging

Which accreditation body accredits you for ISO/IEC 42001 specifically, and what is the scope?
How many ISO/IEC 42001 audits have you completed and against what kinds of scopes?
Who would lead our audit team; what is their AI-domain background beyond ISO management-system experience?
How do you calculate audit days for our scope, and how does that compare to IAF guidance?
How do you handle non-conformities, and what is your appeals process?

Key terms

ISO/IEC 17021-1: The standard governing conformity-assessment bodies, including the independence rule between consulting and certification.
Accreditation body: The national body (e.g. UKAS, ANAB) that accredits certification bodies to issue recognised certificates.

References

Related guides