How much does ISO/IEC 42001 certification cost?
- The certification-body audit fee is the main external cost; scope drives it, not headline size.
- Surveillance audits recur annually; recertification typically every three years.
- Internal effort — building and operating the AIMS — is the largest true cost.
- Organisations already on ISO 27001 spend materially less because the management-system machinery already exists.
- Any figure quoted without a scope statement is meaningless — treat it as marketing.
- General information, not legal advice. Current as of July 2026.
The three cost lines
Three separate lines make up the real cost of ISO/IEC 42001 certification. Confusing them is where most published estimates go wrong.
- Certification-body fees — Stage 1 and Stage 2 audits performed by the accredited body, plus annual surveillance audits and a recertification audit typically every three years.
- Internal effort — the time your staff spend building, operating and evidencing the AIMS. This is by far the largest cost for most organisations and rarely appears in headline quotes.
- Tooling and external support — the software you use to run the AIMS and, where relevant, an implementation partner. Implementation partners cannot then certify you (that is prohibited under ISO/IEC 17021).
What drives the audit fee
Certification bodies quote against scope. The variables are the number of employees in the AIMS scope, the number and complexity of AI systems, the number of sites, and whether existing management-system certifications (27001, 9001) reduce audit days. Accredited bodies must follow IAF mandatory documents on audit-time calculation, so quotes across bodies for the same scope are usually within a comparable range.
Why we won't quote a number
Because it would be dishonest. A two-person AI startup and a global bank both certify to the same standard, but their audits cost radically different amounts. A single quoted 'ISO 42001 price' is either a range so wide it means nothing, or a specific number that fits one scope and misleads for every other. Ask a certification body for a quote against your actual scope; that number will be real.
The two market lies about cost
There are two claims to distrust immediately. The first is 'certified in two weeks for a fixed subscription' — that is selling a subscription, not certification, and no accredited body can complete Stage 1 and Stage 2 audits on that timeline. The second is a five- or six-figure fixed price for 'end-to-end certification' with no scope statement — that is a package built for margins, not for your organisation. Real prices come from an accredited certification body quoting your real scope.
Where the true cost sits
For every organisation that has certified, the audit invoice is a fraction of the total. The bulk is the internal work: writing the AI policy, building the AI system register, operating impact assessments and vendor assessments, running the internal audit programme, and holding a management review the leadership team actually attends. Software that generates and maintains those records from your live systems is where real cost reduction happens — not on the audit fee.
Key terms
- Stage 1 / Stage 2 audit
- The two-part initial certification audit performed by an accredited body.
- Surveillance audit
- The annual audit that maintains the certificate between full recertifications.
- Audit-time calculation
- The IAF-mandated method a certification body uses to size and price an audit against scope.